@strapi/admin 5.58.0 → 5.59.0

package/dist/server/shared/utils/auth-cookie-path.mjs

@@ -1,17 +1,20 @@
 /**
- * Path attribute of the admin auth (access) token cookie, configurable
- * through `admin.auth.cookie.path` so multiple Strapi instances on the same
- * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).
+ * Validates the Path attribute of the admin auth cookies. The path is
+ * configurable through `admin.auth.cookie.path` so multiple Strapi instances
+ * on the same parent domain can keep separate cookies (e.g. `/strapi-de/admin`).
  *
  * Browser-safe single source for both sides of the handoff: the admin panel
- * cannot read server config, so the build transports the config value into
- * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable
- * (see create-build-context.ts in @strapi/strapi); the server resolves the
- * same config at runtime. Changing the path requires an admin rebuild, like
- * any other admin config change.
+ * cannot read server config, so the build transports the access cookie path
+ * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH`
+ * variable (see create-build-context.ts in @strapi/strapi); the server
+ * resolves the same config at runtime. Changing the path requires an admin
+ * rebuild, like any other admin config change.
  *
- * Defaults to `/admin` to match the refresh-cookie path used by
- * `getRefreshCookieOptions`.
+ * The callers pick the value to validate (see session-auth.ts). When
+ * `admin.auth.cookie.path` is unset, the access cookie follows the path the
+ * panel is served from (`admin.url`) and the refresh cookie follows the admin
+ * API (`/admin`), each behind any `server.url` subpath.
+ * `DEFAULT_AUTH_COOKIE_PATH` is only the fallback for a missing or invalid value.
  */ const DEFAULT_AUTH_COOKIE_PATH = '/admin';
 const isValidCookiePath = (path)=>{
     if (!path.startsWith('/')) {

package/dist/server/shared/utils/auth-cookie-path.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cookie-path.mjs","sources":["../../../../shared/utils/auth-cookie-path.ts"],"sourcesContent":["/**\n * Path attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.path` so multiple Strapi instances on the same\n * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the path requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `/admin` to match the refresh-cookie path used by\n * `getRefreshCookieOptions`.\n */\nexport const DEFAULT_AUTH_COOKIE_PATH = '/admin';\n\nconst isValidCookiePath = (path: string): boolean => {\n  if (!path.startsWith('/')) {\n    return false;\n  }\n\n  // RFC 6265 path-av: any CHAR except CTLs or \";\".\n  // eslint-disable-next-line no-control-regex -- CTL chars are exactly what RFC 6265 forbids\n  return !/[\\x00-\\x1F\\x7F;]/.test(path);\n};\n\nexport const resolveAuthCookiePath = (\n  configuredPath?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookiePath = (configuredPath || '').trim();\n\n  if (!cookiePath) {\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  if (!isValidCookiePath(cookiePath)) {\n    warn(\n      `Ignoring invalid admin auth cookie path \"${cookiePath}\" (must be an absolute path without \";\"); using \"${DEFAULT_AUTH_COOKIE_PATH}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  return cookiePath;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_PATH","isValidCookiePath","path","startsWith","test","resolveAuthCookiePath","configuredPath","warn","console","cookiePath","trim"],"mappings":"AAAA;;;;;;;;;;;;;;IAeO,MAAMA,wBAAAA,GAA2B;AAExC,MAAMC,oBAAoB,CAACC,IAAAA,GAAAA;AACzB,IAAA,IAAI,CAACA,IAAAA,CAAKC,UAAU,CAAC,GAAA,CAAA,EAAM;QACzB,OAAO,KAAA;AACT,IAAA;;;IAIA,OAAO,CAAC,kBAAA,CAAmBC,IAAI,CAACF,IAAAA,CAAAA;AAClC,CAAA;MAEaG,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOT,wBAAAA;AACT,IAAA;IAEA,IAAI,CAACC,kBAAkBQ,UAAAA,CAAAA,EAAa;QAClCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,iDAAiD,EAAET,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAEhJ,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOS,UAAAA;AACT;;;;"}
+{"version":3,"file":"auth-cookie-path.mjs","sources":["../../../../shared/utils/auth-cookie-path.ts"],"sourcesContent":["/**\n * Validates the Path attribute of the admin auth cookies. The path is\n * configurable through `admin.auth.cookie.path` so multiple Strapi instances\n * on the same parent domain can keep separate cookies (e.g. `/strapi-de/admin`).\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the access cookie path\n * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH`\n * variable (see create-build-context.ts in @strapi/strapi); the server\n * resolves the same config at runtime. Changing the path requires an admin\n * rebuild, like any other admin config change.\n *\n * The callers pick the value to validate (see session-auth.ts). When\n * `admin.auth.cookie.path` is unset, the access cookie follows the path the\n * panel is served from (`admin.url`) and the refresh cookie follows the admin\n * API (`/admin`), each behind any `server.url` subpath.\n * `DEFAULT_AUTH_COOKIE_PATH` is only the fallback for a missing or invalid value.\n */\nexport const DEFAULT_AUTH_COOKIE_PATH = '/admin';\n\nconst isValidCookiePath = (path: string): boolean => {\n  if (!path.startsWith('/')) {\n    return false;\n  }\n\n  // RFC 6265 path-av: any CHAR except CTLs or \";\".\n  // eslint-disable-next-line no-control-regex -- CTL chars are exactly what RFC 6265 forbids\n  return !/[\\x00-\\x1F\\x7F;]/.test(path);\n};\n\nexport const resolveAuthCookiePath = (\n  configuredPath?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookiePath = (configuredPath || '').trim();\n\n  if (!cookiePath) {\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  if (!isValidCookiePath(cookiePath)) {\n    warn(\n      `Ignoring invalid admin auth cookie path \"${cookiePath}\" (must be an absolute path without \";\"); using \"${DEFAULT_AUTH_COOKIE_PATH}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  return cookiePath;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_PATH","isValidCookiePath","path","startsWith","test","resolveAuthCookiePath","configuredPath","warn","console","cookiePath","trim"],"mappings":"AAAA;;;;;;;;;;;;;;;;;IAkBO,MAAMA,wBAAAA,GAA2B;AAExC,MAAMC,oBAAoB,CAACC,IAAAA,GAAAA;AACzB,IAAA,IAAI,CAACA,IAAAA,CAAKC,UAAU,CAAC,GAAA,CAAA,EAAM;QACzB,OAAO,KAAA;AACT,IAAA;;;IAIA,OAAO,CAAC,kBAAA,CAAmBC,IAAI,CAACF,IAAAA,CAAAA;AAClC,CAAA;MAEaG,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOT,wBAAAA;AACT,IAAA;IAEA,IAAI,CAACC,kBAAkBQ,UAAAA,CAAAA,EAAa;QAClCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,iDAAiD,EAAET,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAEhJ,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOS,UAAAA;AACT;;;;"}

package/dist/server/shared/utils/get-project-type.js

@@ -25,11 +25,11 @@
 };
 // The statuses a license can be in once it has been read. `none` (never licensed) is left out
 // on purpose, and so is a missing status, which a mixed-version install can produce.
-const LICENSED_STATUSES = [
+const LICENSED_STATUSES = new Set([
     'active',
     'expired',
     'unknown'
-];
+]);
 /**
  * Resolves the plan a license was issued for, including one that has lapsed or can no longer
  * be read, so Support links, the Plan card and the debug dump can still name it. It unlocks
@@ -40,7 +40,7 @@ const LICENSED_STATUSES = [
  * type is stored, and with no price id `getProjectType` would fall through to Enterprise, so
  * both conditions are required. Every caller that derives a plan should go through here.
  */ const getLicensedPlan = ({ licenseStatus, type, planPriceId })=>getProjectType({
-        isEE: Boolean(type) && LICENSED_STATUSES.includes(licenseStatus ?? ''),
+        isEE: Boolean(type) && LICENSED_STATUSES.has(licenseStatus ?? ''),
         planPriceId: planPriceId ?? undefined
     });
 

package/dist/server/shared/utils/get-project-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-project-type.js","sources":["../../../../shared/utils/get-project-type.ts"],"sourcesContent":["type ProjectType = 'Community' | 'Growth' | 'Enterprise';\n\n/**\n * Resolves the plan label from the license information returned by the\n * `/admin/project-type` endpoint (browser) or `strapi.ee` (server).\n *\n * This labels the edition that is running: it follows `isEE`, so a lapsed license reads\n * Community. Browser tracking and NPS report this label and the startup table applies the same\n * rule; server metrics also label the running edition, but never say Growth. For the plan a\n * license was issued for, lapsed or not (the Plan card, the Support card and the debug dump),\n * use `getLicensedPlan` below.\n *\n * The label is intentionally limited to three values:\n * - `Community`  when there is no license (Community Edition).\n * - `Growth`     when the licensed plan price id contains \"growth\".\n * - `Enterprise` for any other licensed plan.\n */\nconst getProjectType = ({\n  isEE,\n  planPriceId,\n}: {\n  isEE: boolean;\n  planPriceId?: string;\n}): ProjectType => {\n  if (!isEE) {\n    return 'Community';\n  }\n\n  if (planPriceId?.toLowerCase().includes('growth')) {\n    return 'Growth';\n  }\n\n  return 'Enterprise';\n};\n\n// The statuses a license can be in once it has been read. `none` (never licensed) is left out\n// on purpose, and so is a missing status, which a mixed-version install can produce.\nconst LICENSED_STATUSES: readonly string[] = ['active', 'expired', 'unknown'];\n\n/**\n * Resolves the plan a license was issued for, including one that has lapsed or can no longer\n * be read, so Support links, the Plan card and the debug dump can still name it. It unlocks\n * nothing: feature gating stays on `isEE`.\n *\n * A plan is only reported when a type was verified at some point (live, or retained once the\n * license lapsed) AND the status is licensed. A corrupt license file sets `unknown` before any\n * type is stored, and with no price id `getProjectType` would fall through to Enterprise, so\n * both conditions are required. Every caller that derives a plan should go through here.\n */\nconst getLicensedPlan = ({\n  licenseStatus,\n  type,\n  planPriceId,\n}: {\n  licenseStatus: string | null | undefined;\n  type: string | null | undefined;\n  planPriceId?: string | null;\n}): ProjectType =>\n  getProjectType({\n    isEE: Boolean(type) && LICENSED_STATUSES.includes(licenseStatus ?? ''),\n    planPriceId: planPriceId ?? undefined,\n  });\n\nexport { getLicensedPlan, getProjectType };\nexport type { ProjectType };\n"],"names":["getProjectType","isEE","planPriceId","toLowerCase","includes","LICENSED_STATUSES","getLicensedPlan","licenseStatus","type","Boolean","undefined"],"mappings":";;AAEA;;;;;;;;;;;;;;AAcC,UACKA,cAAAA,GAAiB,CAAC,EACtBC,IAAI,EACJC,WAAW,EAIZ,GAAA;AACC,IAAA,IAAI,CAACD,IAAAA,EAAM;QACT,OAAO,WAAA;AACT,IAAA;IAEA,IAAIC,WAAAA,EAAaC,WAAAA,EAAAA,CAAcC,QAAAA,CAAS,QAAA,CAAA,EAAW;QACjD,OAAO,QAAA;AACT,IAAA;IAEA,OAAO,YAAA;AACT;AAEA;AACA;AACA,MAAMC,iBAAAA,GAAuC;AAAC,IAAA,QAAA;AAAU,IAAA,SAAA;AAAW,IAAA;AAAU,CAAA;AAE7E;;;;;;;;;IAUA,MAAMC,eAAAA,GAAkB,CAAC,EACvBC,aAAa,EACbC,IAAI,EACJN,WAAW,EAKZ,GACCF,cAAAA,CAAe;AACbC,QAAAA,IAAAA,EAAMQ,OAAAA,CAAQD,IAAAA,CAAAA,IAASH,iBAAAA,CAAkBD,QAAQ,CAACG,aAAAA,IAAiB,EAAA,CAAA;AACnEL,QAAAA,WAAAA,EAAaA,WAAAA,IAAeQ;AAC9B,KAAA;;;;;"}
+{"version":3,"file":"get-project-type.js","sources":["../../../../shared/utils/get-project-type.ts"],"sourcesContent":["type ProjectType = 'Community' | 'Growth' | 'Enterprise';\n\n/**\n * Resolves the plan label from the license information returned by the\n * `/admin/project-type` endpoint (browser) or `strapi.ee` (server).\n *\n * This labels the edition that is running: it follows `isEE`, so a lapsed license reads\n * Community. Browser tracking and NPS report this label and the startup table applies the same\n * rule; server metrics also label the running edition, but never say Growth. For the plan a\n * license was issued for, lapsed or not (the Plan card, the Support card and the debug dump),\n * use `getLicensedPlan` below.\n *\n * The label is intentionally limited to three values:\n * - `Community`  when there is no license (Community Edition).\n * - `Growth`     when the licensed plan price id contains \"growth\".\n * - `Enterprise` for any other licensed plan.\n */\nconst getProjectType = ({\n  isEE,\n  planPriceId,\n}: {\n  isEE: boolean;\n  planPriceId?: string;\n}): ProjectType => {\n  if (!isEE) {\n    return 'Community';\n  }\n\n  if (planPriceId?.toLowerCase().includes('growth')) {\n    return 'Growth';\n  }\n\n  return 'Enterprise';\n};\n\n// The statuses a license can be in once it has been read. `none` (never licensed) is left out\n// on purpose, and so is a missing status, which a mixed-version install can produce.\nconst LICENSED_STATUSES: ReadonlySet<string> = new Set(['active', 'expired', 'unknown']);\n\n/**\n * Resolves the plan a license was issued for, including one that has lapsed or can no longer\n * be read, so Support links, the Plan card and the debug dump can still name it. It unlocks\n * nothing: feature gating stays on `isEE`.\n *\n * A plan is only reported when a type was verified at some point (live, or retained once the\n * license lapsed) AND the status is licensed. A corrupt license file sets `unknown` before any\n * type is stored, and with no price id `getProjectType` would fall through to Enterprise, so\n * both conditions are required. Every caller that derives a plan should go through here.\n */\nconst getLicensedPlan = ({\n  licenseStatus,\n  type,\n  planPriceId,\n}: {\n  licenseStatus: string | null | undefined;\n  type: string | null | undefined;\n  planPriceId?: string | null;\n}): ProjectType =>\n  getProjectType({\n    isEE: Boolean(type) && LICENSED_STATUSES.has(licenseStatus ?? ''),\n    planPriceId: planPriceId ?? undefined,\n  });\n\nexport { getLicensedPlan, getProjectType };\nexport type { ProjectType };\n"],"names":["getProjectType","isEE","planPriceId","toLowerCase","includes","LICENSED_STATUSES","Set","getLicensedPlan","licenseStatus","type","Boolean","has","undefined"],"mappings":";;AAEA;;;;;;;;;;;;;;AAcC,UACKA,cAAAA,GAAiB,CAAC,EACtBC,IAAI,EACJC,WAAW,EAIZ,GAAA;AACC,IAAA,IAAI,CAACD,IAAAA,EAAM;QACT,OAAO,WAAA;AACT,IAAA;IAEA,IAAIC,WAAAA,EAAaC,WAAAA,EAAAA,CAAcC,QAAAA,CAAS,QAAA,CAAA,EAAW;QACjD,OAAO,QAAA;AACT,IAAA;IAEA,OAAO,YAAA;AACT;AAEA;AACA;AACA,MAAMC,iBAAAA,GAAyC,IAAIC,GAAAA,CAAI;AAAC,IAAA,QAAA;AAAU,IAAA,SAAA;AAAW,IAAA;AAAU,CAAA,CAAA;AAEvF;;;;;;;;;IAUA,MAAMC,eAAAA,GAAkB,CAAC,EACvBC,aAAa,EACbC,IAAI,EACJP,WAAW,EAKZ,GACCF,cAAAA,CAAe;AACbC,QAAAA,IAAAA,EAAMS,OAAAA,CAAQD,IAAAA,CAAAA,IAASJ,iBAAAA,CAAkBM,GAAG,CAACH,aAAAA,IAAiB,EAAA,CAAA;AAC9DN,QAAAA,WAAAA,EAAaA,WAAAA,IAAeU;AAC9B,KAAA;;;;;"}

package/dist/server/shared/utils/get-project-type.mjs

@@ -23,11 +23,11 @@
 };
 // The statuses a license can be in once it has been read. `none` (never licensed) is left out
 // on purpose, and so is a missing status, which a mixed-version install can produce.
-const LICENSED_STATUSES = [
+const LICENSED_STATUSES = new Set([
     'active',
     'expired',
     'unknown'
-];
+]);
 /**
  * Resolves the plan a license was issued for, including one that has lapsed or can no longer
  * be read, so Support links, the Plan card and the debug dump can still name it. It unlocks
@@ -38,7 +38,7 @@ const LICENSED_STATUSES = [
  * type is stored, and with no price id `getProjectType` would fall through to Enterprise, so
  * both conditions are required. Every caller that derives a plan should go through here.
  */ const getLicensedPlan = ({ licenseStatus, type, planPriceId })=>getProjectType({
-        isEE: Boolean(type) && LICENSED_STATUSES.includes(licenseStatus ?? ''),
+        isEE: Boolean(type) && LICENSED_STATUSES.has(licenseStatus ?? ''),
         planPriceId: planPriceId ?? undefined
     });
 

package/dist/server/shared/utils/get-project-type.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"get-project-type.mjs","sources":["../../../../shared/utils/get-project-type.ts"],"sourcesContent":["type ProjectType = 'Community' | 'Growth' | 'Enterprise';\n\n/**\n * Resolves the plan label from the license information returned by the\n * `/admin/project-type` endpoint (browser) or `strapi.ee` (server).\n *\n * This labels the edition that is running: it follows `isEE`, so a lapsed license reads\n * Community. Browser tracking and NPS report this label and the startup table applies the same\n * rule; server metrics also label the running edition, but never say Growth. For the plan a\n * license was issued for, lapsed or not (the Plan card, the Support card and the debug dump),\n * use `getLicensedPlan` below.\n *\n * The label is intentionally limited to three values:\n * - `Community`  when there is no license (Community Edition).\n * - `Growth`     when the licensed plan price id contains \"growth\".\n * - `Enterprise` for any other licensed plan.\n */\nconst getProjectType = ({\n  isEE,\n  planPriceId,\n}: {\n  isEE: boolean;\n  planPriceId?: string;\n}): ProjectType => {\n  if (!isEE) {\n    return 'Community';\n  }\n\n  if (planPriceId?.toLowerCase().includes('growth')) {\n    return 'Growth';\n  }\n\n  return 'Enterprise';\n};\n\n// The statuses a license can be in once it has been read. `none` (never licensed) is left out\n// on purpose, and so is a missing status, which a mixed-version install can produce.\nconst LICENSED_STATUSES: readonly string[] = ['active', 'expired', 'unknown'];\n\n/**\n * Resolves the plan a license was issued for, including one that has lapsed or can no longer\n * be read, so Support links, the Plan card and the debug dump can still name it. It unlocks\n * nothing: feature gating stays on `isEE`.\n *\n * A plan is only reported when a type was verified at some point (live, or retained once the\n * license lapsed) AND the status is licensed. A corrupt license file sets `unknown` before any\n * type is stored, and with no price id `getProjectType` would fall through to Enterprise, so\n * both conditions are required. Every caller that derives a plan should go through here.\n */\nconst getLicensedPlan = ({\n  licenseStatus,\n  type,\n  planPriceId,\n}: {\n  licenseStatus: string | null | undefined;\n  type: string | null | undefined;\n  planPriceId?: string | null;\n}): ProjectType =>\n  getProjectType({\n    isEE: Boolean(type) && LICENSED_STATUSES.includes(licenseStatus ?? ''),\n    planPriceId: planPriceId ?? undefined,\n  });\n\nexport { getLicensedPlan, getProjectType };\nexport type { ProjectType };\n"],"names":["getProjectType","isEE","planPriceId","toLowerCase","includes","LICENSED_STATUSES","getLicensedPlan","licenseStatus","type","Boolean","undefined"],"mappings":"AAEA;;;;;;;;;;;;;;AAcC,UACKA,cAAAA,GAAiB,CAAC,EACtBC,IAAI,EACJC,WAAW,EAIZ,GAAA;AACC,IAAA,IAAI,CAACD,IAAAA,EAAM;QACT,OAAO,WAAA;AACT,IAAA;IAEA,IAAIC,WAAAA,EAAaC,WAAAA,EAAAA,CAAcC,QAAAA,CAAS,QAAA,CAAA,EAAW;QACjD,OAAO,QAAA;AACT,IAAA;IAEA,OAAO,YAAA;AACT;AAEA;AACA;AACA,MAAMC,iBAAAA,GAAuC;AAAC,IAAA,QAAA;AAAU,IAAA,SAAA;AAAW,IAAA;AAAU,CAAA;AAE7E;;;;;;;;;IAUA,MAAMC,eAAAA,GAAkB,CAAC,EACvBC,aAAa,EACbC,IAAI,EACJN,WAAW,EAKZ,GACCF,cAAAA,CAAe;AACbC,QAAAA,IAAAA,EAAMQ,OAAAA,CAAQD,IAAAA,CAAAA,IAASH,iBAAAA,CAAkBD,QAAQ,CAACG,aAAAA,IAAiB,EAAA,CAAA;AACnEL,QAAAA,WAAAA,EAAaA,WAAAA,IAAeQ;AAC9B,KAAA;;;;"}
+{"version":3,"file":"get-project-type.mjs","sources":["../../../../shared/utils/get-project-type.ts"],"sourcesContent":["type ProjectType = 'Community' | 'Growth' | 'Enterprise';\n\n/**\n * Resolves the plan label from the license information returned by the\n * `/admin/project-type` endpoint (browser) or `strapi.ee` (server).\n *\n * This labels the edition that is running: it follows `isEE`, so a lapsed license reads\n * Community. Browser tracking and NPS report this label and the startup table applies the same\n * rule; server metrics also label the running edition, but never say Growth. For the plan a\n * license was issued for, lapsed or not (the Plan card, the Support card and the debug dump),\n * use `getLicensedPlan` below.\n *\n * The label is intentionally limited to three values:\n * - `Community`  when there is no license (Community Edition).\n * - `Growth`     when the licensed plan price id contains \"growth\".\n * - `Enterprise` for any other licensed plan.\n */\nconst getProjectType = ({\n  isEE,\n  planPriceId,\n}: {\n  isEE: boolean;\n  planPriceId?: string;\n}): ProjectType => {\n  if (!isEE) {\n    return 'Community';\n  }\n\n  if (planPriceId?.toLowerCase().includes('growth')) {\n    return 'Growth';\n  }\n\n  return 'Enterprise';\n};\n\n// The statuses a license can be in once it has been read. `none` (never licensed) is left out\n// on purpose, and so is a missing status, which a mixed-version install can produce.\nconst LICENSED_STATUSES: ReadonlySet<string> = new Set(['active', 'expired', 'unknown']);\n\n/**\n * Resolves the plan a license was issued for, including one that has lapsed or can no longer\n * be read, so Support links, the Plan card and the debug dump can still name it. It unlocks\n * nothing: feature gating stays on `isEE`.\n *\n * A plan is only reported when a type was verified at some point (live, or retained once the\n * license lapsed) AND the status is licensed. A corrupt license file sets `unknown` before any\n * type is stored, and with no price id `getProjectType` would fall through to Enterprise, so\n * both conditions are required. Every caller that derives a plan should go through here.\n */\nconst getLicensedPlan = ({\n  licenseStatus,\n  type,\n  planPriceId,\n}: {\n  licenseStatus: string | null | undefined;\n  type: string | null | undefined;\n  planPriceId?: string | null;\n}): ProjectType =>\n  getProjectType({\n    isEE: Boolean(type) && LICENSED_STATUSES.has(licenseStatus ?? ''),\n    planPriceId: planPriceId ?? undefined,\n  });\n\nexport { getLicensedPlan, getProjectType };\nexport type { ProjectType };\n"],"names":["getProjectType","isEE","planPriceId","toLowerCase","includes","LICENSED_STATUSES","Set","getLicensedPlan","licenseStatus","type","Boolean","has","undefined"],"mappings":"AAEA;;;;;;;;;;;;;;AAcC,UACKA,cAAAA,GAAiB,CAAC,EACtBC,IAAI,EACJC,WAAW,EAIZ,GAAA;AACC,IAAA,IAAI,CAACD,IAAAA,EAAM;QACT,OAAO,WAAA;AACT,IAAA;IAEA,IAAIC,WAAAA,EAAaC,WAAAA,EAAAA,CAAcC,QAAAA,CAAS,QAAA,CAAA,EAAW;QACjD,OAAO,QAAA;AACT,IAAA;IAEA,OAAO,YAAA;AACT;AAEA;AACA;AACA,MAAMC,iBAAAA,GAAyC,IAAIC,GAAAA,CAAI;AAAC,IAAA,QAAA;AAAU,IAAA,SAAA;AAAW,IAAA;AAAU,CAAA,CAAA;AAEvF;;;;;;;;;IAUA,MAAMC,eAAAA,GAAkB,CAAC,EACvBC,aAAa,EACbC,IAAI,EACJP,WAAW,EAKZ,GACCF,cAAAA,CAAe;AACbC,QAAAA,IAAAA,EAAMS,OAAAA,CAAQD,IAAAA,CAAAA,IAASJ,iBAAAA,CAAkBM,GAAG,CAACH,aAAAA,IAAiB,EAAA,CAAA;AAC9DN,QAAAA,WAAAA,EAAaA,WAAAA,IAAeU;AAC9B,KAAA;;;;"}

package/dist/server/shared/utils/session-auth.js

@@ -23,9 +23,75 @@ const getAccessCookieName = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.name');
     return authCookieName.resolveAuthCookieName(configured, warnViaStrapiLog);
 };
-const getAccessCookiePath = ()=>{
+// The admin API routes are mounted under `/admin` whatever `admin.url` is.
+const ADMIN_API_PREFIX = '/admin';
+const getConfiguredCookiePath = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.path');
-    return authCookiePath.resolveAuthCookiePath(configured, warnViaStrapiLog);
+    return typeof configured === 'string' && configured.trim() !== '' ? configured : undefined;
+};
+/**
+ * Path the browser sees for one of the resolved absolute URLs, so it includes
+ * a `server.url` subpath (`admin.path` does not). No trailing slash, except
+ * for the root.
+ */ const getBrowserPath = (key)=>{
+    const absoluteUrl = strapi.config.get(key);
+    if (typeof absoluteUrl !== 'string' || absoluteUrl === '') {
+        return undefined;
+    }
+    try {
+        return new URL(absoluteUrl).pathname.replace(/\/+$/, '') || '/';
+    } catch  {
+        return undefined;
+    }
+};
+/**
+ * Path the browser uses for the admin API (`/admin/access-token`,
+ * `/admin/login`, `/admin/logout`): `/admin` behind any `server.url` subpath.
+ */ const getAdminApiPath = ()=>{
+    const serverPath = getBrowserPath('server.absoluteUrl');
+    const apiPath = serverPath && serverPath !== '/' ? `${serverPath}${ADMIN_API_PREFIX}` : ADMIN_API_PREFIX;
+    return authCookiePath.resolveAuthCookiePath(apiPath, warnViaStrapiLog);
+};
+// RFC 6265 section 5.1.4: whether the browser attaches a cookie scoped to
+// `cookiePath` to a request for `requestPath`.
+const cookiePathMatches = (cookiePath, requestPath)=>{
+    if (requestPath === cookiePath) {
+        return true;
+    }
+    return requestPath.startsWith(cookiePath) && (cookiePath.endsWith('/') || requestPath.charAt(cookiePath.length) === '/');
+};
+/**
+ * Path of the non-httpOnly access cookie. Only the admin panel reads it,
+ * through `document.cookie`, which exposes a cookie only on pages its path
+ * matches. So when `admin.auth.cookie.path` is unset it follows the path the
+ * browser loads the panel from (`admin.url`, behind any `server.url` subpath).
+ * The admin build resolves the same value (create-build-context.ts).
+ */ const getAccessCookiePath = ()=>{
+    return authCookiePath.resolveAuthCookiePath(getConfiguredCookiePath() ?? getBrowserPath('admin.absoluteUrl'), warnViaStrapiLog);
+};
+const warnedRefreshCookiePaths = new Set();
+/**
+ * Path of the httpOnly refresh cookie (and every other cookie built from
+ * `getRefreshCookieOptions`). Only the admin API reads it, and the API does not
+ * move with `admin.url`, so it follows the API path instead of the panel.
+ * `admin.auth.cookie.path` is kept when it covers the API path. Otherwise the
+ * browser would never send the cookie to `/admin/access-token` and every
+ * session would end when its access token expires, so the API path is used.
+ */ const getRefreshCookiePath = ()=>{
+    const apiPath = getAdminApiPath();
+    const configured = getConfiguredCookiePath();
+    if (!configured) {
+        return apiPath;
+    }
+    const configuredPath = authCookiePath.resolveAuthCookiePath(configured, warnViaStrapiLog);
+    if (cookiePathMatches(configuredPath, apiPath)) {
+        return configuredPath;
+    }
+    if (!warnedRefreshCookiePaths.has(configuredPath)) {
+        warnedRefreshCookiePaths.add(configuredPath);
+        strapi.log.warn(`admin.auth.cookie.path "${configuredPath}" does not cover the admin API at "${apiPath}", so the browser would not send the refresh cookie to "${apiPath}/access-token". Using "${apiPath}" for the refresh cookie. The access cookie keeps "${configuredPath}".`);
+    }
+    return apiPath;
 };
 const getAccessCookieDomain = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');
@@ -39,7 +105,7 @@ const getRefreshCookieOptions = (secureRequest)=>{
     const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
     const isProduction = process.env.NODE_ENV === 'production';
     const domain = getAccessCookieDomain();
-    const path = getAccessCookiePath();
+    const path = getRefreshCookiePath();
     const sameSite = strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';
     let isSecure;
     if (typeof configuredSecure === 'boolean') {
@@ -141,6 +207,7 @@ exports.getAccessCookieDomain = getAccessCookieDomain;
 exports.getAccessCookieName = getAccessCookieName;
 exports.getAccessCookiePath = getAccessCookiePath;
 exports.getRefreshCookieOptions = getRefreshCookieOptions;
+exports.getRefreshCookiePath = getRefreshCookiePath;
 exports.getSessionManager = getSessionManager;
 exports.resolveLogoutDeviceId = resolveLogoutDeviceId;
 //# sourceMappingURL=session-auth.js.map

package/dist/server/shared/utils/session-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-auth.js","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Context } from 'koa';\nimport type { Modules } from '@strapi/types';\nimport { buildSessionMetadata } from '@strapi/utils';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\nimport { resolveAuthCookiePath } from './auth-cookie-path';\nimport { resolveAuthCookieDomain } from './auth-cookie-domain';\n\nconst ADMIN_ORIGIN = 'admin';\nconst SESSION_CONTENT_TYPE = 'admin::session';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\n// The resolvers are browser-shared (also inlined into the admin bundle) so\n// they default to console.warn; on the server, route their warnings through\n// the Strapi logger instead.\nconst warnViaStrapiLog = (message: string): void => {\n  strapi.log.warn(message);\n};\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookiePath = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.path');\n  return resolveAuthCookiePath(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookieDomain = (): string | undefined => {\n  const configured: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  return resolveAuthCookieDomain(configured, warnViaStrapiLog);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain = getAccessCookieDomain();\n  const path = getAccessCookiePath();\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n\nexport const buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\n/**\n * Resolves the device id to use when revoking sessions on logout.\n * SSO assigns deviceId server-side, so the client-provided value may not match\n * the active session row. Prefer the deviceId stored on the session backing\n * the current access token when available.\n *\n * Callers should pass `ctx.state.session.id` from the admin auth strategy and\n * the already-parsed body `deviceId` — the logout route requires authentication,\n * so sessionId is expected to be present.\n */\nexport const resolveLogoutDeviceId = async (\n  userId: string,\n  sessionId: string | undefined,\n  clientDeviceId: string | undefined\n): Promise<string | undefined> => {\n  if (!sessionId) {\n    strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');\n    return clientDeviceId;\n  }\n\n  const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({\n    where: { sessionId },\n  });\n\n  if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {\n    strapi.log.debug(\n      'resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId'\n    );\n    return clientDeviceId;\n  }\n\n  return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;\n};\n"],"names":["ADMIN_ORIGIN","SESSION_CONTENT_TYPE","REFRESH_COOKIE_NAME","warnViaStrapiLog","message","strapi","log","warn","getAccessCookieName","configured","config","get","resolveAuthCookieName","getAccessCookiePath","resolveAuthCookiePath","getAccessCookieDomain","resolveAuthCookieDomain","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","undefined","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean","buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","resolveLogoutDeviceId","userId","sessionId","clientDeviceId","debug","session","db","query","findOne","where","origin"],"mappings":";;;;;;;;;;;;AASA,MAAMA,YAAAA,GAAe,OAAA;AACrB,MAAMC,oBAAAA,GAAuB,gBAAA;AAEtB,MAAMC,sBAAsB;AAEnC;AACA;AACA;AACA,MAAMC,mBAAmB,CAACC,OAAAA,GAAAA;IACxBC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CAACH,OAAAA,CAAAA;AAClB,CAAA;MAEaI,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,qCAAsBH,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaU,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMJ,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOG,qCAAsBL,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaY,qBAAAA,GAAwB,IAAA;IACnC,MAAMN,UAAAA,GACJJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BN,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,OAAOK,yCAAwBP,UAAAA,EAAYN,gBAAAA,CAAAA;AAC7C;AAEO,MAAMc,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmBlB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMa,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,MAAAA,GAASb,qBAAAA,EAAAA;AACf,IAAA,MAAMc,IAAAA,GAAOhB,mBAAAA,EAAAA;AAEb,IAAA,MAAMiB,WACJzB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAIoB,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBU,SAAAA,EAAW;AACtCD,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLS,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQH,QAAAA;QACRI,SAAAA,EAAW,IAAA;AACXP,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAM,MAAAA,EAAQJ;AACV,KAAA;AACF;AAEA,MAAMK,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,8CAAA,EACAO,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMuB,aAAaD,MAAAA,CACjBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,6CAAA,EACAM,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEsB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACArB,aAAAA,GAAAA;AAEA,IAAA,MAAMsB,OAAOvB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIgB,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAUnD,OAAOoD,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,uBAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;AAEO,MAAME,+BAAAA,GAAkC,CAACC,GAAAA,GAC9CC,0BAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;KACjC;AAEF;;;;;;;;;AASC,IACM,MAAMC,qBAAAA,GAAwB,OACnCC,QACAC,SAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,SAAAA,EAAW;QACdtE,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CAAC,sEAAA,CAAA;QACjB,OAAOD,cAAAA;AACT,IAAA;IAEA,MAAME,OAAAA,GAAU,MAAMzE,MAAAA,CAAO0E,EAAE,CAACC,KAAK,CAAC/E,oBAAAA,CAAAA,CAAsBgF,OAAO,CAAC;QAClEC,KAAAA,EAAO;AAAEP,YAAAA;AAAU;AACrB,KAAA,CAAA;AAEA,IAAA,IAAIG,OAAAA,EAASJ,MAAAA,KAAWA,MAAAA,IAAUI,OAAAA,EAASK,WAAWnF,YAAAA,EAAc;QAClEK,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CACd,mGAAA,CAAA;QAEF,OAAOD,cAAAA;AACT,IAAA;AAEA,IAAA,OAAO,OAAOE,OAAAA,CAAQd,QAAQ,KAAK,QAAA,GAAWc,OAAAA,CAAQd,QAAQ,GAAGY,cAAAA;AACnE;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"session-auth.js","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Context } from 'koa';\nimport type { Modules } from '@strapi/types';\nimport { buildSessionMetadata } from '@strapi/utils';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\nimport { resolveAuthCookiePath } from './auth-cookie-path';\nimport { resolveAuthCookieDomain } from './auth-cookie-domain';\n\nconst ADMIN_ORIGIN = 'admin';\nconst SESSION_CONTENT_TYPE = 'admin::session';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\n// The resolvers are browser-shared (also inlined into the admin bundle) so\n// they default to console.warn; on the server, route their warnings through\n// the Strapi logger instead.\nconst warnViaStrapiLog = (message: string): void => {\n  strapi.log.warn(message);\n};\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured, warnViaStrapiLog);\n};\n\n// The admin API routes are mounted under `/admin` whatever `admin.url` is.\nconst ADMIN_API_PREFIX = '/admin';\n\nconst getConfiguredCookiePath = (): string | undefined => {\n  const configured: unknown = strapi.config.get('admin.auth.cookie.path');\n  return typeof configured === 'string' && configured.trim() !== '' ? configured : undefined;\n};\n\n/**\n * Path the browser sees for one of the resolved absolute URLs, so it includes\n * a `server.url` subpath (`admin.path` does not). No trailing slash, except\n * for the root.\n */\nconst getBrowserPath = (key: 'admin.absoluteUrl' | 'server.absoluteUrl'): string | undefined => {\n  const absoluteUrl: unknown = strapi.config.get(key);\n  if (typeof absoluteUrl !== 'string' || absoluteUrl === '') {\n    return undefined;\n  }\n\n  try {\n    return new URL(absoluteUrl).pathname.replace(/\\/+$/, '') || '/';\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * Path the browser uses for the admin API (`/admin/access-token`,\n * `/admin/login`, `/admin/logout`): `/admin` behind any `server.url` subpath.\n */\nconst getAdminApiPath = (): string => {\n  const serverPath = getBrowserPath('server.absoluteUrl');\n  const apiPath =\n    serverPath && serverPath !== '/' ? `${serverPath}${ADMIN_API_PREFIX}` : ADMIN_API_PREFIX;\n  return resolveAuthCookiePath(apiPath, warnViaStrapiLog);\n};\n\n// RFC 6265 section 5.1.4: whether the browser attaches a cookie scoped to\n// `cookiePath` to a request for `requestPath`.\nconst cookiePathMatches = (cookiePath: string, requestPath: string): boolean => {\n  if (requestPath === cookiePath) {\n    return true;\n  }\n\n  return (\n    requestPath.startsWith(cookiePath) &&\n    (cookiePath.endsWith('/') || requestPath.charAt(cookiePath.length) === '/')\n  );\n};\n\n/**\n * Path of the non-httpOnly access cookie. Only the admin panel reads it,\n * through `document.cookie`, which exposes a cookie only on pages its path\n * matches. So when `admin.auth.cookie.path` is unset it follows the path the\n * browser loads the panel from (`admin.url`, behind any `server.url` subpath).\n * The admin build resolves the same value (create-build-context.ts).\n */\nexport const getAccessCookiePath = (): string => {\n  return resolveAuthCookiePath(\n    getConfiguredCookiePath() ?? getBrowserPath('admin.absoluteUrl'),\n    warnViaStrapiLog\n  );\n};\n\nconst warnedRefreshCookiePaths = new Set<string>();\n\n/**\n * Path of the httpOnly refresh cookie (and every other cookie built from\n * `getRefreshCookieOptions`). Only the admin API reads it, and the API does not\n * move with `admin.url`, so it follows the API path instead of the panel.\n * `admin.auth.cookie.path` is kept when it covers the API path. Otherwise the\n * browser would never send the cookie to `/admin/access-token` and every\n * session would end when its access token expires, so the API path is used.\n */\nexport const getRefreshCookiePath = (): string => {\n  const apiPath = getAdminApiPath();\n  const configured = getConfiguredCookiePath();\n\n  if (!configured) {\n    return apiPath;\n  }\n\n  const configuredPath = resolveAuthCookiePath(configured, warnViaStrapiLog);\n  if (cookiePathMatches(configuredPath, apiPath)) {\n    return configuredPath;\n  }\n\n  if (!warnedRefreshCookiePaths.has(configuredPath)) {\n    warnedRefreshCookiePaths.add(configuredPath);\n    strapi.log.warn(\n      `admin.auth.cookie.path \"${configuredPath}\" does not cover the admin API at \"${apiPath}\", so the browser would not send the refresh cookie to \"${apiPath}/access-token\". Using \"${apiPath}\" for the refresh cookie. The access cookie keeps \"${configuredPath}\".`\n    );\n  }\n\n  return apiPath;\n};\n\nexport const getAccessCookieDomain = (): string | undefined => {\n  const configured: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  return resolveAuthCookieDomain(configured, warnViaStrapiLog);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain = getAccessCookieDomain();\n  const path = getRefreshCookiePath();\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n\nexport const buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\n/**\n * Resolves the device id to use when revoking sessions on logout.\n * SSO assigns deviceId server-side, so the client-provided value may not match\n * the active session row. Prefer the deviceId stored on the session backing\n * the current access token when available.\n *\n * Callers should pass `ctx.state.session.id` from the admin auth strategy and\n * the already-parsed body `deviceId` — the logout route requires authentication,\n * so sessionId is expected to be present.\n */\nexport const resolveLogoutDeviceId = async (\n  userId: string,\n  sessionId: string | undefined,\n  clientDeviceId: string | undefined\n): Promise<string | undefined> => {\n  if (!sessionId) {\n    strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');\n    return clientDeviceId;\n  }\n\n  const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({\n    where: { sessionId },\n  });\n\n  if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {\n    strapi.log.debug(\n      'resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId'\n    );\n    return clientDeviceId;\n  }\n\n  return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;\n};\n"],"names":["ADMIN_ORIGIN","SESSION_CONTENT_TYPE","REFRESH_COOKIE_NAME","warnViaStrapiLog","message","strapi","log","warn","getAccessCookieName","configured","config","get","resolveAuthCookieName","ADMIN_API_PREFIX","getConfiguredCookiePath","trim","undefined","getBrowserPath","key","absoluteUrl","URL","pathname","replace","getAdminApiPath","serverPath","apiPath","resolveAuthCookiePath","cookiePathMatches","cookiePath","requestPath","startsWith","endsWith","charAt","length","getAccessCookiePath","warnedRefreshCookiePaths","Set","getRefreshCookiePath","configuredPath","has","add","getAccessCookieDomain","resolveAuthCookieDomain","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean","buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","resolveLogoutDeviceId","userId","sessionId","clientDeviceId","debug","session","db","query","findOne","where","origin"],"mappings":";;;;;;;;;;;;AASA,MAAMA,YAAAA,GAAe,OAAA;AACrB,MAAMC,oBAAAA,GAAuB,gBAAA;AAEtB,MAAMC,sBAAsB;AAEnC;AACA;AACA;AACA,MAAMC,mBAAmB,CAACC,OAAAA,GAAAA;IACxBC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CAACH,OAAAA,CAAAA;AAClB,CAAA;MAEaI,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,qCAAsBH,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;AAEA;AACA,MAAMU,gBAAAA,GAAmB,QAAA;AAEzB,MAAMC,uBAAAA,GAA0B,IAAA;AAC9B,IAAA,MAAML,UAAAA,GAAsBJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AAC9C,IAAA,OAAO,OAAOF,UAAAA,KAAe,QAAA,IAAYA,WAAWM,IAAI,EAAA,KAAO,KAAKN,UAAAA,GAAaO,SAAAA;AACnF,CAAA;AAEA;;;;IAKA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;AACtB,IAAA,MAAMC,WAAAA,GAAuBd,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAACO,GAAAA,CAAAA;AAC/C,IAAA,IAAI,OAAOC,WAAAA,KAAgB,QAAA,IAAYA,WAAAA,KAAgB,EAAA,EAAI;QACzD,OAAOH,SAAAA;AACT,IAAA;IAEA,IAAI;QACF,OAAO,IAAII,IAAID,WAAAA,CAAAA,CAAaE,QAAQ,CAACC,OAAO,CAAC,QAAQ,EAAA,CAAA,IAAO,GAAA;AAC9D,IAAA,CAAA,CAAE,OAAM;QACN,OAAON,SAAAA;AACT,IAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAMO,eAAAA,GAAkB,IAAA;AACtB,IAAA,MAAMC,aAAaP,cAAAA,CAAe,oBAAA,CAAA;AAClC,IAAA,MAAMQ,UACJD,UAAAA,IAAcA,UAAAA,KAAe,MAAM,CAAA,EAAGA,UAAAA,CAAAA,EAAaX,kBAAkB,GAAGA,gBAAAA;AAC1E,IAAA,OAAOa,qCAAsBD,OAAAA,EAAStB,gBAAAA,CAAAA;AACxC,CAAA;AAEA;AACA;AACA,MAAMwB,iBAAAA,GAAoB,CAACC,UAAAA,EAAoBC,WAAAA,GAAAA;AAC7C,IAAA,IAAIA,gBAAgBD,UAAAA,EAAY;QAC9B,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OACEC,WAAAA,CAAYC,UAAU,CAACF,UAAAA,CAAAA,KACtBA,UAAAA,CAAWG,QAAQ,CAAC,GAAA,CAAA,IAAQF,YAAYG,MAAM,CAACJ,UAAAA,CAAWK,MAAM,MAAM,GAAE,CAAA;AAE7E,CAAA;AAEA;;;;;;UAOaC,mBAAAA,GAAsB,IAAA;IACjC,OAAOR,oCAAAA,CACLZ,uBAAAA,EAAAA,IAA6BG,cAAAA,CAAe,mBAAA,CAAA,EAC5Cd,gBAAAA,CAAAA;AAEJ;AAEA,MAAMgC,2BAA2B,IAAIC,GAAAA,EAAAA;AAErC;;;;;;;UAQaC,oBAAAA,GAAuB,IAAA;AAClC,IAAA,MAAMZ,OAAAA,GAAUF,eAAAA,EAAAA;AAChB,IAAA,MAAMd,UAAAA,GAAaK,uBAAAA,EAAAA;AAEnB,IAAA,IAAI,CAACL,UAAAA,EAAY;QACf,OAAOgB,OAAAA;AACT,IAAA;IAEA,MAAMa,cAAAA,GAAiBZ,qCAAsBjB,UAAAA,EAAYN,gBAAAA,CAAAA;IACzD,IAAIwB,iBAAAA,CAAkBW,gBAAgBb,OAAAA,CAAAA,EAAU;QAC9C,OAAOa,cAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACH,wBAAAA,CAAyBI,GAAG,CAACD,cAAAA,CAAAA,EAAiB;AACjDH,QAAAA,wBAAAA,CAAyBK,GAAG,CAACF,cAAAA,CAAAA;QAC7BjC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CACb,CAAC,wBAAwB,EAAE+B,eAAe,mCAAmC,EAAEb,QAAQ,wDAAwD,EAAEA,QAAQ,uBAAuB,EAAEA,QAAQ,mDAAmD,EAAEa,cAAAA,CAAe,EAAE,CAAC,CAAA;AAErQ,IAAA;IAEA,OAAOb,OAAAA;AACT;MAEagB,qBAAAA,GAAwB,IAAA;IACnC,MAAMhC,UAAAA,GACJJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BN,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,OAAO+B,yCAAwBjC,UAAAA,EAAYN,gBAAAA,CAAAA;AAC7C;AAEO,MAAMwC,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMuC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,MAAAA,GAASb,qBAAAA,EAAAA;AACf,IAAA,MAAMc,IAAAA,GAAOlB,oBAAAA,EAAAA;AAEb,IAAA,MAAMmB,WACJnD,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAI8C,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBhC,SAAAA,EAAW;AACtCyC,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLQ,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQF,QAAAA;QACRG,SAAAA,EAAW,IAAA;AACXN,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAK,MAAAA,EAAQ7C;AACV,KAAA;AACF;AAEA,MAAM8C,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClB5D,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,8CAAA,EACAiC,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMsB,aAAaD,MAAAA,CACjB5D,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,6CAAA,EACAgC,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEqB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACApB,aAAAA,GAAAA;AAEA,IAAA,MAAMqB,OAAOtB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIe,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAU5E,OAAO6E,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,uBAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;AAEO,MAAME,+BAAAA,GAAkC,CAACC,GAAAA,GAC9CC,0BAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;KACjC;AAEF;;;;;;;;;AASC,IACM,MAAMC,qBAAAA,GAAwB,OACnCC,QACAC,SAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,SAAAA,EAAW;QACd/F,MAAAA,CAAOC,GAAG,CAACgG,KAAK,CAAC,sEAAA,CAAA;QACjB,OAAOD,cAAAA;AACT,IAAA;IAEA,MAAME,OAAAA,GAAU,MAAMlG,MAAAA,CAAOmG,EAAE,CAACC,KAAK,CAACxG,oBAAAA,CAAAA,CAAsByG,OAAO,CAAC;QAClEC,KAAAA,EAAO;AAAEP,YAAAA;AAAU;AACrB,KAAA,CAAA;AAEA,IAAA,IAAIG,OAAAA,EAASJ,MAAAA,KAAWA,MAAAA,IAAUI,OAAAA,EAASK,WAAW5G,YAAAA,EAAc;QAClEK,MAAAA,CAAOC,GAAG,CAACgG,KAAK,CACd,mGAAA,CAAA;QAEF,OAAOD,cAAAA;AACT,IAAA;AAEA,IAAA,OAAO,OAAOE,OAAAA,CAAQd,QAAQ,KAAK,QAAA,GAAWc,OAAAA,CAAQd,QAAQ,GAAGY,cAAAA;AACnE;;;;;;;;;;;;;;;;;;;"}

package/dist/server/shared/utils/session-auth.mjs

@@ -17,9 +17,75 @@ const getAccessCookieName = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.name');
     return resolveAuthCookieName(configured, warnViaStrapiLog);
 };
-const getAccessCookiePath = ()=>{
+// The admin API routes are mounted under `/admin` whatever `admin.url` is.
+const ADMIN_API_PREFIX = '/admin';
+const getConfiguredCookiePath = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.path');
-    return resolveAuthCookiePath(configured, warnViaStrapiLog);
+    return typeof configured === 'string' && configured.trim() !== '' ? configured : undefined;
+};
+/**
+ * Path the browser sees for one of the resolved absolute URLs, so it includes
+ * a `server.url` subpath (`admin.path` does not). No trailing slash, except
+ * for the root.
+ */ const getBrowserPath = (key)=>{
+    const absoluteUrl = strapi.config.get(key);
+    if (typeof absoluteUrl !== 'string' || absoluteUrl === '') {
+        return undefined;
+    }
+    try {
+        return new URL(absoluteUrl).pathname.replace(/\/+$/, '') || '/';
+    } catch  {
+        return undefined;
+    }
+};
+/**
+ * Path the browser uses for the admin API (`/admin/access-token`,
+ * `/admin/login`, `/admin/logout`): `/admin` behind any `server.url` subpath.
+ */ const getAdminApiPath = ()=>{
+    const serverPath = getBrowserPath('server.absoluteUrl');
+    const apiPath = serverPath && serverPath !== '/' ? `${serverPath}${ADMIN_API_PREFIX}` : ADMIN_API_PREFIX;
+    return resolveAuthCookiePath(apiPath, warnViaStrapiLog);
+};
+// RFC 6265 section 5.1.4: whether the browser attaches a cookie scoped to
+// `cookiePath` to a request for `requestPath`.
+const cookiePathMatches = (cookiePath, requestPath)=>{
+    if (requestPath === cookiePath) {
+        return true;
+    }
+    return requestPath.startsWith(cookiePath) && (cookiePath.endsWith('/') || requestPath.charAt(cookiePath.length) === '/');
+};
+/**
+ * Path of the non-httpOnly access cookie. Only the admin panel reads it,
+ * through `document.cookie`, which exposes a cookie only on pages its path
+ * matches. So when `admin.auth.cookie.path` is unset it follows the path the
+ * browser loads the panel from (`admin.url`, behind any `server.url` subpath).
+ * The admin build resolves the same value (create-build-context.ts).
+ */ const getAccessCookiePath = ()=>{
+    return resolveAuthCookiePath(getConfiguredCookiePath() ?? getBrowserPath('admin.absoluteUrl'), warnViaStrapiLog);
+};
+const warnedRefreshCookiePaths = new Set();
+/**
+ * Path of the httpOnly refresh cookie (and every other cookie built from
+ * `getRefreshCookieOptions`). Only the admin API reads it, and the API does not
+ * move with `admin.url`, so it follows the API path instead of the panel.
+ * `admin.auth.cookie.path` is kept when it covers the API path. Otherwise the
+ * browser would never send the cookie to `/admin/access-token` and every
+ * session would end when its access token expires, so the API path is used.
+ */ const getRefreshCookiePath = ()=>{
+    const apiPath = getAdminApiPath();
+    const configured = getConfiguredCookiePath();
+    if (!configured) {
+        return apiPath;
+    }
+    const configuredPath = resolveAuthCookiePath(configured, warnViaStrapiLog);
+    if (cookiePathMatches(configuredPath, apiPath)) {
+        return configuredPath;
+    }
+    if (!warnedRefreshCookiePaths.has(configuredPath)) {
+        warnedRefreshCookiePaths.add(configuredPath);
+        strapi.log.warn(`admin.auth.cookie.path "${configuredPath}" does not cover the admin API at "${apiPath}", so the browser would not send the refresh cookie to "${apiPath}/access-token". Using "${apiPath}" for the refresh cookie. The access cookie keeps "${configuredPath}".`);
+    }
+    return apiPath;
 };
 const getAccessCookieDomain = ()=>{
     const configured = strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');
@@ -33,7 +99,7 @@ const getRefreshCookieOptions = (secureRequest)=>{
     const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
     const isProduction = process.env.NODE_ENV === 'production';
     const domain = getAccessCookieDomain();
-    const path = getAccessCookiePath();
+    const path = getRefreshCookiePath();
     const sameSite = strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';
     let isSecure;
     if (typeof configuredSecure === 'boolean') {
@@ -122,5 +188,5 @@ const buildSessionMetadataFromContext = (ctx)=>buildSessionMetadata({
     return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;
 };
 
-export { DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN, DEFAULT_IDLE_SESSION_LIFESPAN, DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN, DEFAULT_MAX_SESSION_LIFESPAN, REFRESH_COOKIE_NAME, buildCookieOptionsWithExpiry, buildSessionMetadataFromContext, extractDeviceParams, generateDeviceId, getAccessCookieDomain, getAccessCookieName, getAccessCookiePath, getRefreshCookieOptions, getSessionManager, resolveLogoutDeviceId };
+export { DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN, DEFAULT_IDLE_SESSION_LIFESPAN, DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN, DEFAULT_MAX_SESSION_LIFESPAN, REFRESH_COOKIE_NAME, buildCookieOptionsWithExpiry, buildSessionMetadataFromContext, extractDeviceParams, generateDeviceId, getAccessCookieDomain, getAccessCookieName, getAccessCookiePath, getRefreshCookieOptions, getRefreshCookiePath, getSessionManager, resolveLogoutDeviceId };
 //# sourceMappingURL=session-auth.mjs.map

package/dist/server/shared/utils/session-auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-auth.mjs","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Context } from 'koa';\nimport type { Modules } from '@strapi/types';\nimport { buildSessionMetadata } from '@strapi/utils';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\nimport { resolveAuthCookiePath } from './auth-cookie-path';\nimport { resolveAuthCookieDomain } from './auth-cookie-domain';\n\nconst ADMIN_ORIGIN = 'admin';\nconst SESSION_CONTENT_TYPE = 'admin::session';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\n// The resolvers are browser-shared (also inlined into the admin bundle) so\n// they default to console.warn; on the server, route their warnings through\n// the Strapi logger instead.\nconst warnViaStrapiLog = (message: string): void => {\n  strapi.log.warn(message);\n};\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookiePath = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.path');\n  return resolveAuthCookiePath(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookieDomain = (): string | undefined => {\n  const configured: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  return resolveAuthCookieDomain(configured, warnViaStrapiLog);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain = getAccessCookieDomain();\n  const path = getAccessCookiePath();\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n\nexport const buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\n/**\n * Resolves the device id to use when revoking sessions on logout.\n * SSO assigns deviceId server-side, so the client-provided value may not match\n * the active session row. Prefer the deviceId stored on the session backing\n * the current access token when available.\n *\n * Callers should pass `ctx.state.session.id` from the admin auth strategy and\n * the already-parsed body `deviceId` — the logout route requires authentication,\n * so sessionId is expected to be present.\n */\nexport const resolveLogoutDeviceId = async (\n  userId: string,\n  sessionId: string | undefined,\n  clientDeviceId: string | undefined\n): Promise<string | undefined> => {\n  if (!sessionId) {\n    strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');\n    return clientDeviceId;\n  }\n\n  const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({\n    where: { sessionId },\n  });\n\n  if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {\n    strapi.log.debug(\n      'resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId'\n    );\n    return clientDeviceId;\n  }\n\n  return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;\n};\n"],"names":["ADMIN_ORIGIN","SESSION_CONTENT_TYPE","REFRESH_COOKIE_NAME","warnViaStrapiLog","message","strapi","log","warn","getAccessCookieName","configured","config","get","resolveAuthCookieName","getAccessCookiePath","resolveAuthCookiePath","getAccessCookieDomain","resolveAuthCookieDomain","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","undefined","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean","buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","resolveLogoutDeviceId","userId","sessionId","clientDeviceId","debug","session","db","query","findOne","where","origin"],"mappings":";;;;;;AASA,MAAMA,YAAAA,GAAe,OAAA;AACrB,MAAMC,oBAAAA,GAAuB,gBAAA;AAEtB,MAAMC,sBAAsB;AAEnC;AACA;AACA;AACA,MAAMC,mBAAmB,CAACC,OAAAA,GAAAA;IACxBC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CAACH,OAAAA,CAAAA;AAClB,CAAA;MAEaI,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,sBAAsBH,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaU,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMJ,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOG,sBAAsBL,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaY,qBAAAA,GAAwB,IAAA;IACnC,MAAMN,UAAAA,GACJJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BN,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,OAAOK,wBAAwBP,UAAAA,EAAYN,gBAAAA,CAAAA;AAC7C;AAEO,MAAMc,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmBlB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMa,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,MAAAA,GAASb,qBAAAA,EAAAA;AACf,IAAA,MAAMc,IAAAA,GAAOhB,mBAAAA,EAAAA;AAEb,IAAA,MAAMiB,WACJzB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAIoB,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBU,SAAAA,EAAW;AACtCD,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLS,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQH,QAAAA;QACRI,SAAAA,EAAW,IAAA;AACXP,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAM,MAAAA,EAAQJ;AACV,KAAA;AACF;AAEA,MAAMK,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,8CAAA,EACAO,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMuB,aAAaD,MAAAA,CACjBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,6CAAA,EACAM,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEsB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACArB,aAAAA,GAAAA;AAEA,IAAA,MAAMsB,OAAOvB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIgB,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAUnD,OAAOoD,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,MAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;AAEO,MAAME,+BAAAA,GAAkC,CAACC,GAAAA,GAC9CC,oBAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;KACjC;AAEF;;;;;;;;;AASC,IACM,MAAMC,qBAAAA,GAAwB,OACnCC,QACAC,SAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,SAAAA,EAAW;QACdtE,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CAAC,sEAAA,CAAA;QACjB,OAAOD,cAAAA;AACT,IAAA;IAEA,MAAME,OAAAA,GAAU,MAAMzE,MAAAA,CAAO0E,EAAE,CAACC,KAAK,CAAC/E,oBAAAA,CAAAA,CAAsBgF,OAAO,CAAC;QAClEC,KAAAA,EAAO;AAAEP,YAAAA;AAAU;AACrB,KAAA,CAAA;AAEA,IAAA,IAAIG,OAAAA,EAASJ,MAAAA,KAAWA,MAAAA,IAAUI,OAAAA,EAASK,WAAWnF,YAAAA,EAAc;QAClEK,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CACd,mGAAA,CAAA;QAEF,OAAOD,cAAAA;AACT,IAAA;AAEA,IAAA,OAAO,OAAOE,OAAAA,CAAQd,QAAQ,KAAK,QAAA,GAAWc,OAAAA,CAAQd,QAAQ,GAAGY,cAAAA;AACnE;;;;"}
+{"version":3,"file":"session-auth.mjs","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Context } from 'koa';\nimport type { Modules } from '@strapi/types';\nimport { buildSessionMetadata } from '@strapi/utils';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\nimport { resolveAuthCookiePath } from './auth-cookie-path';\nimport { resolveAuthCookieDomain } from './auth-cookie-domain';\n\nconst ADMIN_ORIGIN = 'admin';\nconst SESSION_CONTENT_TYPE = 'admin::session';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\n// The resolvers are browser-shared (also inlined into the admin bundle) so\n// they default to console.warn; on the server, route their warnings through\n// the Strapi logger instead.\nconst warnViaStrapiLog = (message: string): void => {\n  strapi.log.warn(message);\n};\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured, warnViaStrapiLog);\n};\n\n// The admin API routes are mounted under `/admin` whatever `admin.url` is.\nconst ADMIN_API_PREFIX = '/admin';\n\nconst getConfiguredCookiePath = (): string | undefined => {\n  const configured: unknown = strapi.config.get('admin.auth.cookie.path');\n  return typeof configured === 'string' && configured.trim() !== '' ? configured : undefined;\n};\n\n/**\n * Path the browser sees for one of the resolved absolute URLs, so it includes\n * a `server.url` subpath (`admin.path` does not). No trailing slash, except\n * for the root.\n */\nconst getBrowserPath = (key: 'admin.absoluteUrl' | 'server.absoluteUrl'): string | undefined => {\n  const absoluteUrl: unknown = strapi.config.get(key);\n  if (typeof absoluteUrl !== 'string' || absoluteUrl === '') {\n    return undefined;\n  }\n\n  try {\n    return new URL(absoluteUrl).pathname.replace(/\\/+$/, '') || '/';\n  } catch {\n    return undefined;\n  }\n};\n\n/**\n * Path the browser uses for the admin API (`/admin/access-token`,\n * `/admin/login`, `/admin/logout`): `/admin` behind any `server.url` subpath.\n */\nconst getAdminApiPath = (): string => {\n  const serverPath = getBrowserPath('server.absoluteUrl');\n  const apiPath =\n    serverPath && serverPath !== '/' ? `${serverPath}${ADMIN_API_PREFIX}` : ADMIN_API_PREFIX;\n  return resolveAuthCookiePath(apiPath, warnViaStrapiLog);\n};\n\n// RFC 6265 section 5.1.4: whether the browser attaches a cookie scoped to\n// `cookiePath` to a request for `requestPath`.\nconst cookiePathMatches = (cookiePath: string, requestPath: string): boolean => {\n  if (requestPath === cookiePath) {\n    return true;\n  }\n\n  return (\n    requestPath.startsWith(cookiePath) &&\n    (cookiePath.endsWith('/') || requestPath.charAt(cookiePath.length) === '/')\n  );\n};\n\n/**\n * Path of the non-httpOnly access cookie. Only the admin panel reads it,\n * through `document.cookie`, which exposes a cookie only on pages its path\n * matches. So when `admin.auth.cookie.path` is unset it follows the path the\n * browser loads the panel from (`admin.url`, behind any `server.url` subpath).\n * The admin build resolves the same value (create-build-context.ts).\n */\nexport const getAccessCookiePath = (): string => {\n  return resolveAuthCookiePath(\n    getConfiguredCookiePath() ?? getBrowserPath('admin.absoluteUrl'),\n    warnViaStrapiLog\n  );\n};\n\nconst warnedRefreshCookiePaths = new Set<string>();\n\n/**\n * Path of the httpOnly refresh cookie (and every other cookie built from\n * `getRefreshCookieOptions`). Only the admin API reads it, and the API does not\n * move with `admin.url`, so it follows the API path instead of the panel.\n * `admin.auth.cookie.path` is kept when it covers the API path. Otherwise the\n * browser would never send the cookie to `/admin/access-token` and every\n * session would end when its access token expires, so the API path is used.\n */\nexport const getRefreshCookiePath = (): string => {\n  const apiPath = getAdminApiPath();\n  const configured = getConfiguredCookiePath();\n\n  if (!configured) {\n    return apiPath;\n  }\n\n  const configuredPath = resolveAuthCookiePath(configured, warnViaStrapiLog);\n  if (cookiePathMatches(configuredPath, apiPath)) {\n    return configuredPath;\n  }\n\n  if (!warnedRefreshCookiePaths.has(configuredPath)) {\n    warnedRefreshCookiePaths.add(configuredPath);\n    strapi.log.warn(\n      `admin.auth.cookie.path \"${configuredPath}\" does not cover the admin API at \"${apiPath}\", so the browser would not send the refresh cookie to \"${apiPath}/access-token\". Using \"${apiPath}\" for the refresh cookie. The access cookie keeps \"${configuredPath}\".`\n    );\n  }\n\n  return apiPath;\n};\n\nexport const getAccessCookieDomain = (): string | undefined => {\n  const configured: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  return resolveAuthCookieDomain(configured, warnViaStrapiLog);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain = getAccessCookieDomain();\n  const path = getRefreshCookiePath();\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n\nexport const buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\n/**\n * Resolves the device id to use when revoking sessions on logout.\n * SSO assigns deviceId server-side, so the client-provided value may not match\n * the active session row. Prefer the deviceId stored on the session backing\n * the current access token when available.\n *\n * Callers should pass `ctx.state.session.id` from the admin auth strategy and\n * the already-parsed body `deviceId` — the logout route requires authentication,\n * so sessionId is expected to be present.\n */\nexport const resolveLogoutDeviceId = async (\n  userId: string,\n  sessionId: string | undefined,\n  clientDeviceId: string | undefined\n): Promise<string | undefined> => {\n  if (!sessionId) {\n    strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');\n    return clientDeviceId;\n  }\n\n  const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({\n    where: { sessionId },\n  });\n\n  if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {\n    strapi.log.debug(\n      'resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId'\n    );\n    return clientDeviceId;\n  }\n\n  return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;\n};\n"],"names":["ADMIN_ORIGIN","SESSION_CONTENT_TYPE","REFRESH_COOKIE_NAME","warnViaStrapiLog","message","strapi","log","warn","getAccessCookieName","configured","config","get","resolveAuthCookieName","ADMIN_API_PREFIX","getConfiguredCookiePath","trim","undefined","getBrowserPath","key","absoluteUrl","URL","pathname","replace","getAdminApiPath","serverPath","apiPath","resolveAuthCookiePath","cookiePathMatches","cookiePath","requestPath","startsWith","endsWith","charAt","length","getAccessCookiePath","warnedRefreshCookiePaths","Set","getRefreshCookiePath","configuredPath","has","add","getAccessCookieDomain","resolveAuthCookieDomain","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean","buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","resolveLogoutDeviceId","userId","sessionId","clientDeviceId","debug","session","db","query","findOne","where","origin"],"mappings":";;;;;;AASA,MAAMA,YAAAA,GAAe,OAAA;AACrB,MAAMC,oBAAAA,GAAuB,gBAAA;AAEtB,MAAMC,sBAAsB;AAEnC;AACA;AACA;AACA,MAAMC,mBAAmB,CAACC,OAAAA,GAAAA;IACxBC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CAACH,OAAAA,CAAAA;AAClB,CAAA;MAEaI,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,sBAAsBH,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;AAEA;AACA,MAAMU,gBAAAA,GAAmB,QAAA;AAEzB,MAAMC,uBAAAA,GAA0B,IAAA;AAC9B,IAAA,MAAML,UAAAA,GAAsBJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AAC9C,IAAA,OAAO,OAAOF,UAAAA,KAAe,QAAA,IAAYA,WAAWM,IAAI,EAAA,KAAO,KAAKN,UAAAA,GAAaO,SAAAA;AACnF,CAAA;AAEA;;;;IAKA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;AACtB,IAAA,MAAMC,WAAAA,GAAuBd,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAACO,GAAAA,CAAAA;AAC/C,IAAA,IAAI,OAAOC,WAAAA,KAAgB,QAAA,IAAYA,WAAAA,KAAgB,EAAA,EAAI;QACzD,OAAOH,SAAAA;AACT,IAAA;IAEA,IAAI;QACF,OAAO,IAAII,IAAID,WAAAA,CAAAA,CAAaE,QAAQ,CAACC,OAAO,CAAC,QAAQ,EAAA,CAAA,IAAO,GAAA;AAC9D,IAAA,CAAA,CAAE,OAAM;QACN,OAAON,SAAAA;AACT,IAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAMO,eAAAA,GAAkB,IAAA;AACtB,IAAA,MAAMC,aAAaP,cAAAA,CAAe,oBAAA,CAAA;AAClC,IAAA,MAAMQ,UACJD,UAAAA,IAAcA,UAAAA,KAAe,MAAM,CAAA,EAAGA,UAAAA,CAAAA,EAAaX,kBAAkB,GAAGA,gBAAAA;AAC1E,IAAA,OAAOa,sBAAsBD,OAAAA,EAAStB,gBAAAA,CAAAA;AACxC,CAAA;AAEA;AACA;AACA,MAAMwB,iBAAAA,GAAoB,CAACC,UAAAA,EAAoBC,WAAAA,GAAAA;AAC7C,IAAA,IAAIA,gBAAgBD,UAAAA,EAAY;QAC9B,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OACEC,WAAAA,CAAYC,UAAU,CAACF,UAAAA,CAAAA,KACtBA,UAAAA,CAAWG,QAAQ,CAAC,GAAA,CAAA,IAAQF,YAAYG,MAAM,CAACJ,UAAAA,CAAWK,MAAM,MAAM,GAAE,CAAA;AAE7E,CAAA;AAEA;;;;;;UAOaC,mBAAAA,GAAsB,IAAA;IACjC,OAAOR,qBAAAA,CACLZ,uBAAAA,EAAAA,IAA6BG,cAAAA,CAAe,mBAAA,CAAA,EAC5Cd,gBAAAA,CAAAA;AAEJ;AAEA,MAAMgC,2BAA2B,IAAIC,GAAAA,EAAAA;AAErC;;;;;;;UAQaC,oBAAAA,GAAuB,IAAA;AAClC,IAAA,MAAMZ,OAAAA,GAAUF,eAAAA,EAAAA;AAChB,IAAA,MAAMd,UAAAA,GAAaK,uBAAAA,EAAAA;AAEnB,IAAA,IAAI,CAACL,UAAAA,EAAY;QACf,OAAOgB,OAAAA;AACT,IAAA;IAEA,MAAMa,cAAAA,GAAiBZ,sBAAsBjB,UAAAA,EAAYN,gBAAAA,CAAAA;IACzD,IAAIwB,iBAAAA,CAAkBW,gBAAgBb,OAAAA,CAAAA,EAAU;QAC9C,OAAOa,cAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACH,wBAAAA,CAAyBI,GAAG,CAACD,cAAAA,CAAAA,EAAiB;AACjDH,QAAAA,wBAAAA,CAAyBK,GAAG,CAACF,cAAAA,CAAAA;QAC7BjC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CACb,CAAC,wBAAwB,EAAE+B,eAAe,mCAAmC,EAAEb,QAAQ,wDAAwD,EAAEA,QAAQ,uBAAuB,EAAEA,QAAQ,mDAAmD,EAAEa,cAAAA,CAAe,EAAE,CAAC,CAAA;AAErQ,IAAA;IAEA,OAAOb,OAAAA;AACT;MAEagB,qBAAAA,GAAwB,IAAA;IACnC,MAAMhC,UAAAA,GACJJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BN,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,OAAO+B,wBAAwBjC,UAAAA,EAAYN,gBAAAA,CAAAA;AAC7C;AAEO,MAAMwC,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmB5C,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMuC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,MAAAA,GAASb,qBAAAA,EAAAA;AACf,IAAA,MAAMc,IAAAA,GAAOlB,oBAAAA,EAAAA;AAEb,IAAA,MAAMmB,WACJnD,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAI8C,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBhC,SAAAA,EAAW;AACtCyC,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLQ,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQF,QAAAA;QACRG,SAAAA,EAAW,IAAA;AACXN,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAK,MAAAA,EAAQ7C;AACV,KAAA;AACF;AAEA,MAAM8C,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClB5D,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,8CAAA,EACAiC,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMsB,aAAaD,MAAAA,CACjB5D,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,6CAAA,EACAgC,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEqB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACApB,aAAAA,GAAAA;AAEA,IAAA,MAAMqB,OAAOtB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIe,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAU5E,OAAO6E,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,MAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;AAEO,MAAME,+BAAAA,GAAkC,CAACC,GAAAA,GAC9CC,oBAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;KACjC;AAEF;;;;;;;;;AASC,IACM,MAAMC,qBAAAA,GAAwB,OACnCC,QACAC,SAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,SAAAA,EAAW;QACd/F,MAAAA,CAAOC,GAAG,CAACgG,KAAK,CAAC,sEAAA,CAAA;QACjB,OAAOD,cAAAA;AACT,IAAA;IAEA,MAAME,OAAAA,GAAU,MAAMlG,MAAAA,CAAOmG,EAAE,CAACC,KAAK,CAACxG,oBAAAA,CAAAA,CAAsByG,OAAO,CAAC;QAClEC,KAAAA,EAAO;AAAEP,YAAAA;AAAU;AACrB,KAAA,CAAA;AAEA,IAAA,IAAIG,OAAAA,EAASJ,MAAAA,KAAWA,MAAAA,IAAUI,OAAAA,EAASK,WAAW5G,YAAAA,EAAc;QAClEK,MAAAA,CAAOC,GAAG,CAACgG,KAAK,CACd,mGAAA,CAAA;QAEF,OAAOD,cAAAA;AACT,IAAA;AAEA,IAAA,OAAO,OAAOE,OAAAA,CAAQd,QAAQ,KAAK,QAAA,GAAWc,OAAAA,CAAQd,QAAQ,GAAGY,cAAAA;AACnE;;;;"}

package/dist/server/src/ai/services/ai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../../../../../server/src/ai/services/ai.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAS1C,QAAA,MAAM,oBAAoB,GAAI,YAAY;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE;uBAkBvC,OAAO;oCAGM,OAAO;mCAKR,OAAO;;;;;;;;;;;4BAiQjB,MAAM;yBACT,MAAM;gCACC,MAAM;kCACJ,OAAO;0BACf,OAAO;8BACH,MAAM;kCACF,MAAM;8BACV,MAAM;4BACR,MAAM;;0BAVE,MAAM;;CA4CzC,CAAC;AAEF,OAAO,EAAE,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../../../../../server/src/ai/services/ai.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAS1C,QAAA,MAAM,oBAAoB,GAAI,YAAY;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE;uBAkBvC,OAAO;oCAGM,OAAO;mCAKR,OAAO;;;;;;;;;;;4BAgQjB,MAAM;yBACT,MAAM;gCACC,MAAM;kCACJ,OAAO;0BACf,OAAO;8BACH,MAAM;kCACF,MAAM;8BACV,MAAM;4BACR,MAAM;;0BAVE,MAAM;;CA4CzC,CAAC;AAEF,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/server/src/controllers/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/admin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAcnC,OAAO,KAAK,EAEV,kBAAkB,EAClB,cAAc,EAOf,MAAM,iCAAiC,CAAC;AAezC;;GAEG;;sBAQuB,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC;;;;;;;;;;+BAmCvB,OAAO;6BAmBT,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6EnB,OAAO;;;;2BAmCG,OAAO;;;;;;;AA7KtC,wBAuLE"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../server/src/controllers/admin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAcnC,OAAO,KAAK,EAEV,kBAAkB,EAClB,cAAc,EAOf,MAAM,iCAAiC,CAAC;AA0BzC;;GAEG;;sBAQuB,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC;;;;;;;;;;+BAmCvB,OAAO;6BAmBT,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4EnB,OAAO;;;;2BAuBG,OAAO;;;;;;;AAhKtC,wBA0KE"}

package/dist/server/src/domain/permission/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../server/src/domain/permission/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAC1D,UAAU,EACV,kBAAkB,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,GAAG,WAAW,GAAG,WAAW,CAChG,CAAC;AAIF,eAAO,MAAM,gBAAgB,UAS5B,CAAC;AACF,eAAO,MAAM,yBAAyB,sFAO5B,CAAC;AAEX,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,mBACb,CAAC;AAY9C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,mEAOvB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,eAAe,mEAK1B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,WAAW,mEAGvB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GACtB,UAAU,MAAM,EAChB,OAAO,OAAO,EACd,YAAY,UAAU,KACrB,UAEF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,SAAS,MAAM,EACrD,UAAU,SAAS,EACnB,YAAY,UAAU,KACqC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAEzF;;;GAGG;AACH,eAAO,MAAM,MAAM,GAAI,YAAY,uBAAuB,KACwB,UACjF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,4HAa9B,CAAC;AAEF;;;GAGG;AAEH,iBAAS,YAAY,CAAC,CAAC,SAAS,uBAAuB,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;AACrF,iBAAS,YAAY,CAAC,CAAC,SAAS,uBAAuB,EAAE,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC;AAWjF,OAAO,EAAE,YAAY,EAAE,CAAC;;;;yBAzCW,uBAAuB,KACwB,UAAU;qBAV7D,SAAS,SAAS,MAAM,YAC3C,SAAS,cACP,UAAU,KACqC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC;;;;;kCAxE7C,UAAU,KAAK,mBAAmB;4BAyDjE,MAAM,SACT,OAAO,cACF,UAAU,KACrB,UAAU;;;AA6Db,wBAYE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../server/src/domain/permission/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAC1D,UAAU,EACV,kBAAkB,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,GAAG,WAAW,GAAG,WAAW,CAChG,CAAC;AAIF,eAAO,MAAM,gBAAgB,UAS5B,CAAC;AACF,eAAO,MAAM,yBAAyB,sFAO5B,CAAC;AAEX,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,mBACb,CAAC;AAY9C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,mEAOvB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,eAAe,mEAK1B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,WAAW,mEAEvB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GACtB,UAAU,MAAM,EAChB,OAAO,OAAO,EACd,YAAY,UAAU,KACrB,UAEF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,SAAS,MAAM,EACrD,UAAU,SAAS,EACnB,YAAY,UAAU,KACqC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAEzF;;;GAGG;AACH,eAAO,MAAM,MAAM,GAAI,YAAY,uBAAuB,KACwB,UACjF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,4HAa9B,CAAC;AAEF;;;GAGG;AAEH,iBAAS,YAAY,CAAC,CAAC,SAAS,uBAAuB,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;AACrF,iBAAS,YAAY,CAAC,CAAC,SAAS,uBAAuB,EAAE,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC;AAWjF,OAAO,EAAE,YAAY,EAAE,CAAC;;;;yBAzCW,uBAAuB,KACwB,UAAU;qBAV7D,SAAS,SAAS,MAAM,YAC3C,SAAS,cACP,UAAU,KACqC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC;;;;;kCAvE7C,UAAU,KAAK,mBAAmB;4BAwDjE,MAAM,SACT,OAAO,cACF,UAAU,KACrB,UAAU;;;AA6Db,wBAYE"}

package/dist/server/src/services/constants.d.ts

@@ -1,6 +1,7 @@
 declare const constants: {
     CONTENT_TYPE_SECTION: string;
     SUPER_ADMIN_CODE: string;
+    ROLE_TEXT_MAX_LENGTH: number;
     EDITOR_CODE: string;
     AUTHOR_CODE: string;
     READ_ACTION: string;
@@ -8,6 +9,7 @@ declare const constants: {
     UPDATE_ACTION: string;
     DELETE_ACTION: string;
     PUBLISH_ACTION: string;
+    TOKEN_TEXT_MAX_LENGTH: number;
     API_TOKEN_TYPE: {
         READ_ONLY: string;
         FULL_ACCESS: string;

package/dist/server/src/services/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../server/src/services/constants.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDd,CAAC;AAEF,eAAe,SAAS,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../server/src/services/constants.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyDd,CAAC;AAEF,eAAe,SAAS,CAAC"}

package/dist/server/src/services/permission/rename-fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rename-fields.d.ts","sourceRoot":"","sources":["../../../../../server/src/services/permission/rename-fields.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAU,MAAM,eAAe,CAAC;AAIlD,KAAK,sBAAsB,GAAG,UAAU,CACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,gCAAgC,CAAC,CAC9D,CAAC,CAAC,CAAC,CAAC;AAYL;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GAAI,aAE1C;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;CACrB,KAAG,sBA2GH,CAAC"}
+{"version":3,"file":"rename-fields.d.ts","sourceRoot":"","sources":["../../../../../server/src/services/permission/rename-fields.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAU,MAAM,eAAe,CAAC;AAIlD,KAAK,sBAAsB,GAAG,UAAU,CACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,gCAAgC,CAAC,CAC9D,CAAC,CAAC,CAAC,CAAC;AAYL;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GAAI,aAE1C;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;CACrB,KAAG,sBA0GH,CAAC"}

package/dist/server/src/services/permission/sections-builder/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../../../../server/src/services/permission/sections-builder/handlers.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAIrD,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,GAAG,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,MAAM,EAAE,CAAC;AAE1C;;;;;;GAMG;AACH,QAAA,MAAM,QAAQ,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,SAWrF,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,OAAO,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,SAUpF,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,gBAAgB,GAAI,sBAGvB;IACD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,mBAAmB,CAAC;CAC9B,SAsBA,CAAC;AAEF;;GAEG;AACH,QAAA,MAAM,kBAAkB,GACrB,MAAM,MAAM,MACZ,0CAA0C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,SA2B1F,CAAC;AA2BJ;;GAEG;AACH,QAAA,MAAM,cAAc,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,SAkB5F,CAAC;AAEF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../../../../server/src/services/permission/sections-builder/handlers.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAIrD,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,GAAG,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,MAAM,EAAE,CAAC;AAE1C;;;;;;GAMG;AACH,QAAA,MAAM,QAAQ,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,SAWrF,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,OAAO,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,SAUpF,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,gBAAgB,GAAI,sBAGvB;IACD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,mBAAmB,CAAC;CAC9B,SAqBA,CAAC;AAEF;;GAEG;AACH,QAAA,MAAM,kBAAkB,GACrB,MAAM,MAAM,MACZ,0CAA0C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,SA2B1F,CAAC;AA2BJ;;GAEG;AACH,QAAA,MAAM,cAAc,GAAI,qBAAqB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,SAkB5F,CAAC;AAEF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC"}

package/dist/server/src/services/role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../../../server/src/services/role.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiB,KAAK,IAAI,UAAU,EAAU,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAwBzF,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;;;;;;;;;;;;;;;;mBAHnD,CAAC,SAAS,MAAM,QAAQ,CAAC,KAAG,IAAI,CAAC,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;yBAyBhD,OAAO,CAAC,SAAS,CAAC,KAAG,OAAO,CAAC,SAAS,CAAC;sCA0BhC,OAAO,KAAG,OAAO,CAAC,SAAS,CAAC;oDAWxD,OAAO,KACjB,OAAO,CAAC,uBAAuB,CAAC;6CAeE,OAAO,KAAG,OAAO,CAAC,SAAS,EAAE,CAAC;oCAOtB,GAAG,KAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;qBAiBvD,GAAG,cAAc,OAAO,CAAC,SAAS,CAAC,KAAG,OAAO,CAAC,SAAS,CAAC;sBA4BjD,OAAO,KAAG,OAAO,CAAC,OAAO,CAAC;qBAS3B,GAAG,KAAG,OAAO,CAAC,MAAM,CAAC;wBA2BlB,IAAI,CAAC,EAAE,EAAE,KAAG,OAAO,CAAC,SAAS,EAAE,CAAC;4BAoBlC,IAAI,CAAC,EAAE,KAAG,OAAO,CAAC,MAAM,CAAC;yBAMpC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;;;;6BAsKlB,IAAI,CAAC,EAAE,eAAe,GAAG;8BAiE9B,SAAS,KAAG,OAAO;gCAhI1C,IAAI,CAAC,EAAE,gBACF,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC,CAAC;;oCArJxB,IAAI,CAAC,EAAE,EAAE;;;;;AA8R5D,wBAuBE"}
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../../../server/src/services/role.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiB,KAAK,IAAI,UAAU,EAAU,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAwBzF,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;;;;;;;;;;;;;;;;mBAHnD,CAAC,SAAS,MAAM,QAAQ,CAAC,KAAG,IAAI,CAAC,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;yBAyBhD,OAAO,CAAC,SAAS,CAAC,KAAG,OAAO,CAAC,SAAS,CAAC;sCAgChC,OAAO,KAAG,OAAO,CAAC,SAAS,CAAC;oDAWxD,OAAO,KACjB,OAAO,CAAC,uBAAuB,CAAC;6CAeE,OAAO,KAAG,OAAO,CAAC,SAAS,EAAE,CAAC;oCAOtB,GAAG,KAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;qBAiBvD,GAAG,cAAc,OAAO,CAAC,SAAS,CAAC,KAAG,OAAO,CAAC,SAAS,CAAC;sBA4BjD,OAAO,KAAG,OAAO,CAAC,OAAO,CAAC;qBAS3B,GAAG,KAAG,OAAO,CAAC,MAAM,CAAC;wBA2BlB,IAAI,CAAC,EAAE,EAAE,KAAG,OAAO,CAAC,SAAS,EAAE,CAAC;4BAoBlC,IAAI,CAAC,EAAE,KAAG,OAAO,CAAC,MAAM,CAAC;yBAMpC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;;;;6BAwKlB,IAAI,CAAC,EAAE,eAAe,GAAG;8BAiE9B,SAAS,KAAG,OAAO;gCAlI1C,IAAI,CAAC,EAAE,gBACF,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC,CAAC;;oCArJxB,IAAI,CAAC,EAAE,EAAE;;;;;AAgS5D,wBAuBE"}

package/dist/server/src/validation/role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../../../server/src/validation/role.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAqB,MAAM,eAAe,CAAC;AA6DvD,eAAO,MAAM,uBAAuB;;;IAAsC,CAAC;AAC3E,eAAO,MAAM,uBAAuB;;;IAAsC,CAAC;AAC3E,eAAO,MAAM,wBAAwB;;IAAuC,CAAC;AAC7E,eAAO,MAAM,uBAAuB,wDAAsC,CAAC;;;;;;;;;;;;;;;AAE3E,wBAKE"}
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../../../server/src/validation/role.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAqB,MAAM,eAAe,CAAC;AAgEvD,eAAO,MAAM,uBAAuB;;;IAAsC,CAAC;AAC3E,eAAO,MAAM,uBAAuB;;;IAAsC,CAAC;AAC3E,eAAO,MAAM,wBAAwB;;IAAuC,CAAC;AAC7E,eAAO,MAAM,uBAAuB,wDAAsC,CAAC;;;;;;;;;;;;;;;AAE3E,wBAKE"}

package/dist/shared/contracts/transfer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transfer.d.ts","sourceRoot":"","sources":["../../../shared/contracts/transfer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC;IACtC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,uBAAuB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,qBAAqB,EAAE,aAAa,CAAC;IAC/E,WAAW,EAAE,KAAK,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AAEtE,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,aAAa,EACb,MAAM,GAAG,aAAa,GAAG,YAAY,GAAG,aAAa,GAAG,UAAU,CACnE,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3B;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,iBAAiB,CAAC;KAC5D;CACF;AACD;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,iBAAiB,CAAC;KAC5D;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,MAAM;QACrB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;KACrB;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,sBAAsB,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,UAAiB,OAAO;QACtB,IAAI,EAAE,kBAAkB,CAAC;QACzB,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,aAAa,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,CAAC;KAC7D;CACF;AAED,MAAM,WAAW,kBACf,SAAQ,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,aAAa,CAAC,EACtD,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC;CAAG;AAEhE;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,UAAiB,OAAO;QACtB,IAAI,EAAE,kBAAkB,CAAC;QACzB,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,MAAM;QACrB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;KACrB;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,sBAAsB,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,MAAM;QACrB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;KACrB;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,sBAAsB,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,eAAe,CAAC;IACvC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,MAAM;QACrB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;KACrB;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,aAAa,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF"}
+{"version":3,"file":"transfer.d.ts","sourceRoot":"","sources":["../../../shared/contracts/transfer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC;IACtC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,uBAAuB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,qBAAqB,EAAE,aAAa,CAAC;IAC/E,WAAW,EAAE,KAAK,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AAEtE,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,aAAa,EACb,MAAM,GAAG,aAAa,GAAG,YAAY,GAAG,aAAa,GAAG,UAAU,CACnE,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3B;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,iBAAiB,CAAC;KAC5D;CACF;AACD;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,iBAAiB,CAAC;KAC5D;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,MAAM;QACrB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;KACrB;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,sBAAsB,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,UAAiB,OAAO;QACtB,IAAI,EAAE,kBAAkB,CAAC;QACzB,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,aAAa,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,CAAC;KAC7D;CACF;AAED,MAAM,WAAW,kBACf,SACE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,aAAa,CAAC,EAChD,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC;CAAG;AAEhE;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,UAAiB,OAAO;QACtB,IAAI,EAAE,kBAAkB,CAAC;QACzB,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,MAAM;QACrB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;KACrB;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,sBAAsB,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,MAAM;QACrB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;KACrB;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,sBAAsB,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,WAAW,eAAe,CAAC;IACvC,UAAiB,OAAO;QACtB,IAAI,EAAE,EAAE,CAAC;QACT,KAAK,EAAE,EAAE,CAAC;KACX;IAED,UAAiB,MAAM;QACrB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;KACrB;IAED,UAAiB,QAAQ;QACvB,IAAI,EAAE,aAAa,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjC;CACF"}

package/dist/shared/utils/auth-cookie-path.d.ts

@@ -1,17 +1,20 @@
 /**
- * Path attribute of the admin auth (access) token cookie, configurable
- * through `admin.auth.cookie.path` so multiple Strapi instances on the same
- * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).
+ * Validates the Path attribute of the admin auth cookies. The path is
+ * configurable through `admin.auth.cookie.path` so multiple Strapi instances
+ * on the same parent domain can keep separate cookies (e.g. `/strapi-de/admin`).
  *
  * Browser-safe single source for both sides of the handoff: the admin panel
- * cannot read server config, so the build transports the config value into
- * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable
- * (see create-build-context.ts in @strapi/strapi); the server resolves the
- * same config at runtime. Changing the path requires an admin rebuild, like
- * any other admin config change.
+ * cannot read server config, so the build transports the access cookie path
+ * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH`
+ * variable (see create-build-context.ts in @strapi/strapi); the server
+ * resolves the same config at runtime. Changing the path requires an admin
+ * rebuild, like any other admin config change.
  *
- * Defaults to `/admin` to match the refresh-cookie path used by
- * `getRefreshCookieOptions`.
+ * The callers pick the value to validate (see session-auth.ts). When
+ * `admin.auth.cookie.path` is unset, the access cookie follows the path the
+ * panel is served from (`admin.url`) and the refresh cookie follows the admin
+ * API (`/admin`), each behind any `server.url` subpath.
+ * `DEFAULT_AUTH_COOKIE_PATH` is only the fallback for a missing or invalid value.
  */
 export declare const DEFAULT_AUTH_COOKIE_PATH = "/admin";
 export declare const resolveAuthCookiePath: (configuredPath?: string, warn?: (message: string) => void) => string;