@strapi/admin 5.57.0 → 5.59.0

package/dist/server/shared/utils/session-auth.js

@@ -23,9 +23,75 @@ const getAccessCookieName = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.name');
     return authCookieName.resolveAuthCookieName(configured, warnViaStrapiLog);
 };
-const getAccessCookiePath = ()=>{
+// The admin API routes are mounted under `/admin` whatever `admin.url` is.
+const ADMIN_API_PREFIX = '/admin';
+const getConfiguredCookiePath = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.path');
-    return authCookiePath.resolveAuthCookiePath(configured, warnViaStrapiLog);
+    return typeof configured === 'string' && configured.trim() !== '' ? configured : undefined;
+};
+/**
+ * Path the browser sees for one of the resolved absolute URLs, so it includes
+ * a `server.url` subpath (`admin.path` does not). No trailing slash, except
+ * for the root.
+ */ const getBrowserPath = (key)=>{
+    const absoluteUrl = strapi.config.get(key);
+    if (typeof absoluteUrl !== 'string' || absoluteUrl === '') {
+        return undefined;
+    }
+    try {
+        return new URL(absoluteUrl).pathname.replace(/\/+$/, '') || '/';
+    } catch  {
+        return undefined;
+    }
+};
+/**
+ * Path the browser uses for the admin API (`/admin/access-token`,
+ * `/admin/login`, `/admin/logout`): `/admin` behind any `server.url` subpath.
+ */ const getAdminApiPath = ()=>{
+    const serverPath = getBrowserPath('server.absoluteUrl');
+    const apiPath = serverPath && serverPath !== '/' ? `${serverPath}${ADMIN_API_PREFIX}` : ADMIN_API_PREFIX;
+    return authCookiePath.resolveAuthCookiePath(apiPath, warnViaStrapiLog);
+};
+// RFC 6265 section 5.1.4: whether the browser attaches a cookie scoped to
+// `cookiePath` to a request for `requestPath`.
+const cookiePathMatches = (cookiePath, requestPath)=>{
+    if (requestPath === cookiePath) {
+        return true;
+    }
+    return requestPath.startsWith(cookiePath) && (cookiePath.endsWith('/') || requestPath.charAt(cookiePath.length) === '/');
+};
+/**
+ * Path of the non-httpOnly access cookie. Only the admin panel reads it,
+ * through `document.cookie`, which exposes a cookie only on pages its path
+ * matches. So when `admin.auth.cookie.path` is unset it follows the path the
+ * browser loads the panel from (`admin.url`, behind any `server.url` subpath).
+ * The admin build resolves the same value (create-build-context.ts).
+ */ const getAccessCookiePath = ()=>{
+    return authCookiePath.resolveAuthCookiePath(getConfiguredCookiePath() ?? getBrowserPath('admin.absoluteUrl'), warnViaStrapiLog);
+};
+const warnedRefreshCookiePaths = new Set();
+/**
+ * Path of the httpOnly refresh cookie (and every other cookie built from
+ * `getRefreshCookieOptions`). Only the admin API reads it, and the API does not
+ * move with `admin.url`, so it follows the API path instead of the panel.
+ * `admin.auth.cookie.path` is kept when it covers the API path. Otherwise the
+ * browser would never send the cookie to `/admin/access-token` and every
+ * session would end when its access token expires, so the API path is used.
+ */ const getRefreshCookiePath = ()=>{
+    const apiPath = getAdminApiPath();
+    const configured = getConfiguredCookiePath();
+    if (!configured) {
+        return apiPath;
+    }
+    const configuredPath = authCookiePath.resolveAuthCookiePath(configured, warnViaStrapiLog);
+    if (cookiePathMatches(configuredPath, apiPath)) {
+        return configuredPath;
+    }
+    if (!warnedRefreshCookiePaths.has(configuredPath)) {
+        warnedRefreshCookiePaths.add(configuredPath);
+        strapi.log.warn(`admin.auth.cookie.path "${configuredPath}" does not cover the admin API at "${apiPath}", so the browser would not send the refresh cookie to "${apiPath}/access-token". Using "${apiPath}" for the refresh cookie. The access cookie keeps "${configuredPath}".`);
+    }
+    return apiPath;
 };
 const getAccessCookieDomain = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');
@@ -39,7 +105,7 @@ const getRefreshCookieOptions = (secureRequest)=>{
     const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
     const isProduction = process.env.NODE_ENV === 'production';
     const domain = getAccessCookieDomain();
-    const path = getAccessCookiePath();
+    const path = getRefreshCookiePath();
     const sameSite = strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';
     let isSecure;
     if (typeof configuredSecure === 'boolean') {
@@ -141,6 +207,7 @@ exports.getAccessCookieDomain = getAccessCookieDomain;
 exports.getAccessCookieName = getAccessCookieName;
 exports.getAccessCookiePath = getAccessCookiePath;
 exports.getRefreshCookieOptions = getRefreshCookieOptions;
+exports.getRefreshCookiePath = getRefreshCookiePath;
 exports.getSessionManager = getSessionManager;
 exports.resolveLogoutDeviceId = resolveLogoutDeviceId;
 //# sourceMappingURL=session-auth.js.map

package/dist/server/shared/utils/session-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-auth.js","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Context } from 'koa';\nimport type { Modules } from '@strapi/types';\nimport { buildSessionMetadata } from '@strapi/utils';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\nimport { resolveAuthCookiePath } from './auth-cookie-path';\nimport { resolveAuthCookieDomain } from './auth-cookie-domain';\n\nconst ADMIN_ORIGIN = 'admin';\nconst SESSION_CONTENT_TYPE = 'admin::session';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\n// The resolvers are browser-shared (also inlined into the admin bundle) so\n// they default to console.warn; on the server, route their warnings through\n// the Strapi logger instead.\nconst warnViaStrapiLog = (message: string): void => {\n  strapi.log.warn(message);\n};\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookiePath = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.path');\n  return resolveAuthCookiePath(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookieDomain = (): string | undefined => {\n  const configured: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  return resolveAuthCookieDomain(configured, warnViaStrapiLog);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain = getAccessCookieDomain();\n  const path = getAccessCookiePath();\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n\nexport const buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\n/**\n * Resolves the device id to use when revoking sessions on logout.\n * SSO assigns deviceId server-side, so the client-provided value may not match\n * the active session row. Prefer the deviceId stored on the session backing\n * the current access token when available.\n *\n * Callers should pass `ctx.state.session.id` from the admin auth strategy and\n * the already-parsed body `deviceId` — the logout route requires authentication,\n * so sessionId is expected to be present.\n */\nexport const resolveLogoutDeviceId = async (\n  userId: string,\n  sessionId: string | undefined,\n  clientDeviceId: string | undefined\n): Promise<string | undefined> => {\n  if (!sessionId) {\n    strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');\n    return clientDeviceId;\n  }\n\n  const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({\n    where: { sessionId },\n  });\n\n  if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {\n    strapi.log.debug(\n      'resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId'\n    );\n    return clientDeviceId;\n  }\n\n  return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;\n};\n"],"names":["ADMIN_ORIGIN","SESSION_CONTENT_TYPE","REFRESH_COOKIE_NAME","warnViaStrapiLog","message","strapi","log","warn","getAccessCookieName","configured","config","get","resolveAuthCookieName","getAccessCookiePath","resolveAuthCookiePath","getAccessCookieDomain","resolveAuthCookieDomain","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","undefined","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean","buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","resolveLogoutDeviceId","userId","sessionId","clientDeviceId","debug","session","db","query","findOne","where","origin"],"mappings":";;;;;;;;;;;;AASA,MAAMA,YAAAA,GAAe,OAAA;AACrB,MAAMC,oBAAAA,GAAuB,gBAAA;AAEtB,MAAMC,sBAAsB;AAEnC;AACA;AACA;AACA,MAAMC,mBAAmB,CAACC,OAAAA,GAAAA;IACxBC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CAACH,OAAAA,CAAAA;AAClB,CAAA;MAEaI,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,qCAAsBH,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaU,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMJ,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOG,qCAAsBL,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaY,qBAAAA,GAAwB,IAAA;IACnC,MAAMN,UAAAA,GACJJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BN,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,OAAOK,yCAAwBP,UAAAA,EAAYN,gBAAAA,CAAAA;AAC7C;AAEO,MAAMc,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmBlB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMa,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,MAAAA,GAASb,qBAAAA,EAAAA;AACf,IAAA,MAAMc,IAAAA,GAAOhB,mBAAAA,EAAAA;AAEb,IAAA,MAAMiB,WACJzB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAIoB,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBU,SAAAA,EAAW;AACtCD,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLS,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQH,QAAAA;QACRI,SAAAA,EAAW,IAAA;AACXP,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAM,MAAAA,EAAQJ;AACV,KAAA;AACF;AAEA,MAAMK,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,8CAAA,EACAO,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMuB,aAAaD,MAAAA,CACjBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,6CAAA,EACAM,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEsB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACArB,aAAAA,GAAAA;AAEA,IAAA,MAAMsB,OAAOvB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIgB,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAUnD,OAAOoD,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,uBAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;AAEO,MAAME,+BAAAA,GAAkC,CAACC,GAAAA,GAC9CC,0BAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;KACjC;AAEF;;;;;;;;;AASC,IACM,MAAMC,qBAAAA,GAAwB,OACnCC,QACAC,SAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,SAAAA,EAAW;QACdtE,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CAAC,sEAAA,CAAA;QACjB,OAAOD,cAAAA;AACT,IAAA;IAEA,MAAME,OAAAA,GAAU,MAAMzE,MAAAA,CAAO0E,EAAE,CAACC,KAAK,CAAC/E,oBAAAA,CAAAA,CAAsBgF,OAAO,CAAC;QAClEC,KAAAA,EAAO;AAAEP,YAAAA;AAAU;AACrB,KAAA,CAAA;AAEA,IAAA,IAAIG,OAAAA,EAASJ,MAAAA,KAAWA,MAAAA,IAAUI,OAAAA,EAASK,WAAWnF,YAAAA,EAAc;QAClEK,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CACd,mGAAA,CAAA;QAEF,OAAOD,cAAAA;AACT,IAAA;AAEA,IAAA,OAAO,OAAOE,OAAAA,CAAQd,QAAQ,KAAK,QAAA,GAAWc,OAAAA,CAAQd,QAAQ,GAAGY,cAAAA;AACnE;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"session-auth.js","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Context } from 'koa';\nimport type { Modules } from '@strapi/types';\nimport { buildSessionMetadata } from '@strapi/utils';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\nimport { resolveAuthCookiePath } from './auth-cookie-path';\nimport { resolveAuthCookieDomain } from './auth-cookie-domain';\n\nconst ADMIN_ORIGIN = 'admin';\nconst SESSION_CONTENT_TYPE = 'admin::session';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\n// The resolvers are browser-shared (also inlined into the admin bundle) so\n// they default to console.warn; on the server, route their warnings through\n// the Strapi logger instead.\nconst warnViaStrapiLog = (message: string): void => {\n  strapi.log.warn(message);\n};\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured, warnViaStrapiLog);\n};\n\n// The admin API routes are mounted under `/admin` whatever `admin.url` is.\nconst ADMIN_API_PREFIX = '/admin';\n\nconst getConfiguredCookiePath = (): string | undefined => {\n  const configured: unknown = strapi.config.get('admin.auth.cookie.path');\n  return typeof configured === 'string' && configured.trim() !== '' ? configured : undefined;\n};\n\n/**\n * Path the browser sees for one of the resolved absolute URLs, so it includes\n * a `server.url` subpath (`admin.path` does not). No trailing slash, except\n * for the root.\n */\nconst getBrowserPath = (key: 'admin.absoluteUrl' | 'server.absoluteUrl'): string | undefined => {\n  const absoluteUrl: unknown = strapi.config.get(key);\n  if (typeof absoluteUrl !== 'string' || absoluteUrl === '') {\n    return undefined;\n  }\n\n  try {\n    return new URL(absoluteUrl).pathname.replace(/\\/+$/, '') || '/';\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * Path the browser uses for the admin API (`/admin/access-token`,\n * `/admin/login`, `/admin/logout`): `/admin` behind any `server.url` subpath.\n */\nconst getAdminApiPath = (): string => {\n  const serverPath = getBrowserPath('server.absoluteUrl');\n  const apiPath =\n    serverPath && serverPath !== '/' ? `${serverPath}${ADMIN_API_PREFIX}` : ADMIN_API_PREFIX;\n  return resolveAuthCookiePath(apiPath, warnViaStrapiLog);\n};\n\n// RFC 6265 section 5.1.4: whether the browser attaches a cookie scoped to\n// `cookiePath` to a request for `requestPath`.\nconst cookiePathMatches = (cookiePath: string, requestPath: string): boolean => {\n  if (requestPath === cookiePath) {\n    return true;\n  }\n\n  return (\n    requestPath.startsWith(cookiePath) &&\n    (cookiePath.endsWith('/') || requestPath.charAt(cookiePath.length) === '/')\n  );\n};\n\n/**\n * Path of the non-httpOnly access cookie. Only the admin panel reads it,\n * through `document.cookie`, which exposes a cookie only on pages its path\n * matches. So when `admin.auth.cookie.path` is unset it follows the path the\n * browser loads the panel from (`admin.url`, behind any `server.url` subpath).\n * The admin build resolves the same value (create-build-context.ts).\n */\nexport const getAccessCookiePath = (): string => {\n  return resolveAuthCookiePath(\n    getConfiguredCookiePath() ?? getBrowserPath('admin.absoluteUrl'),\n    warnViaStrapiLog\n  );\n};\n\nconst warnedRefreshCookiePaths = new Set<string>();\n\n/**\n * Path of the httpOnly refresh cookie (and every other cookie built from\n * `getRefreshCookieOptions`). Only the admin API reads it, and the API does not\n * move with `admin.url`, so it follows the API path instead of the panel.\n * `admin.auth.cookie.path` is kept when it covers the API path. Otherwise the\n * browser would never send the cookie to `/admin/access-token` and every\n * session would end when its access token expires, so the API path is used.\n */\nexport const getRefreshCookiePath = (): string => {\n  const apiPath = getAdminApiPath();\n  const configured = getConfiguredCookiePath();\n\n  if (!configured) {\n    return apiPath;\n  }\n\n  const configuredPath = resolveAuthCookiePath(configured, warnViaStrapiLog);\n  if (cookiePathMatches(configuredPath, apiPath)) {\n    return configuredPath;\n  }\n\n  if (!warnedRefreshCookiePaths.has(configuredPath)) {\n    warnedRefreshCookiePaths.add(configuredPath);\n    strapi.log.warn(\n      `admin.auth.cookie.path \"${configuredPath}\" does not cover the admin API at \"${apiPath}\", so the browser would not send the refresh cookie to \"${apiPath}/access-token\". Using \"${apiPath}\" for the refresh cookie. The access cookie keeps \"${configuredPath}\".`\n    );\n  }\n\n  return apiPath;\n};\n\nexport const getAccessCookieDomain = (): string | undefined => {\n  const configured: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  return resolveAuthCookieDomain(configured, warnViaStrapiLog);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain = getAccessCookieDomain();\n  const path = getRefreshCookiePath();\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n\nexport const buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\n/**\n * Resolves the device id to use when revoking sessions on logout.\n * SSO assigns deviceId server-side, so the client-provided value may not match\n * the active session row. Prefer the deviceId stored on the session backing\n * the current access token when available.\n *\n * Callers should pass `ctx.state.session.id` from the admin auth strategy and\n * the already-parsed body `deviceId` — the logout route requires authentication,\n * so sessionId is expected to be present.\n */\nexport const resolveLogoutDeviceId = async (\n  userId: string,\n  sessionId: string | undefined,\n  clientDeviceId: string | undefined\n): Promise<string | undefined> => {\n  if (!sessionId) {\n    strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');\n    return clientDeviceId;\n  }\n\n  const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({\n    where: { sessionId },\n  });\n\n  if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {\n    strapi.log.debug(\n      'resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId'\n    );\n    return clientDeviceId;\n  }\n\n  return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;\n};\n"],"names":["ADMIN_ORIGIN","SESSION_CONTENT_TYPE","REFRESH_COOKIE_NAME","warnViaStrapiLog","message","strapi","log","warn","getAccessCookieName","configured","config","get","resolveAuthCookieName","ADMIN_API_PREFIX","getConfiguredCookiePath","trim","undefined","getBrowserPath","key","absoluteUrl","URL","pathname","replace","getAdminApiPath","serverPath","apiPath","resolveAuthCookiePath","cookiePathMatches","cookiePath","requestPath","startsWith","endsWith","charAt","length","getAccessCookiePath","warnedRefreshCookiePaths","Set","getRefreshCookiePath","configuredPath","has","add","getAccessCookieDomain","resolveAuthCookieDomain","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean","buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","resolveLogoutDeviceId","userId","sessionId","clientDeviceId","debug","session","db","query","findOne","where","origin"],"mappings":";;;;;;;;;;;;AASA,MAAMA,YAAAA,GAAe,OAAA;AACrB,MAAMC,oBAAAA,GAAuB,gBAAA;AAEtB,MAAMC,sBAAsB;AAEnC;AACA;AACA;AACA,MAAMC,mBAAmB,CAACC,OAAAA,GAAAA;IACxBC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CAACH,OAAAA,CAAAA;AAClB,CAAA;MAEaI,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,qCAAsBH,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;AAEA;AACA,MAAMU,gBAAAA,GAAmB,QAAA;AAEzB,MAAMC,uBAAAA,GAA0B,IAAA;AAC9B,IAAA,MAAML,UAAAA,GAAsBJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AAC9C,IAAA,OAAO,OAAOF,UAAAA,KAAe,QAAA,IAAYA,WAAWM,IAAI,EAAA,KAAO,KAAKN,UAAAA,GAAaO,SAAAA;AACnF,CAAA;AAEA;;;;IAKA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;AACtB,IAAA,MAAMC,WAAAA,GAAuBd,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAACO,GAAAA,CAAAA;AAC/C,IAAA,IAAI,OAAOC,WAAAA,KAAgB,QAAA,IAAYA,WAAAA,KAAgB,EAAA,EAAI;QACzD,OAAOH,SAAAA;AACT,IAAA;IAEA,IAAI;QACF,OAAO,IAAII,IAAID,WAAAA,CAAAA,CAAaE,QAAQ,CAACC,OAAO,CAAC,QAAQ,EAAA,CAAA,IAAO,GAAA;AAC9D,IAAA,CAAA,CAAE,OAAM;QACN,OAAON,SAAAA;AACT,IAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAMO,eAAAA,GAAkB,IAAA;AACtB,IAAA,MAAMC,aAAaP,cAAAA,CAAe,oBAAA,CAAA;AAClC,IAAA,MAAMQ,UACJD,UAAAA,IAAcA,UAAAA,KAAe,MAAM,CAAA,EAAGA,UAAAA,CAAAA,EAAaX,kBAAkB,GAAGA,gBAAAA;AAC1E,IAAA,OAAOa,qCAAsBD,OAAAA,EAAStB,gBAAAA,CAAAA;AACxC,CAAA;AAEA;AACA;AACA,MAAMwB,iBAAAA,GAAoB,CAACC,UAAAA,EAAoBC,WAAAA,GAAAA;AAC7C,IAAA,IAAIA,gBAAgBD,UAAAA,EAAY;QAC9B,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OACEC,WAAAA,CAAYC,UAAU,CAACF,UAAAA,CAAAA,KACtBA,UAAAA,CAAWG,QAAQ,CAAC,GAAA,CAAA,IAAQF,YAAYG,MAAM,CAACJ,UAAAA,CAAWK,MAAM,MAAM,GAAE,CAAA;AAE7E,CAAA;AAEA;;;;;;UAOaC,mBAAAA,GAAsB,IAAA;IACjC,OAAOR,oCAAAA,CACLZ,uBAAAA,EAAAA,IAA6BG,cAAAA,CAAe,mBAAA,CAAA,EAC5Cd,gBAAAA,CAAAA;AAEJ;AAEA,MAAMgC,2BAA2B,IAAIC,GAAAA,EAAAA;AAErC;;;;;;;UAQaC,oBAAAA,GAAuB,IAAA;AAClC,IAAA,MAAMZ,OAAAA,GAAUF,eAAAA,EAAAA;AAChB,IAAA,MAAMd,UAAAA,GAAaK,uBAAAA,EAAAA;AAEnB,IAAA,IAAI,CAACL,UAAAA,EAAY;QACf,OAAOgB,OAAAA;AACT,IAAA;IAEA,MAAMa,cAAAA,GAAiBZ,qCAAsBjB,UAAAA,EAAYN,gBAAAA,CAAAA;IACzD,IAAIwB,iBAAAA,CAAkBW,gBAAgBb,OAAAA,CAAAA,EAAU;QAC9C,OAAOa,cAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACH,wBAAAA,CAAyBI,GAAG,CAACD,cAAAA,CAAAA,EAAiB;AACjDH,QAAAA,wBAAAA,CAAyBK,GAAG,CAACF,cAAAA,CAAAA;QAC7BjC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CACb,CAAC,wBAAwB,EAAE+B,eAAe,mCAAmC,EAAEb,QAAQ,wDAAwD,EAAEA,QAAQ,uBAAuB,EAAEA,QAAQ,mDAAmD,EAAEa,cAAAA,CAAe,EAAE,CAAC,CAAA;AAErQ,IAAA;IAEA,OAAOb,OAAAA;AACT;MAEagB,qBAAAA,GAAwB,IAAA;IACnC,MAAMhC,UAAAA,GACJJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BN,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,OAAO+B,yCAAwBjC,UAAAA,EAAYN,gBAAAA,CAAAA;AAC7C;AAEO,MAAMwC,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMuC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,MAAAA,GAASb,qBAAAA,EAAAA;AACf,IAAA,MAAMc,IAAAA,GAAOlB,oBAAAA,EAAAA;AAEb,IAAA,MAAMmB,WACJnD,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAI8C,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBhC,SAAAA,EAAW;AACtCyC,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLQ,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQF,QAAAA;QACRG,SAAAA,EAAW,IAAA;AACXN,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAK,MAAAA,EAAQ7C;AACV,KAAA;AACF;AAEA,MAAM8C,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClB5D,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,8CAAA,EACAiC,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMsB,aAAaD,MAAAA,CACjB5D,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,6CAAA,EACAgC,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEqB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACApB,aAAAA,GAAAA;AAEA,IAAA,MAAMqB,OAAOtB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIe,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAU5E,OAAO6E,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,uBAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;AAEO,MAAME,+BAAAA,GAAkC,CAACC,GAAAA,GAC9CC,0BAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;KACjC;AAEF;;;;;;;;;AASC,IACM,MAAMC,qBAAAA,GAAwB,OACnCC,QACAC,SAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,SAAAA,EAAW;QACd/F,MAAAA,CAAOC,GAAG,CAACgG,KAAK,CAAC,sEAAA,CAAA;QACjB,OAAOD,cAAAA;AACT,IAAA;IAEA,MAAME,OAAAA,GAAU,MAAMlG,MAAAA,CAAOmG,EAAE,CAACC,KAAK,CAACxG,oBAAAA,CAAAA,CAAsByG,OAAO,CAAC;QAClEC,KAAAA,EAAO;AAAEP,YAAAA;AAAU;AACrB,KAAA,CAAA;AAEA,IAAA,IAAIG,OAAAA,EAASJ,MAAAA,KAAWA,MAAAA,IAAUI,OAAAA,EAASK,WAAW5G,YAAAA,EAAc;QAClEK,MAAAA,CAAOC,GAAG,CAACgG,KAAK,CACd,mGAAA,CAAA;QAEF,OAAOD,cAAAA;AACT,IAAA;AAEA,IAAA,OAAO,OAAOE,OAAAA,CAAQd,QAAQ,KAAK,QAAA,GAAWc,OAAAA,CAAQd,QAAQ,GAAGY,cAAAA;AACnE;;;;;;;;;;;;;;;;;;;"}

package/dist/server/shared/utils/session-auth.mjs

@@ -17,9 +17,75 @@ const getAccessCookieName = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.name');
     return resolveAuthCookieName(configured, warnViaStrapiLog);
 };
-const getAccessCookiePath = ()=>{
+// The admin API routes are mounted under `/admin` whatever `admin.url` is.
+const ADMIN_API_PREFIX = '/admin';
+const getConfiguredCookiePath = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.path');
-    return resolveAuthCookiePath(configured, warnViaStrapiLog);
+    return typeof configured === 'string' && configured.trim() !== '' ? configured : undefined;
+};
+/**
+ * Path the browser sees for one of the resolved absolute URLs, so it includes
+ * a `server.url` subpath (`admin.path` does not). No trailing slash, except
+ * for the root.
+ */ const getBrowserPath = (key)=>{
+    const absoluteUrl = strapi.config.get(key);
+    if (typeof absoluteUrl !== 'string' || absoluteUrl === '') {
+        return undefined;
+    }
+    try {
+        return new URL(absoluteUrl).pathname.replace(/\/+$/, '') || '/';
+    } catch  {
+        return undefined;
+    }
+};
+/**
+ * Path the browser uses for the admin API (`/admin/access-token`,
+ * `/admin/login`, `/admin/logout`): `/admin` behind any `server.url` subpath.
+ */ const getAdminApiPath = ()=>{
+    const serverPath = getBrowserPath('server.absoluteUrl');
+    const apiPath = serverPath && serverPath !== '/' ? `${serverPath}${ADMIN_API_PREFIX}` : ADMIN_API_PREFIX;
+    return resolveAuthCookiePath(apiPath, warnViaStrapiLog);
+};
+// RFC 6265 section 5.1.4: whether the browser attaches a cookie scoped to
+// `cookiePath` to a request for `requestPath`.
+const cookiePathMatches = (cookiePath, requestPath)=>{
+    if (requestPath === cookiePath) {
+        return true;
+    }
+    return requestPath.startsWith(cookiePath) && (cookiePath.endsWith('/') || requestPath.charAt(cookiePath.length) === '/');
+};
+/**
+ * Path of the non-httpOnly access cookie. Only the admin panel reads it,
+ * through `document.cookie`, which exposes a cookie only on pages its path
+ * matches. So when `admin.auth.cookie.path` is unset it follows the path the
+ * browser loads the panel from (`admin.url`, behind any `server.url` subpath).
+ * The admin build resolves the same value (create-build-context.ts).
+ */ const getAccessCookiePath = ()=>{
+    return resolveAuthCookiePath(getConfiguredCookiePath() ?? getBrowserPath('admin.absoluteUrl'), warnViaStrapiLog);
+};
+const warnedRefreshCookiePaths = new Set();
+/**
+ * Path of the httpOnly refresh cookie (and every other cookie built from
+ * `getRefreshCookieOptions`). Only the admin API reads it, and the API does not
+ * move with `admin.url`, so it follows the API path instead of the panel.
+ * `admin.auth.cookie.path` is kept when it covers the API path. Otherwise the
+ * browser would never send the cookie to `/admin/access-token` and every
+ * session would end when its access token expires, so the API path is used.
+ */ const getRefreshCookiePath = ()=>{
+    const apiPath = getAdminApiPath();
+    const configured = getConfiguredCookiePath();
+    if (!configured) {
+        return apiPath;
+    }
+    const configuredPath = resolveAuthCookiePath(configured, warnViaStrapiLog);
+    if (cookiePathMatches(configuredPath, apiPath)) {
+        return configuredPath;
+    }
+    if (!warnedRefreshCookiePaths.has(configuredPath)) {
+        warnedRefreshCookiePaths.add(configuredPath);
+        strapi.log.warn(`admin.auth.cookie.path "${configuredPath}" does not cover the admin API at "${apiPath}", so the browser would not send the refresh cookie to "${apiPath}/access-token". Using "${apiPath}" for the refresh cookie. The access cookie keeps "${configuredPath}".`);
+    }
+    return apiPath;
 };
 const getAccessCookieDomain = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');
@@ -33,7 +99,7 @@ const getRefreshCookieOptions = (secureRequest)=>{
     const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
     const isProduction = process.env.NODE_ENV === 'production';
     const domain = getAccessCookieDomain();
-    const path = getAccessCookiePath();
+    const path = getRefreshCookiePath();
     const sameSite = strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';
     let isSecure;
     if (typeof configuredSecure === 'boolean') {
@@ -122,5 +188,5 @@ const buildSessionMetadataFromContext = (ctx)=>buildSessionMetadata({
     return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;
 };
 
-export { DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN, DEFAULT_IDLE_SESSION_LIFESPAN, DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN, DEFAULT_MAX_SESSION_LIFESPAN, REFRESH_COOKIE_NAME, buildCookieOptionsWithExpiry, buildSessionMetadataFromContext, extractDeviceParams, generateDeviceId, getAccessCookieDomain, getAccessCookieName, getAccessCookiePath, getRefreshCookieOptions, getSessionManager, resolveLogoutDeviceId };
+export { DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN, DEFAULT_IDLE_SESSION_LIFESPAN, DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN, DEFAULT_MAX_SESSION_LIFESPAN, REFRESH_COOKIE_NAME, buildCookieOptionsWithExpiry, buildSessionMetadataFromContext, extractDeviceParams, generateDeviceId, getAccessCookieDomain, getAccessCookieName, getAccessCookiePath, getRefreshCookieOptions, getRefreshCookiePath, getSessionManager, resolveLogoutDeviceId };
 //# sourceMappingURL=session-auth.mjs.map

package/dist/server/shared/utils/session-auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-auth.mjs","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Context } from 'koa';\nimport type { Modules } from '@strapi/types';\nimport { buildSessionMetadata } from '@strapi/utils';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\nimport { resolveAuthCookiePath } from './auth-cookie-path';\nimport { resolveAuthCookieDomain } from './auth-cookie-domain';\n\nconst ADMIN_ORIGIN = 'admin';\nconst SESSION_CONTENT_TYPE = 'admin::session';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\n// The resolvers are browser-shared (also inlined into the admin bundle) so\n// they default to console.warn; on the server, route their warnings through\n// the Strapi logger instead.\nconst warnViaStrapiLog = (message: string): void => {\n  strapi.log.warn(message);\n};\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookiePath = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.path');\n  return resolveAuthCookiePath(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookieDomain = (): string | undefined => {\n  const configured: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  return resolveAuthCookieDomain(configured, warnViaStrapiLog);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain = getAccessCookieDomain();\n  const path = getAccessCookiePath();\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n\nexport const buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\n/**\n * Resolves the device id to use when revoking sessions on logout.\n * SSO assigns deviceId server-side, so the client-provided value may not match\n * the active session row. Prefer the deviceId stored on the session backing\n * the current access token when available.\n *\n * Callers should pass `ctx.state.session.id` from the admin auth strategy and\n * the already-parsed body `deviceId` — the logout route requires authentication,\n * so sessionId is expected to be present.\n */\nexport const resolveLogoutDeviceId = async (\n  userId: string,\n  sessionId: string | undefined,\n  clientDeviceId: string | undefined\n): Promise<string | undefined> => {\n  if (!sessionId) {\n    strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');\n    return clientDeviceId;\n  }\n\n  const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({\n    where: { sessionId },\n  });\n\n  if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {\n    strapi.log.debug(\n      'resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId'\n    );\n    return clientDeviceId;\n  }\n\n  return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;\n};\n"],"names":["ADMIN_ORIGIN","SESSION_CONTENT_TYPE","REFRESH_COOKIE_NAME","warnViaStrapiLog","message","strapi","log","warn","getAccessCookieName","configured","config","get","resolveAuthCookieName","getAccessCookiePath","resolveAuthCookiePath","getAccessCookieDomain","resolveAuthCookieDomain","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","undefined","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean","buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","resolveLogoutDeviceId","userId","sessionId","clientDeviceId","debug","session","db","query","findOne","where","origin"],"mappings":";;;;;;AASA,MAAMA,YAAAA,GAAe,OAAA;AACrB,MAAMC,oBAAAA,GAAuB,gBAAA;AAEtB,MAAMC,sBAAsB;AAEnC;AACA;AACA;AACA,MAAMC,mBAAmB,CAACC,OAAAA,GAAAA;IACxBC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CAACH,OAAAA,CAAAA;AAClB,CAAA;MAEaI,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,sBAAsBH,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaU,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMJ,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOG,sBAAsBL,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaY,qBAAAA,GAAwB,IAAA;IACnC,MAAMN,UAAAA,GACJJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BN,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,OAAOK,wBAAwBP,UAAAA,EAAYN,gBAAAA,CAAAA;AAC7C;AAEO,MAAMc,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmBlB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMa,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,MAAAA,GAASb,qBAAAA,EAAAA;AACf,IAAA,MAAMc,IAAAA,GAAOhB,mBAAAA,EAAAA;AAEb,IAAA,MAAMiB,WACJzB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAIoB,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBU,SAAAA,EAAW;AACtCD,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLS,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQH,QAAAA;QACRI,SAAAA,EAAW,IAAA;AACXP,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAM,MAAAA,EAAQJ;AACV,KAAA;AACF;AAEA,MAAMK,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,8CAAA,EACAO,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMuB,aAAaD,MAAAA,CACjBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,6CAAA,EACAM,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEsB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACArB,aAAAA,GAAAA;AAEA,IAAA,MAAMsB,OAAOvB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIgB,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAUnD,OAAOoD,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,MAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;AAEO,MAAME,+BAAAA,GAAkC,CAACC,GAAAA,GAC9CC,oBAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;KACjC;AAEF;;;;;;;;;AASC,IACM,MAAMC,qBAAAA,GAAwB,OACnCC,QACAC,SAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,SAAAA,EAAW;QACdtE,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CAAC,sEAAA,CAAA;QACjB,OAAOD,cAAAA;AACT,IAAA;IAEA,MAAME,OAAAA,GAAU,MAAMzE,MAAAA,CAAO0E,EAAE,CAACC,KAAK,CAAC/E,oBAAAA,CAAAA,CAAsBgF,OAAO,CAAC;QAClEC,KAAAA,EAAO;AAAEP,YAAAA;AAAU;AACrB,KAAA,CAAA;AAEA,IAAA,IAAIG,OAAAA,EAASJ,MAAAA,KAAWA,MAAAA,IAAUI,OAAAA,EAASK,WAAWnF,YAAAA,EAAc;QAClEK,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CACd,mGAAA,CAAA;QAEF,OAAOD,cAAAA;AACT,IAAA;AAEA,IAAA,OAAO,OAAOE,OAAAA,CAAQd,QAAQ,KAAK,QAAA,GAAWc,OAAAA,CAAQd,QAAQ,GAAGY,cAAAA;AACnE;;;;"}
+{"version":3,"file":"session-auth.mjs","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Context } from 'koa';\nimport type { Modules } from '@strapi/types';\nimport { buildSessionMetadata } from '@strapi/utils';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\nimport { resolveAuthCookiePath } from './auth-cookie-path';\nimport { resolveAuthCookieDomain } from './auth-cookie-domain';\n\nconst ADMIN_ORIGIN = 'admin';\nconst SESSION_CONTENT_TYPE = 'admin::session';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\n// The resolvers are browser-shared (also inlined into the admin bundle) so\n// they default to console.warn; on the server, route their warnings through\n// the Strapi logger instead.\nconst warnViaStrapiLog = (message: string): void => {\n  strapi.log.warn(message);\n};\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured, warnViaStrapiLog);\n};\n\n// The admin API routes are mounted under `/admin` whatever `admin.url` is.\nconst ADMIN_API_PREFIX = '/admin';\n\nconst getConfiguredCookiePath = (): string | undefined => {\n  const configured: unknown = strapi.config.get('admin.auth.cookie.path');\n  return typeof configured === 'string' && configured.trim() !== '' ? configured : undefined;\n};\n\n/**\n * Path the browser sees for one of the resolved absolute URLs, so it includes\n * a `server.url` subpath (`admin.path` does not). No trailing slash, except\n * for the root.\n */\nconst getBrowserPath = (key: 'admin.absoluteUrl' | 'server.absoluteUrl'): string | undefined => {\n  const absoluteUrl: unknown = strapi.config.get(key);\n  if (typeof absoluteUrl !== 'string' || absoluteUrl === '') {\n    return undefined;\n  }\n\n  try {\n    return new URL(absoluteUrl).pathname.replace(/\\/+$/, '') || '/';\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * Path the browser uses for the admin API (`/admin/access-token`,\n * `/admin/login`, `/admin/logout`): `/admin` behind any `server.url` subpath.\n */\nconst getAdminApiPath = (): string => {\n  const serverPath = getBrowserPath('server.absoluteUrl');\n  const apiPath =\n    serverPath && serverPath !== '/' ? `${serverPath}${ADMIN_API_PREFIX}` : ADMIN_API_PREFIX;\n  return resolveAuthCookiePath(apiPath, warnViaStrapiLog);\n};\n\n// RFC 6265 section 5.1.4: whether the browser attaches a cookie scoped to\n// `cookiePath` to a request for `requestPath`.\nconst cookiePathMatches = (cookiePath: string, requestPath: string): boolean => {\n  if (requestPath === cookiePath) {\n    return true;\n  }\n\n  return (\n    requestPath.startsWith(cookiePath) &&\n    (cookiePath.endsWith('/') || requestPath.charAt(cookiePath.length) === '/')\n  );\n};\n\n/**\n * Path of the non-httpOnly access cookie. Only the admin panel reads it,\n * through `document.cookie`, which exposes a cookie only on pages its path\n * matches. So when `admin.auth.cookie.path` is unset it follows the path the\n * browser loads the panel from (`admin.url`, behind any `server.url` subpath).\n * The admin build resolves the same value (create-build-context.ts).\n */\nexport const getAccessCookiePath = (): string => {\n  return resolveAuthCookiePath(\n    getConfiguredCookiePath() ?? getBrowserPath('admin.absoluteUrl'),\n    warnViaStrapiLog\n  );\n};\n\nconst warnedRefreshCookiePaths = new Set<string>();\n\n/**\n * Path of the httpOnly refresh cookie (and every other cookie built from\n * `getRefreshCookieOptions`). Only the admin API reads it, and the API does not\n * move with `admin.url`, so it follows the API path instead of the panel.\n * `admin.auth.cookie.path` is kept when it covers the API path. Otherwise the\n * browser would never send the cookie to `/admin/access-token` and every\n * session would end when its access token expires, so the API path is used.\n */\nexport const getRefreshCookiePath = (): string => {\n  const apiPath = getAdminApiPath();\n  const configured = getConfiguredCookiePath();\n\n  if (!configured) {\n    return apiPath;\n  }\n\n  const configuredPath = resolveAuthCookiePath(configured, warnViaStrapiLog);\n  if (cookiePathMatches(configuredPath, apiPath)) {\n    return configuredPath;\n  }\n\n  if (!warnedRefreshCookiePaths.has(configuredPath)) {\n    warnedRefreshCookiePaths.add(configuredPath);\n    strapi.log.warn(\n      `admin.auth.cookie.path \"${configuredPath}\" does not cover the admin API at \"${apiPath}\", so the browser would not send the refresh cookie to \"${apiPath}/access-token\". Using \"${apiPath}\" for the refresh cookie. The access cookie keeps \"${configuredPath}\".`\n    );\n  }\n\n  return apiPath;\n};\n\nexport const getAccessCookieDomain = (): string | undefined => {\n  const configured: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  return resolveAuthCookieDomain(configured, warnViaStrapiLog);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain = getAccessCookieDomain();\n  const path = getRefreshCookiePath();\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n\nexport const buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\n/**\n * Resolves the device id to use when revoking sessions on logout.\n * SSO assigns deviceId server-side, so the client-provided value may not match\n * the active session row. Prefer the deviceId stored on the session backing\n * the current access token when available.\n *\n * Callers should pass `ctx.state.session.id` from the admin auth strategy and\n * the already-parsed body `deviceId` — the logout route requires authentication,\n * so sessionId is expected to be present.\n */\nexport const resolveLogoutDeviceId = async (\n  userId: string,\n  sessionId: string | undefined,\n  clientDeviceId: string | undefined\n): Promise<string | undefined> => {\n  if (!sessionId) {\n    strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');\n    return clientDeviceId;\n  }\n\n  const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({\n    where: { sessionId },\n  });\n\n  if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {\n    strapi.log.debug(\n      'resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId'\n    );\n    return clientDeviceId;\n  }\n\n  return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;\n};\n"],"names":["ADMIN_ORIGIN","SESSION_CONTENT_TYPE","REFRESH_COOKIE_NAME","warnViaStrapiLog","message","strapi","log","warn","getAccessCookieName","configured","config","get","resolveAuthCookieName","ADMIN_API_PREFIX","getConfiguredCookiePath","trim","undefined","getBrowserPath","key","absoluteUrl","URL","pathname","replace","getAdminApiPath","serverPath","apiPath","resolveAuthCookiePath","cookiePathMatches","cookiePath","requestPath","startsWith","endsWith","charAt","length","getAccessCookiePath","warnedRefreshCookiePaths","Set","getRefreshCookiePath","configuredPath","has","add","getAccessCookieDomain","resolveAuthCookieDomain","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean","buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","resolveLogoutDeviceId","userId","sessionId","clientDeviceId","debug","session","db","query","findOne","where","origin"],"mappings":";;;;;;AASA,MAAMA,YAAAA,GAAe,OAAA;AACrB,MAAMC,oBAAAA,GAAuB,gBAAA;AAEtB,MAAMC,sBAAsB;AAEnC;AACA;AACA;AACA,MAAMC,mBAAmB,CAACC,OAAAA,GAAAA;IACxBC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CAACH,OAAAA,CAAAA;AAClB,CAAA;MAEaI,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,sBAAsBH,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;AAEA;AACA,MAAMU,gBAAAA,GAAmB,QAAA;AAEzB,MAAMC,uBAAAA,GAA0B,IAAA;AAC9B,IAAA,MAAML,UAAAA,GAAsBJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AAC9C,IAAA,OAAO,OAAOF,UAAAA,KAAe,QAAA,IAAYA,WAAWM,IAAI,EAAA,KAAO,KAAKN,UAAAA,GAAaO,SAAAA;AACnF,CAAA;AAEA;;;;IAKA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;AACtB,IAAA,MAAMC,WAAAA,GAAuBd,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAACO,GAAAA,CAAAA;AAC/C,IAAA,IAAI,OAAOC,WAAAA,KAAgB,QAAA,IAAYA,WAAAA,KAAgB,EAAA,EAAI;QACzD,OAAOH,SAAAA;AACT,IAAA;IAEA,IAAI;QACF,OAAO,IAAII,IAAID,WAAAA,CAAAA,CAAaE,QAAQ,CAACC,OAAO,CAAC,QAAQ,EAAA,CAAA,IAAO,GAAA;AAC9D,IAAA,CAAA,CAAE,OAAM;QACN,OAAON,SAAAA;AACT,IAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAMO,eAAAA,GAAkB,IAAA;AACtB,IAAA,MAAMC,aAAaP,cAAAA,CAAe,oBAAA,CAAA;AAClC,IAAA,MAAMQ,UACJD,UAAAA,IAAcA,UAAAA,KAAe,MAAM,CAAA,EAAGA,UAAAA,CAAAA,EAAaX,kBAAkB,GAAGA,gBAAAA;AAC1E,IAAA,OAAOa,sBAAsBD,OAAAA,EAAStB,gBAAAA,CAAAA;AACxC,CAAA;AAEA;AACA;AACA,MAAMwB,iBAAAA,GAAoB,CAACC,UAAAA,EAAoBC,WAAAA,GAAAA;AAC7C,IAAA,IAAIA,gBAAgBD,UAAAA,EAAY;QAC9B,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OACEC,WAAAA,CAAYC,UAAU,CAACF,UAAAA,CAAAA,KACtBA,UAAAA,CAAWG,QAAQ,CAAC,GAAA,CAAA,IAAQF,YAAYG,MAAM,CAACJ,UAAAA,CAAWK,MAAM,MAAM,GAAE,CAAA;AAE7E,CAAA;AAEA;;;;;;UAOaC,mBAAAA,GAAsB,IAAA;IACjC,OAAOR,qBAAAA,CACLZ,uBAAAA,EAAAA,IAA6BG,cAAAA,CAAe,mBAAA,CAAA,EAC5Cd,gBAAAA,CAAAA;AAEJ;AAEA,MAAMgC,2BAA2B,IAAIC,GAAAA,EAAAA;AAErC;;;;;;;UAQaC,oBAAAA,GAAuB,IAAA;AAClC,IAAA,MAAMZ,OAAAA,GAAUF,eAAAA,EAAAA;AAChB,IAAA,MAAMd,UAAAA,GAAaK,uBAAAA,EAAAA;AAEnB,IAAA,IAAI,CAACL,UAAAA,EAAY;QACf,OAAOgB,OAAAA;AACT,IAAA;IAEA,MAAMa,cAAAA,GAAiBZ,sBAAsBjB,UAAAA,EAAYN,gBAAAA,CAAAA;IACzD,IAAIwB,iBAAAA,CAAkBW,gBAAgBb,OAAAA,CAAAA,EAAU;QAC9C,OAAOa,cAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACH,wBAAAA,CAAyBI,GAAG,CAACD,cAAAA,CAAAA,EAAiB;AACjDH,QAAAA,wBAAAA,CAAyBK,GAAG,CAACF,cAAAA,CAAAA;QAC7BjC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CACb,CAAC,wBAAwB,EAAE+B,eAAe,mCAAmC,EAAEb,QAAQ,wDAAwD,EAAEA,QAAQ,uBAAuB,EAAEA,QAAQ,mDAAmD,EAAEa,cAAAA,CAAe,EAAE,CAAC,CAAA;AAErQ,IAAA;IAEA,OAAOb,OAAAA;AACT;MAEagB,qBAAAA,GAAwB,IAAA;IACnC,MAAMhC,UAAAA,GACJJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BN,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,OAAO+B,wBAAwBjC,UAAAA,EAAYN,gBAAAA,CAAAA;AAC7C;AAEO,MAAMwC,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMuC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,MAAAA,GAASb,qBAAAA,EAAAA;AACf,IAAA,MAAMc,IAAAA,GAAOlB,oBAAAA,EAAAA;AAEb,IAAA,MAAMmB,WACJnD,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAI8C,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBhC,SAAAA,EAAW;AACtCyC,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLQ,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQF,QAAAA;QACRG,SAAAA,EAAW,IAAA;AACXN,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAK,MAAAA,EAAQ7C;AACV,KAAA;AACF;AAEA,MAAM8C,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClB5D,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,8CAAA,EACAiC,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMsB,aAAaD,MAAAA,CACjB5D,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,6CAAA,EACAgC,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEqB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACApB,aAAAA,GAAAA;AAEA,IAAA,MAAMqB,OAAOtB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIe,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAU5E,OAAO6E,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,MAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;AAEO,MAAME,+BAAAA,GAAkC,CAACC,GAAAA,GAC9CC,oBAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;KACjC;AAEF;;;;;;;;;AASC,IACM,MAAMC,qBAAAA,GAAwB,OACnCC,QACAC,SAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,SAAAA,EAAW;QACd/F,MAAAA,CAAOC,GAAG,CAACgG,KAAK,CAAC,sEAAA,CAAA;QACjB,OAAOD,cAAAA;AACT,IAAA;IAEA,MAAME,OAAAA,GAAU,MAAMlG,MAAAA,CAAOmG,EAAE,CAACC,KAAK,CAACxG,oBAAAA,CAAAA,CAAsByG,OAAO,CAAC;QAClEC,KAAAA,EAAO;AAAEP,YAAAA;AAAU;AACrB,KAAA,CAAA;AAEA,IAAA,IAAIG,OAAAA,EAASJ,MAAAA,KAAWA,MAAAA,IAAUI,OAAAA,EAASK,WAAW5G,YAAAA,EAAc;QAClEK,MAAAA,CAAOC,GAAG,CAACgG,KAAK,CACd,mGAAA,CAAA;QAEF,OAAOD,cAAAA;AACT,IAAA;AAEA,IAAA,OAAO,OAAOE,OAAAA,CAAQd,QAAQ,KAAK,QAAA,GAAWc,OAAAA,CAAQd,QAAQ,GAAGY,cAAAA;AACnE;;;;"}

package/dist/server/src/ai/services/ai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../../../../../server/src/ai/services/ai.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAS1C,QAAA,MAAM,oBAAoB,GAAI,YAAY;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE;uBAkBvC,OAAO;oCAGM,OAAO;mCAKR,OAAO;;;;;;;;;;;4BAiQjB,MAAM;yBACT,MAAM;gCACC,MAAM;kCACJ,OAAO;0BACf,OAAO;8BACH,MAAM;kCACF,MAAM;8BACV,MAAM;4BACR,MAAM;;0BAVE,MAAM;;CA4CzC,CAAC;AAEF,OAAO,EAAE,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../../../../../server/src/ai/services/ai.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAS1C,QAAA,MAAM,oBAAoB,GAAI,YAAY;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE;uBAkBvC,OAAO;oCAGM,OAAO;mCAKR,OAAO;;;;;;;;;;;4BAgQjB,MAAM;yBACT,MAAM;gCACC,MAAM;kCACJ,OAAO;0BACf,OAAO;8BACH,MAAM;kCACF,MAAM;8BACV,MAAM;4BACR,MAAM;;0BAVE,MAAM;;CA4CzC,CAAC;AAEF,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/server/src/audit-logs/auth.d.ts

@@ -0,0 +1,72 @@
+import type { Data, Modules } from '@strapi/types';
+import { emitAudit } from '@strapi/utils';
+import { type AdminUserSnapshot } from './admin-users';
+/**
+ * Event hub events bound to the `admin.auth.events` config callbacks
+ * (`onConnectionError`, `onSSOAutoRegistration`). Their names and payloads are public.
+ */
+export declare const AUTH_EVENTS: {
+    readonly LOGIN_FAILURE: "admin.auth.error";
+    readonly AUTO_REGISTRATION: "admin.auth.autoRegistration";
+};
+/** One fixed value per emit site. */
+export type LoginFailureReason = 'login_not_allowed' | 'unexpected_error' | 'invalid_credentials' | 'account_inactive' | 'sso_connection_error' | 'sso_registration_disabled' | 'sso_role_misconfigured';
+/**
+ * Payload of `admin.auth.error`, also passed to the `onConnectionError` callback.
+ * The audit log stores `provider`, `reason` and the account, never `error`.
+ */
+export interface LoginFailureEvent {
+    error: Error;
+    provider: string;
+    reason: LoginFailureReason;
+    /** The account the login was for, when known. */
+    user?: {
+        id: Data.ID;
+        email: string;
+    };
+}
+/** Payload of `admin.auth.autoRegistration`: the created `admin::user` row, roles populated. */
+export interface AutoRegistrationEvent {
+    user: {
+        id: Data.ID;
+        email?: string | null;
+        roles?: AdminUserSnapshot['roles'];
+    };
+    provider: string;
+}
+export interface LoginFailureDetails {
+    provider: string;
+    reason: LoginFailureReason;
+}
+export interface AutoRegistrationDetails {
+    provider: string;
+    roles: Data.ID[];
+}
+type AuditStrapi = Parameters<typeof emitAudit>[0]['strapi'];
+/**
+ * Emits without waiting: listeners bound to the event, such as the `onConnectionError`
+ * config callback, run before the audit subscriber and must not hold the login.
+ */
+export declare const emitLoginFailure: ({ strapi }: {
+    strapi: AuditStrapi;
+}, event: LoginFailureEvent) => void;
+/**
+ * Whether the audit log records a failed login. Not recorded: failures anyone can produce
+ * from outside before any verification, a local login for an email with no account and an
+ * SSO connection with no valid profile.
+ */
+export declare const isRecordedLoginFailure: (event: LoginFailureEvent) => boolean;
+/**
+ * The part of the audit-logs lifecycle service used here.
+ * The full service type lives in the Admin EE package.
+ */
+interface AuditLogsLifecycle {
+    registerEvent<TDetails>(name: string, transform: Modules.AuditLogs.EventTransformer<TDetails>, options?: {
+        allowUnknownActor?: boolean;
+        alwaysUnknownActor?: boolean;
+        shouldRecord?: (...args: any[]) => boolean;
+    }): void;
+}
+export declare const registerAuthAuditEvents: (auditLogsLifecycle: AuditLogsLifecycle) => void;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/server/src/audit-logs/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../server/src/audit-logs/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,OAAO,EAAqC,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,WAAW;;;CAGd,CAAC;AAEX,qCAAqC;AACrC,MAAM,MAAM,kBAAkB,GAC1B,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,kBAAkB,GAClB,sBAAsB,GACtB,2BAA2B,GAC3B,wBAAwB,CAAC;AAE7B;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,iDAAiD;IACjD,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC;AAED,gGAAgG;AAChG,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IACjF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;CAClB;AAED,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,YAAY;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,EACnC,OAAO,iBAAiB,KACvB,IASF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,iBAAiB,YAC0B,CAAC;AAE1F;;;GAGG;AACH,UAAU,kBAAkB;IAC1B,aAAa,CAAC,QAAQ,EACpB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACvD,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,YAAY,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;KAC5C,GACA,IAAI,CAAC;CACT;AAQD,eAAO,MAAM,uBAAuB,GAAI,oBAAoB,kBAAkB,SAkB7E,CAAC"}

package/dist/server/src/config/admin-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-actions.d.ts","sourceRoot":"","sources":["../../../../server/src/config/admin-actions.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;IA+QnB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEF,wBAEE"}
+{"version":3,"file":"admin-actions.d.ts","sourceRoot":"","sources":["../../../../server/src/config/admin-actions.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsRnB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEF,wBAEE"}

package/dist/server/src/controllers/admin.d.ts

@@ -38,6 +38,9 @@ declare const _default: {
             useYarn: boolean;
         };
     }>;
+    debugDump(): Promise<{
+        data: import("../../../shared/contracts/admin").DebugDumpPayload;
+    }>;
     plugins(ctx: Context): Promise<void>;
     licenseTrialTimeLeft(): Promise<{
         trialEndsAt: string;

package/dist/server/src/controllers/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/admin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAcnC,OAAO,KAAK,EAEV,kBAAkB,EAClB,cAAc,EAMf,MAAM,iCAAiC,CAAC;AAezC;;GAEG;;sBAQuB,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC;;;;;;;;;;+BAmCvB,OAAO;6BAmBT,OAAO;;;;;;;;;;;;;;;;;;;;;;;iBAuEnB,OAAO;;;;2BAmCG,OAAO;;;;;;;AAvKtC,wBAiLE"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/admin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAcnC,OAAO,KAAK,EAEV,kBAAkB,EAClB,cAAc,EAOf,MAAM,iCAAiC,CAAC;AA0BzC;;GAEG;;sBAQuB,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC;;;;;;;;;;+BAmCvB,OAAO;6BAmBT,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4EnB,OAAO;;;;2BAuBG,OAAO;;;;;;;AAhKtC,wBA0KE"}

package/dist/server/src/controllers/authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,KAAK,CAAC;AAGzC,OAAO,eAAe,CAAC;;;0BAqHO,OAAO;kBAcf,OAAO;uBAiDF,OAAO;wBAmDN,OAAO;uBAeR,OAAO;qBAsDT,OAAO;gBAyCZ,OAAO;;AAlT3B,wBAgVE"}
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAQ,MAAM,KAAK,CAAC;AAGzC,OAAO,eAAe,CAAC;;;0BA4JO,OAAO;kBAcf,OAAO;uBAiDF,OAAO;wBAmDN,OAAO;uBAeR,OAAO;qBAsDT,OAAO;gBAyCZ,OAAO;;AAvT3B,wBAqVE"}

package/dist/server/src/controllers/index.d.ts

@@ -34,6 +34,9 @@ declare const _default: {
                 useYarn: boolean;
             };
         }>;
+        debugDump(): Promise<{
+            data: import("../../../shared/contracts/admin").DebugDumpPayload;
+        }>;
         plugins(ctx: import("koa").Context): Promise<void>;
         licenseTrialTimeLeft(): Promise<{
             trialEndsAt: string;

package/dist/server/src/controllers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,wBAeE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,wBAeE"}

package/dist/server/src/domain/permission/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../server/src/domain/permission/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAC1D,UAAU,EACV,kBAAkB,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,GAAG,WAAW,GAAG,WAAW,CAChG,CAAC;AAIF,eAAO,MAAM,gBAAgB,UAS5B,CAAC;AACF,eAAO,MAAM,yBAAyB,sFAO5B,CAAC;AAEX,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,mBACb,CAAC;AAY9C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,mEAOvB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,eAAe,mEAK1B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,WAAW,mEAGvB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GACtB,UAAU,MAAM,EAChB,OAAO,OAAO,EACd,YAAY,UAAU,KACrB,UAEF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,SAAS,MAAM,EACrD,UAAU,SAAS,EACnB,YAAY,UAAU,KACqC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAEzF;;;GAGG;AACH,eAAO,MAAM,MAAM,GAAI,YAAY,uBAAuB,KACwB,UACjF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,4HAa9B,CAAC;AAEF;;;GAGG;AAEH,iBAAS,YAAY,CAAC,CAAC,SAAS,uBAAuB,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;AACrF,iBAAS,YAAY,CAAC,CAAC,SAAS,uBAAuB,EAAE,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC;AAWjF,OAAO,EAAE,YAAY,EAAE,CAAC;;;;yBAzCW,uBAAuB,KACwB,UAAU;qBAV7D,SAAS,SAAS,MAAM,YAC3C,SAAS,cACP,UAAU,KACqC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC;;;;;kCAxE7C,UAAU,KAAK,mBAAmB;4BAyDjE,MAAM,SACT,OAAO,cACF,UAAU,KACrB,UAAU;;;AA6Db,wBAYE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../server/src/domain/permission/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAC1D,UAAU,EACV,kBAAkB,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,GAAG,WAAW,GAAG,WAAW,CAChG,CAAC;AAIF,eAAO,MAAM,gBAAgB,UAS5B,CAAC;AACF,eAAO,MAAM,yBAAyB,sFAO5B,CAAC;AAEX,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,mBACb,CAAC;AAY9C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,mEAOvB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,eAAe,mEAK1B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,WAAW,mEAEvB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GACtB,UAAU,MAAM,EAChB,OAAO,OAAO,EACd,YAAY,UAAU,KACrB,UAEF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,SAAS,MAAM,EACrD,UAAU,SAAS,EACnB,YAAY,UAAU,KACqC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAEzF;;;GAGG;AACH,eAAO,MAAM,MAAM,GAAI,YAAY,uBAAuB,KACwB,UACjF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,4HAa9B,CAAC;AAEF;;;GAGG;AAEH,iBAAS,YAAY,CAAC,CAAC,SAAS,uBAAuB,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;AACrF,iBAAS,YAAY,CAAC,CAAC,SAAS,uBAAuB,EAAE,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC;AAWjF,OAAO,EAAE,YAAY,EAAE,CAAC;;;;yBAzCW,uBAAuB,KACwB,UAAU;qBAV7D,SAAS,SAAS,MAAM,YAC3C,SAAS,cACP,UAAU,KACqC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC;;;;;kCAvE7C,UAAU,KAAK,mBAAmB;4BAwDjE,MAAM,SACT,OAAO,cACF,UAAU,KACrB,UAAU;;;AA6Db,wBAYE"}

package/dist/server/src/index.d.ts

@@ -213,6 +213,11 @@ declare let admin: {
             getHomepageLayout: (userId: number) => Promise<import("./controllers/validation/schema").HomepageLayout | null>;
             updateHomepageLayout: (userId: number, input: unknown) => Promise<import("./controllers/validation/schema").HomepageLayout>;
         };
+        'debug-dump': ({ strapi }: {
+            strapi: import("@strapi/types/dist/core/strapi.js").Strapi;
+        }) => {
+            generate(): Promise<import("../../shared/contracts/admin").DebugDumpPayload>;
+        };
     };
     controllers: {
         admin: {
@@ -250,6 +255,9 @@ declare let admin: {
                     useYarn: boolean;
                 };
             }>;
+            debugDump(): Promise<{
+                data: import("../../shared/contracts/admin").DebugDumpPayload;
+            }>;
             plugins(ctx: import("koa").Context): Promise<void>;
             licenseTrialTimeLeft(): Promise<{
                 trialEndsAt: string;

package/dist/server/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../server/src/index.ts"],"names":[],"mappings":"AAeA,QAAA,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;sBAPG,GAAG;;;;;sBAAH,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6B2tD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA3BnuD,0BAAY,EAAC,wBAAW;gCANjB,0BAAW,EAAC,wBACtB;;CAqBJ,CAAC;AAUF,eAAe,KAAK,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../server/src/index.ts"],"names":[],"mappings":"AAeA,QAAA,IAAI,KAAK;;;;;;;;;;;;;;;;;;;;;;sBAPG,GAAG;;;;;sBAAH,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6B2tD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA3BnuD,0BAAY,EAAC,wBAAW;gCANjB,0BAAW,EAAC,wBACtB;;CAqBJ,CAAC;AAUF,eAAe,KAAK,CAAC"}

package/dist/server/src/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../server/src/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;yBAS1B,YAAY;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE;AAAnD,wBAoBE"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../server/src/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;yBAU1B,YAAY;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE;AAAnD,wBAwBE"}

package/dist/server/src/routes/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../server/src/routes/admin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,wBAoFE"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../server/src/routes/admin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,wBA+FE"}

package/dist/server/src/services/auth.d.ts

@@ -22,6 +22,12 @@ declare const completePasswordReset: (user: AdminUser, password: string) => Prom
  * cannot be retried. Shared by the CE and EE auth services. (GH#25711)
  */
 declare const assertResetPasswordTokenIsValid: (user: AdminUser) => Promise<void>;
+/**
+ * Check login credentials
+ * @param email the users email address
+ * @param password the users password
+ */
+export declare const USER_NOT_ACTIVE_MESSAGE = "User not active";
 declare const _default: {
     checkCredentials: ({ email, password }: {
         email: string;

package/dist/server/src/services/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../server/src/services/auth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,eAAe,CAAC;AAQvB;;;GAGG;AACH,QAAA,MAAM,wBAAwB,QAAO,MASpC,CAAC;AAEF;;;;GAIG;AACH,QAAA,MAAM,wBAAwB,GAAU,QAAQ,SAAS,CAAC,IAAI,CAAC,KAAG,OAAO,CAAC,MAAM,CAkB/E,CAAC;AAEF;;;GAGG;AACH,QAAA,MAAM,qBAAqB,GAAU,MAAM,SAAS,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,SAAS,CAUzF,CAAC;AAEF;;;;GAIG;AACH,QAAA,MAAM,+BAA+B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,IAAI,CAa5E,CAAC;;4CAsBmD;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;;;iCAPpD,MAAM,QAAQ,MAAM;6BARxB,MAAM;;eAuCmB,MAAM;;;4BA0CE,MAAM;kBAAY,MAAM;;;AAezF,wBAAmG;AACnG,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,+BAA+B,EAC/B,qBAAqB,GACtB,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../server/src/services/auth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,eAAe,CAAC;AAQvB;;;GAGG;AACH,QAAA,MAAM,wBAAwB,QAAO,MASpC,CAAC;AAEF;;;;GAIG;AACH,QAAA,MAAM,wBAAwB,GAAU,QAAQ,SAAS,CAAC,IAAI,CAAC,KAAG,OAAO,CAAC,MAAM,CAkB/E,CAAC;AAEF;;;GAGG;AACH,QAAA,MAAM,qBAAqB,GAAU,MAAM,SAAS,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,SAAS,CAUzF,CAAC;AAEF;;;;GAIG;AACH,QAAA,MAAM,+BAA+B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,IAAI,CAa5E,CAAC;AAiBF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;;4CAEJ;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;;;iCATpD,MAAM,QAAQ,MAAM;6BARxB,MAAM;;eAyCmB,MAAM;;;4BA0CE,MAAM;kBAAY,MAAM;;;AAezF,wBAAmG;AACnG,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,+BAA+B,EAC/B,qBAAqB,GACtB,CAAC"}

package/dist/server/src/services/constants.d.ts

@@ -1,6 +1,7 @@
 declare const constants: {
     CONTENT_TYPE_SECTION: string;
     SUPER_ADMIN_CODE: string;
+    ROLE_TEXT_MAX_LENGTH: number;
     EDITOR_CODE: string;
     AUTHOR_CODE: string;
     READ_ACTION: string;
@@ -8,6 +9,7 @@ declare const constants: {
     UPDATE_ACTION: string;
     DELETE_ACTION: string;
     PUBLISH_ACTION: string;
+    TOKEN_TEXT_MAX_LENGTH: number;
     API_TOKEN_TYPE: {
         READ_ONLY: string;
         FULL_ACCESS: string;

package/dist/server/src/services/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../server/src/services/constants.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDd,CAAC;AAEF,eAAe,SAAS,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../server/src/services/constants.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyDd,CAAC;AAEF,eAAe,SAAS,CAAC"}

package/dist/server/src/services/debug-dump.d.ts

@@ -0,0 +1,9 @@
+import type { Core } from '@strapi/types';
+import type { DebugDumpPayload } from '../../../shared/contracts/admin';
+declare const debugDumpService: ({ strapi }: {
+    strapi: Core.Strapi;
+}) => {
+    generate(): Promise<DebugDumpPayload>;
+};
+export default debugDumpService;
+//# sourceMappingURL=debug-dump.d.ts.map

package/dist/server/src/services/debug-dump.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-dump.d.ts","sourceRoot":"","sources":["../../../../server/src/services/debug-dump.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAwBxE,QAAA,MAAM,gBAAgB,GAAI,YAAY;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE;gBACzC,OAAO,CAAC,gBAAgB,CAAC;CAkI3C,CAAC;AAEH,eAAe,gBAAgB,CAAC"}

package/dist/server/src/services/index.d.ts

@@ -135,6 +135,11 @@ declare const _default: {
         getHomepageLayout: (userId: number) => Promise<import("../controllers/validation/schema").HomepageLayout | null>;
         updateHomepageLayout: (userId: number, input: unknown) => Promise<import("../controllers/validation/schema").HomepageLayout>;
     };
+    'debug-dump': ({ strapi }: {
+        strapi: import("@strapi/types/dist/core/strapi.js").Strapi;
+    }) => {
+        generate(): Promise<import("../../../shared/contracts/admin").DebugDumpPayload>;
+    };
 };
 export default _default;
 //# sourceMappingURL=index.d.ts.map

package/dist/server/src/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/src/services/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,WAAW,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,eAAe,MAAM,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;;;oBA4B4vC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IATjzC,sDAAsD;;;;;;;;;;;;;;;;;;;;;;;;;;AAZxD,wBAoBE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/src/services/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,WAAW,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,eAAe,MAAM,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;;;oBA8B2rC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAVhvC,sDAAsD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAZxD,wBAqBE"}

package/dist/server/src/services/permission/rename-fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rename-fields.d.ts","sourceRoot":"","sources":["../../../../../server/src/services/permission/rename-fields.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAU,MAAM,eAAe,CAAC;AAIlD,KAAK,sBAAsB,GAAG,UAAU,CACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,gCAAgC,CAAC,CAC9D,CAAC,CAAC,CAAC,CAAC;AAYL;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GAAI,aAE1C;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;CACrB,KAAG,sBA2GH,CAAC"}
+{"version":3,"file":"rename-fields.d.ts","sourceRoot":"","sources":["../../../../../server/src/services/permission/rename-fields.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAU,MAAM,eAAe,CAAC;AAIlD,KAAK,sBAAsB,GAAG,UAAU,CACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,gCAAgC,CAAC,CAC9D,CAAC,CAAC,CAAC,CAAC;AAYL;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GAAI,aAE1C;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;CACrB,KAAG,sBA0GH,CAAC"}

package/dist/server/src/services/permission/sections-builder/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../../../../server/src/services/permission/sections-builder/handlers.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAIrD,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,GAAG,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,MAAM,EAAE,CAAC;AAE1C;;;;;;GAMG;AACH,QAAA,MAAM,QAAQ,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,SAWrF,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,OAAO,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,SAUpF,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,gBAAgB,GAAI,sBAGvB;IACD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,mBAAmB,CAAC;CAC9B,SAsBA,CAAC;AAEF;;GAEG;AACH,QAAA,MAAM,kBAAkB,GACrB,MAAM,MAAM,MACZ,0CAA0C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,SA2B1F,CAAC;AA2BJ;;GAEG;AACH,QAAA,MAAM,cAAc,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,SAkB5F,CAAC;AAEF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../../../../server/src/services/permission/sections-builder/handlers.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAIrD,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,GAAG,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,MAAM,EAAE,CAAC;AAE1C;;;;;;GAMG;AACH,QAAA,MAAM,QAAQ,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,SAWrF,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,OAAO,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,SAUpF,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,gBAAgB,GAAI,sBAGvB;IACD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,mBAAmB,CAAC;CAC9B,SAqBA,CAAC;AAEF;;GAEG;AACH,QAAA,MAAM,kBAAkB,GACrB,MAAM,MAAM,MACZ,0CAA0C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,SA2B1F,CAAC;AA2BJ;;GAEG;AACH,QAAA,MAAM,cAAc,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,SAkB5F,CAAC;AAEF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC"}