@strapi/core 5.0.0-beta.8 → 5.0.0-rc.0

package/dist/middlewares/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sources":["../../src/middlewares/cors.ts"],"sourcesContent":["import koaCors from '@koa/cors';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = {\n  enabled?: boolean;\n  origin: string | string[] | ((ctx: any) => string | string[]);\n  expose?: string | string[];\n  maxAge?: number;\n  credentials?: boolean;\n  methods?: string | string[];\n  headers?: string | string[];\n  keepHeadersOnError?: boolean;\n};\n\nconst defaults: Config = {\n  origin: '*',\n  maxAge: 31536000,\n  credentials: true,\n  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'],\n  headers: ['Content-Type', 'Authorization', 'Origin', 'Accept'],\n  keepHeadersOnError: false,\n};\n\nexport const cors: Core.MiddlewareFactory<Config> = (config) => {\n  const { origin, expose, maxAge, credentials, methods, headers, keepHeadersOnError } = {\n    ...defaults,\n    ...config,\n  };\n\n  if (config.enabled !== undefined) {\n    strapi.log.warn(\n      'The strapi::cors middleware no longer supports the `enabled` option. Using it' +\n        ' to conditionally enable CORS might cause an insecure default. To disable strapi::cors, remove it from' +\n        ' the exported array in config/middleware.js'\n    );\n  }\n\n  return koaCors({\n    async origin(ctx) {\n      let originList: string | string[];\n\n      if (typeof origin === 'function') {\n        originList = await origin(ctx);\n      } else {\n        originList = origin;\n      }\n\n      const whitelist = Array.isArray(originList) ? originList : originList.split(/\\s*,\\s*/);\n\n      const requestOrigin = ctx.headers.origin ?? '';\n      if (whitelist.includes('*')) {\n        return credentials ? requestOrigin : '*';\n      }\n\n      if (!whitelist.includes(requestOrigin)) {\n        return ctx.throw(`${requestOrigin} is not a valid origin`);\n      }\n      return requestOrigin;\n    },\n    exposeHeaders: expose,\n    maxAge,\n    credentials,\n    allowMethods: methods,\n    allowHeaders: headers,\n    keepHeadersOnError,\n  });\n};\n"],"names":["koaCors"],"mappings":";;;;;AAeA,MAAM,WAAmB;AAAA,EACvB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,SAAS,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,QAAQ,SAAS;AAAA,EACpE,SAAS,CAAC,gBAAgB,iBAAiB,UAAU,QAAQ;AAAA,EAC7D,oBAAoB;AACtB;AAEa,MAAA,OAAuC,CAAC,WAAW;AACxD,QAAA,EAAE,QAAQ,QAAQ,QAAQ,aAAa,SAAS,SAAS,uBAAuB;AAAA,IACpF,GAAG;AAAA,IACH,GAAG;AAAA,EAAA;AAGD,MAAA,OAAO,YAAY,QAAW;AAChC,WAAO,IAAI;AAAA,MACT;AAAA,IAAA;AAAA,EAIJ;AAEA,SAAOA,yBAAQ;AAAA,IACb,MAAM,OAAO,KAAK;AACZ,UAAA;AAEA,UAAA,OAAO,WAAW,YAAY;AACnB,qBAAA,MAAM,OAAO,GAAG;AAAA,MAAA,OACxB;AACQ,qBAAA;AAAA,MACf;AAEM,YAAA,YAAY,MAAM,QAAQ,UAAU,IAAI,aAAa,WAAW,MAAM,SAAS;AAE/E,YAAA,gBAAgB,IAAI,QAAQ,UAAU;AACxC,UAAA,UAAU,SAAS,GAAG,GAAG;AAC3B,eAAO,cAAc,gBAAgB;AAAA,MACvC;AAEA,UAAI,CAAC,UAAU,SAAS,aAAa,GAAG;AACtC,eAAO,IAAI,MAAM,GAAG,aAAa,wBAAwB;AAAA,MAC3D;AACO,aAAA;AAAA,IACT;AAAA,IACA,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,cAAc;AAAA,IACd;AAAA,EAAA,CACD;AACH;;"}
+{"version":3,"file":"cors.js","sources":["../../src/middlewares/cors.ts"],"sourcesContent":["import koaCors from '@koa/cors';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = {\n  enabled?: boolean;\n  origin: string | string[] | ((ctx: any) => string | string[]);\n  expose?: string | string[];\n  maxAge?: number;\n  credentials?: boolean;\n  methods?: string | string[];\n  headers?: string | string[];\n  keepHeadersOnError?: boolean;\n};\n\nconst defaults: Config = {\n  origin: '*',\n  maxAge: 31536000,\n  credentials: true,\n  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'],\n  headers: ['Content-Type', 'Authorization', 'Origin', 'Accept'],\n  keepHeadersOnError: false,\n};\n\nexport const cors: Core.MiddlewareFactory<Config> = (config) => {\n  const { origin, expose, maxAge, credentials, methods, headers, keepHeadersOnError } = {\n    ...defaults,\n    ...config,\n  };\n\n  if (config.enabled !== undefined) {\n    strapi.log.warn(\n      'The strapi::cors middleware no longer supports the `enabled` option. Using it' +\n        ' to conditionally enable CORS might cause an insecure default. To disable strapi::cors, remove it from' +\n        ' the exported array in config/middleware.js'\n    );\n  }\n\n  return koaCors({\n    async origin(ctx) {\n      if (!ctx.get('Origin')) {\n        return '*';\n      }\n\n      let originList: string | string[];\n\n      if (typeof origin === 'function') {\n        originList = await origin(ctx);\n      } else {\n        originList = origin;\n      }\n\n      if (Array.isArray(originList)) {\n        return originList.includes(ctx.get('Origin')) ? ctx.get('Origin') : '';\n      }\n\n      return originList;\n    },\n    exposeHeaders: expose,\n    maxAge,\n    credentials,\n    allowMethods: methods,\n    allowHeaders: headers,\n    keepHeadersOnError,\n  });\n};\n"],"names":["koaCors"],"mappings":";;;;;AAeA,MAAM,WAAmB;AAAA,EACvB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,SAAS,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,QAAQ,SAAS;AAAA,EACpE,SAAS,CAAC,gBAAgB,iBAAiB,UAAU,QAAQ;AAAA,EAC7D,oBAAoB;AACtB;AAEa,MAAA,OAAuC,CAAC,WAAW;AACxD,QAAA,EAAE,QAAQ,QAAQ,QAAQ,aAAa,SAAS,SAAS,uBAAuB;AAAA,IACpF,GAAG;AAAA,IACH,GAAG;AAAA,EAAA;AAGD,MAAA,OAAO,YAAY,QAAW;AAChC,WAAO,IAAI;AAAA,MACT;AAAA,IAAA;AAAA,EAIJ;AAEA,SAAOA,yBAAQ;AAAA,IACb,MAAM,OAAO,KAAK;AAChB,UAAI,CAAC,IAAI,IAAI,QAAQ,GAAG;AACf,eAAA;AAAA,MACT;AAEI,UAAA;AAEA,UAAA,OAAO,WAAW,YAAY;AACnB,qBAAA,MAAM,OAAO,GAAG;AAAA,MAAA,OACxB;AACQ,qBAAA;AAAA,MACf;AAEI,UAAA,MAAM,QAAQ,UAAU,GAAG;AACtB,eAAA,WAAW,SAAS,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,QAAQ,IAAI;AAAA,MACtE;AAEO,aAAA;AAAA,IACT;AAAA,IACA,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,cAAc;AAAA,IACd;AAAA,EAAA,CACD;AACH;;"}

package/dist/middlewares/cors.mjs

@@ -19,21 +19,19 @@ const cors = (config) => {
   }
   return koaCors({
     async origin(ctx) {
+      if (!ctx.get("Origin")) {
+        return "*";
+      }
       let originList;
       if (typeof origin === "function") {
         originList = await origin(ctx);
       } else {
         originList = origin;
       }
-      const whitelist = Array.isArray(originList) ? originList : originList.split(/\s*,\s*/);
-      const requestOrigin = ctx.headers.origin ?? "";
-      if (whitelist.includes("*")) {
-        return credentials ? requestOrigin : "*";
-      }
-      if (!whitelist.includes(requestOrigin)) {
-        return ctx.throw(`${requestOrigin} is not a valid origin`);
+      if (Array.isArray(originList)) {
+        return originList.includes(ctx.get("Origin")) ? ctx.get("Origin") : "";
       }
-      return requestOrigin;
+      return originList;
     },
     exposeHeaders: expose,
     maxAge,

package/dist/middlewares/cors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cors.mjs","sources":["../../src/middlewares/cors.ts"],"sourcesContent":["import koaCors from '@koa/cors';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = {\n  enabled?: boolean;\n  origin: string | string[] | ((ctx: any) => string | string[]);\n  expose?: string | string[];\n  maxAge?: number;\n  credentials?: boolean;\n  methods?: string | string[];\n  headers?: string | string[];\n  keepHeadersOnError?: boolean;\n};\n\nconst defaults: Config = {\n  origin: '*',\n  maxAge: 31536000,\n  credentials: true,\n  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'],\n  headers: ['Content-Type', 'Authorization', 'Origin', 'Accept'],\n  keepHeadersOnError: false,\n};\n\nexport const cors: Core.MiddlewareFactory<Config> = (config) => {\n  const { origin, expose, maxAge, credentials, methods, headers, keepHeadersOnError } = {\n    ...defaults,\n    ...config,\n  };\n\n  if (config.enabled !== undefined) {\n    strapi.log.warn(\n      'The strapi::cors middleware no longer supports the `enabled` option. Using it' +\n        ' to conditionally enable CORS might cause an insecure default. To disable strapi::cors, remove it from' +\n        ' the exported array in config/middleware.js'\n    );\n  }\n\n  return koaCors({\n    async origin(ctx) {\n      let originList: string | string[];\n\n      if (typeof origin === 'function') {\n        originList = await origin(ctx);\n      } else {\n        originList = origin;\n      }\n\n      const whitelist = Array.isArray(originList) ? originList : originList.split(/\\s*,\\s*/);\n\n      const requestOrigin = ctx.headers.origin ?? '';\n      if (whitelist.includes('*')) {\n        return credentials ? requestOrigin : '*';\n      }\n\n      if (!whitelist.includes(requestOrigin)) {\n        return ctx.throw(`${requestOrigin} is not a valid origin`);\n      }\n      return requestOrigin;\n    },\n    exposeHeaders: expose,\n    maxAge,\n    credentials,\n    allowMethods: methods,\n    allowHeaders: headers,\n    keepHeadersOnError,\n  });\n};\n"],"names":[],"mappings":";AAeA,MAAM,WAAmB;AAAA,EACvB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,SAAS,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,QAAQ,SAAS;AAAA,EACpE,SAAS,CAAC,gBAAgB,iBAAiB,UAAU,QAAQ;AAAA,EAC7D,oBAAoB;AACtB;AAEa,MAAA,OAAuC,CAAC,WAAW;AACxD,QAAA,EAAE,QAAQ,QAAQ,QAAQ,aAAa,SAAS,SAAS,uBAAuB;AAAA,IACpF,GAAG;AAAA,IACH,GAAG;AAAA,EAAA;AAGD,MAAA,OAAO,YAAY,QAAW;AAChC,WAAO,IAAI;AAAA,MACT;AAAA,IAAA;AAAA,EAIJ;AAEA,SAAO,QAAQ;AAAA,IACb,MAAM,OAAO,KAAK;AACZ,UAAA;AAEA,UAAA,OAAO,WAAW,YAAY;AACnB,qBAAA,MAAM,OAAO,GAAG;AAAA,MAAA,OACxB;AACQ,qBAAA;AAAA,MACf;AAEM,YAAA,YAAY,MAAM,QAAQ,UAAU,IAAI,aAAa,WAAW,MAAM,SAAS;AAE/E,YAAA,gBAAgB,IAAI,QAAQ,UAAU;AACxC,UAAA,UAAU,SAAS,GAAG,GAAG;AAC3B,eAAO,cAAc,gBAAgB;AAAA,MACvC;AAEA,UAAI,CAAC,UAAU,SAAS,aAAa,GAAG;AACtC,eAAO,IAAI,MAAM,GAAG,aAAa,wBAAwB;AAAA,MAC3D;AACO,aAAA;AAAA,IACT;AAAA,IACA,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,cAAc;AAAA,IACd;AAAA,EAAA,CACD;AACH;"}
+{"version":3,"file":"cors.mjs","sources":["../../src/middlewares/cors.ts"],"sourcesContent":["import koaCors from '@koa/cors';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = {\n  enabled?: boolean;\n  origin: string | string[] | ((ctx: any) => string | string[]);\n  expose?: string | string[];\n  maxAge?: number;\n  credentials?: boolean;\n  methods?: string | string[];\n  headers?: string | string[];\n  keepHeadersOnError?: boolean;\n};\n\nconst defaults: Config = {\n  origin: '*',\n  maxAge: 31536000,\n  credentials: true,\n  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'],\n  headers: ['Content-Type', 'Authorization', 'Origin', 'Accept'],\n  keepHeadersOnError: false,\n};\n\nexport const cors: Core.MiddlewareFactory<Config> = (config) => {\n  const { origin, expose, maxAge, credentials, methods, headers, keepHeadersOnError } = {\n    ...defaults,\n    ...config,\n  };\n\n  if (config.enabled !== undefined) {\n    strapi.log.warn(\n      'The strapi::cors middleware no longer supports the `enabled` option. Using it' +\n        ' to conditionally enable CORS might cause an insecure default. To disable strapi::cors, remove it from' +\n        ' the exported array in config/middleware.js'\n    );\n  }\n\n  return koaCors({\n    async origin(ctx) {\n      if (!ctx.get('Origin')) {\n        return '*';\n      }\n\n      let originList: string | string[];\n\n      if (typeof origin === 'function') {\n        originList = await origin(ctx);\n      } else {\n        originList = origin;\n      }\n\n      if (Array.isArray(originList)) {\n        return originList.includes(ctx.get('Origin')) ? ctx.get('Origin') : '';\n      }\n\n      return originList;\n    },\n    exposeHeaders: expose,\n    maxAge,\n    credentials,\n    allowMethods: methods,\n    allowHeaders: headers,\n    keepHeadersOnError,\n  });\n};\n"],"names":[],"mappings":";AAeA,MAAM,WAAmB;AAAA,EACvB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,SAAS,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,QAAQ,SAAS;AAAA,EACpE,SAAS,CAAC,gBAAgB,iBAAiB,UAAU,QAAQ;AAAA,EAC7D,oBAAoB;AACtB;AAEa,MAAA,OAAuC,CAAC,WAAW;AACxD,QAAA,EAAE,QAAQ,QAAQ,QAAQ,aAAa,SAAS,SAAS,uBAAuB;AAAA,IACpF,GAAG;AAAA,IACH,GAAG;AAAA,EAAA;AAGD,MAAA,OAAO,YAAY,QAAW;AAChC,WAAO,IAAI;AAAA,MACT;AAAA,IAAA;AAAA,EAIJ;AAEA,SAAO,QAAQ;AAAA,IACb,MAAM,OAAO,KAAK;AAChB,UAAI,CAAC,IAAI,IAAI,QAAQ,GAAG;AACf,eAAA;AAAA,MACT;AAEI,UAAA;AAEA,UAAA,OAAO,WAAW,YAAY;AACnB,qBAAA,MAAM,OAAO,GAAG;AAAA,MAAA,OACxB;AACQ,qBAAA;AAAA,MACf;AAEI,UAAA,MAAM,QAAQ,UAAU,GAAG;AACtB,eAAA,WAAW,SAAS,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,QAAQ,IAAI;AAAA,MACtE;AAEO,aAAA;AAAA,IACT;AAAA,IACA,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,cAAc;AAAA,IACd;AAAA,EAAA,CACD;AACH;"}

package/dist/middlewares/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/middlewares/security.ts"],"names":[],"mappings":"AACA,OAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AA0B3D,eAAO,MAAM,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAkEjD,CAAC"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/middlewares/security.ts"],"names":[],"mappings":"AACA,OAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAkC3D,eAAO,MAAM,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAkEjD,CAAC"}

package/dist/middlewares/security.js

@@ -27,6 +27,13 @@ const defaults = {
     action: "sameorigin"
   }
 };
+const mergeConfig = (existingConfig, newConfig) => {
+  return _.mergeWith(
+    (obj, src) => Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : void 0,
+    existingConfig,
+    newConfig
+  );
+};
 const security = (config, { strapi }) => (ctx, next) => {
   let helmetConfig = _.defaultsDeep(defaults, config);
   const specialPaths = ["/documentation"];
@@ -47,7 +54,7 @@ const security = (config, { strapi }) => (ctx, next) => {
     directives["frame-src"].push("sandbox.embed.apollographql.com");
   }
   if (ctx.method === "GET" && specialPaths.some((str) => ctx.path.startsWith(str))) {
-    helmetConfig = _.merge(helmetConfig, {
+    helmetConfig = mergeConfig(helmetConfig, {
       crossOriginEmbedderPolicy: false,
       // TODO: only use this for graphql playground
       contentSecurityPolicy: {
@@ -55,8 +62,8 @@ const security = (config, { strapi }) => (ctx, next) => {
       }
     });
   }
-  if (process.env.NODE_ENV === "development" && ctx.method === "GET" && ["/admin"].some((str) => ctx.path.startsWith(str))) {
-    helmetConfig = _.merge(helmetConfig, {
+  if (["development", "test"].includes(process.env.NODE_ENV ?? "") && ctx.method === "GET" && ["/admin"].some((str) => ctx.path.startsWith(str))) {
+    helmetConfig = mergeConfig(helmetConfig, {
       contentSecurityPolicy: {
         directives: {
           "script-src": ["'self'", "'unsafe-inline'"],

package/dist/middlewares/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sources":["../../src/middlewares/security.ts"],"sourcesContent":["import { defaultsDeep, merge } from 'lodash/fp';\nimport helmet, { KoaHelmet } from 'koa-helmet';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = NonNullable<Parameters<KoaHelmet>[0]>;\n\nconst defaults: Config = {\n  crossOriginEmbedderPolicy: false,\n  crossOriginOpenerPolicy: false,\n  crossOriginResourcePolicy: false,\n  originAgentCluster: false,\n  contentSecurityPolicy: {\n    useDefaults: true,\n    directives: {\n      'connect-src': [\"'self'\", 'https:'],\n      'img-src': [\"'self'\", 'data:', 'blob:', 'https://market-assets.strapi.io'],\n      'media-src': [\"'self'\", 'data:', 'blob:'],\n      upgradeInsecureRequests: null,\n    },\n  },\n  xssFilter: false,\n  hsts: {\n    maxAge: 31536000,\n    includeSubDomains: true,\n  },\n  frameguard: {\n    action: 'sameorigin',\n  },\n};\n\nexport const security: Core.MiddlewareFactory<Config> =\n  (config, { strapi }) =>\n  (ctx, next) => {\n    let helmetConfig: Config = defaultsDeep(defaults, config);\n\n    const specialPaths = ['/documentation'];\n\n    const directives: {\n      'script-src': string[];\n      'img-src': string[];\n      'manifest-src': string[];\n      'frame-src': string[];\n    } = {\n      'script-src': [\"'self'\", \"'unsafe-inline'\", 'cdn.jsdelivr.net'],\n      'img-src': [\"'self'\", 'data:', 'cdn.jsdelivr.net', 'strapi.io'],\n      'manifest-src': [],\n      'frame-src': [],\n    };\n\n    // if apollo graphql playground is enabled, add exceptions for it\n    if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {\n      const { config: gqlConfig } = strapi.plugin('graphql');\n      specialPaths.push(gqlConfig('endpoint'));\n\n      directives['script-src'].push(`https: 'unsafe-inline'`);\n      directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);\n      directives['manifest-src'].push(`'self'`);\n      directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');\n      directives['frame-src'].push(`'self'`);\n      directives['frame-src'].push('sandbox.embed.apollographql.com');\n    }\n\n    // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that\n    if (ctx.method === 'GET' && specialPaths.some((str) => ctx.path.startsWith(str))) {\n      helmetConfig = merge(helmetConfig, {\n        crossOriginEmbedderPolicy: false, // TODO: only use this for graphql playground\n        contentSecurityPolicy: {\n          directives,\n        },\n      });\n    }\n\n    /**\n     * These are for vite's watch mode so it can accurately\n     * connect to the HMR websocket & reconnect on failure\n     * or when the server restarts.\n     *\n     * It only applies in development, and only on GET requests\n     * that are part of the admin route.\n     */\n    if (\n      process.env.NODE_ENV === 'development' &&\n      ctx.method === 'GET' &&\n      ['/admin'].some((str) => ctx.path.startsWith(str))\n    ) {\n      helmetConfig = merge(helmetConfig, {\n        contentSecurityPolicy: {\n          directives: {\n            'script-src': [\"'self'\", \"'unsafe-inline'\"],\n            'connect-src': [\"'self'\", 'http:', 'https:', 'ws:'],\n          },\n        },\n      });\n    }\n\n    return helmet(helmetConfig)(ctx, next);\n  };\n"],"names":["defaultsDeep","merge","helmet"],"mappings":";;;;;;AAOA,MAAM,WAAmB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAC3B,oBAAoB;AAAA,EACpB,uBAAuB;AAAA,IACrB,aAAa;AAAA,IACb,YAAY;AAAA,MACV,eAAe,CAAC,UAAU,QAAQ;AAAA,MAClC,WAAW,CAAC,UAAU,SAAS,SAAS,iCAAiC;AAAA,MACzE,aAAa,CAAC,UAAU,SAAS,OAAO;AAAA,MACxC,yBAAyB;AAAA,IAC3B;AAAA,EACF;AAAA,EACA,WAAW;AAAA,EACX,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,mBAAmB;AAAA,EACrB;AAAA,EACA,YAAY;AAAA,IACV,QAAQ;AAAA,EACV;AACF;AAEa,MAAA,WACX,CAAC,QAAQ,EAAE,aACX,CAAC,KAAK,SAAS;AACT,MAAA,eAAuBA,EAAAA,aAAa,UAAU,MAAM;AAElD,QAAA,eAAe,CAAC,gBAAgB;AAEtC,QAAM,aAKF;AAAA,IACF,cAAc,CAAC,UAAU,mBAAmB,kBAAkB;AAAA,IAC9D,WAAW,CAAC,UAAU,SAAS,oBAAoB,WAAW;AAAA,IAC9D,gBAAgB,CAAC;AAAA,IACjB,aAAa,CAAC;AAAA,EAAA;AAIZ,MAAA,OAAO,OAAO,SAAS,GAAG,QAAQ,OAAO,EAAE,WAAW,aAAa;AACrE,UAAM,EAAE,QAAQ,UAAA,IAAc,OAAO,OAAO,SAAS;AACxC,iBAAA,KAAK,UAAU,UAAU,CAAC;AAE5B,eAAA,YAAY,EAAE,KAAK,wBAAwB;AAC3C,eAAA,SAAS,EAAE,KAAK,oDAAoD;AACpE,eAAA,cAAc,EAAE,KAAK,QAAQ;AAC7B,eAAA,cAAc,EAAE,KAAK,kDAAkD;AACvE,eAAA,WAAW,EAAE,KAAK,QAAQ;AAC1B,eAAA,WAAW,EAAE,KAAK,iCAAiC;AAAA,EAChE;AAGA,MAAI,IAAI,WAAW,SAAS,aAAa,KAAK,CAAC,QAAQ,IAAI,KAAK,WAAW,GAAG,CAAC,GAAG;AAChF,mBAAeC,QAAM,cAAc;AAAA,MACjC,2BAA2B;AAAA;AAAA,MAC3B,uBAAuB;AAAA,QACrB;AAAA,MACF;AAAA,IAAA,CACD;AAAA,EACH;AAUA,MACE,QAAQ,IAAI,aAAa,iBACzB,IAAI,WAAW,SACf,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,WAAW,GAAG,CAAC,GACjD;AACA,mBAAeA,QAAM,cAAc;AAAA,MACjC,uBAAuB;AAAA,QACrB,YAAY;AAAA,UACV,cAAc,CAAC,UAAU,iBAAiB;AAAA,UAC1C,eAAe,CAAC,UAAU,SAAS,UAAU,KAAK;AAAA,QACpD;AAAA,MACF;AAAA,IAAA,CACD;AAAA,EACH;AAEA,SAAOC,gBAAO,QAAA,YAAY,EAAE,KAAK,IAAI;AACvC;;"}
+{"version":3,"file":"security.js","sources":["../../src/middlewares/security.ts"],"sourcesContent":["import { defaultsDeep, mergeWith } from 'lodash/fp';\nimport helmet, { KoaHelmet } from 'koa-helmet';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = NonNullable<Parameters<KoaHelmet>[0]>;\n\nconst defaults: Config = {\n  crossOriginEmbedderPolicy: false,\n  crossOriginOpenerPolicy: false,\n  crossOriginResourcePolicy: false,\n  originAgentCluster: false,\n  contentSecurityPolicy: {\n    useDefaults: true,\n    directives: {\n      'connect-src': [\"'self'\", 'https:'],\n      'img-src': [\"'self'\", 'data:', 'blob:', 'https://market-assets.strapi.io'],\n      'media-src': [\"'self'\", 'data:', 'blob:'],\n      upgradeInsecureRequests: null,\n    },\n  },\n  xssFilter: false,\n  hsts: {\n    maxAge: 31536000,\n    includeSubDomains: true,\n  },\n  frameguard: {\n    action: 'sameorigin',\n  },\n};\n\nconst mergeConfig = (existingConfig: Config, newConfig: Config) => {\n  return mergeWith(\n    (obj, src) => (Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined),\n    existingConfig,\n    newConfig\n  );\n};\n\nexport const security: Core.MiddlewareFactory<Config> =\n  (config, { strapi }) =>\n  (ctx, next) => {\n    let helmetConfig: Config = defaultsDeep(defaults, config);\n\n    const specialPaths = ['/documentation'];\n\n    const directives: {\n      'script-src': string[];\n      'img-src': string[];\n      'manifest-src': string[];\n      'frame-src': string[];\n    } = {\n      'script-src': [\"'self'\", \"'unsafe-inline'\", 'cdn.jsdelivr.net'],\n      'img-src': [\"'self'\", 'data:', 'cdn.jsdelivr.net', 'strapi.io'],\n      'manifest-src': [],\n      'frame-src': [],\n    };\n\n    // if apollo graphql playground is enabled, add exceptions for it\n    if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {\n      const { config: gqlConfig } = strapi.plugin('graphql');\n      specialPaths.push(gqlConfig('endpoint'));\n\n      directives['script-src'].push(`https: 'unsafe-inline'`);\n      directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);\n      directives['manifest-src'].push(`'self'`);\n      directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');\n      directives['frame-src'].push(`'self'`);\n      directives['frame-src'].push('sandbox.embed.apollographql.com');\n    }\n\n    // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that\n    if (ctx.method === 'GET' && specialPaths.some((str) => ctx.path.startsWith(str))) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        crossOriginEmbedderPolicy: false, // TODO: only use this for graphql playground\n        contentSecurityPolicy: {\n          directives,\n        },\n      });\n    }\n\n    /**\n     * These are for vite's watch mode so it can accurately\n     * connect to the HMR websocket & reconnect on failure\n     * or when the server restarts.\n     *\n     * It only applies in development, and only on GET requests\n     * that are part of the admin route.\n     */\n    if (\n      ['development', 'test'].includes(process.env.NODE_ENV ?? '') &&\n      ctx.method === 'GET' &&\n      ['/admin'].some((str) => ctx.path.startsWith(str))\n    ) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        contentSecurityPolicy: {\n          directives: {\n            'script-src': [\"'self'\", \"'unsafe-inline'\"],\n            'connect-src': [\"'self'\", 'http:', 'https:', 'ws:'],\n          },\n        },\n      });\n    }\n\n    return helmet(helmetConfig)(ctx, next);\n  };\n"],"names":["mergeWith","defaultsDeep","helmet"],"mappings":";;;;;;AAOA,MAAM,WAAmB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAC3B,oBAAoB;AAAA,EACpB,uBAAuB;AAAA,IACrB,aAAa;AAAA,IACb,YAAY;AAAA,MACV,eAAe,CAAC,UAAU,QAAQ;AAAA,MAClC,WAAW,CAAC,UAAU,SAAS,SAAS,iCAAiC;AAAA,MACzE,aAAa,CAAC,UAAU,SAAS,OAAO;AAAA,MACxC,yBAAyB;AAAA,IAC3B;AAAA,EACF;AAAA,EACA,WAAW;AAAA,EACX,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,mBAAmB;AAAA,EACrB;AAAA,EACA,YAAY;AAAA,IACV,QAAQ;AAAA,EACV;AACF;AAEA,MAAM,cAAc,CAAC,gBAAwB,cAAsB;AAC1D,SAAAA,EAAA;AAAA,IACL,CAAC,KAAK,QAAS,MAAM,QAAQ,GAAG,KAAK,MAAM,QAAQ,GAAG,IAAI,IAAI,OAAO,GAAG,IAAI;AAAA,IAC5E;AAAA,IACA;AAAA,EAAA;AAEJ;AAEa,MAAA,WACX,CAAC,QAAQ,EAAE,aACX,CAAC,KAAK,SAAS;AACT,MAAA,eAAuBC,EAAAA,aAAa,UAAU,MAAM;AAElD,QAAA,eAAe,CAAC,gBAAgB;AAEtC,QAAM,aAKF;AAAA,IACF,cAAc,CAAC,UAAU,mBAAmB,kBAAkB;AAAA,IAC9D,WAAW,CAAC,UAAU,SAAS,oBAAoB,WAAW;AAAA,IAC9D,gBAAgB,CAAC;AAAA,IACjB,aAAa,CAAC;AAAA,EAAA;AAIZ,MAAA,OAAO,OAAO,SAAS,GAAG,QAAQ,OAAO,EAAE,WAAW,aAAa;AACrE,UAAM,EAAE,QAAQ,UAAA,IAAc,OAAO,OAAO,SAAS;AACxC,iBAAA,KAAK,UAAU,UAAU,CAAC;AAE5B,eAAA,YAAY,EAAE,KAAK,wBAAwB;AAC3C,eAAA,SAAS,EAAE,KAAK,oDAAoD;AACpE,eAAA,cAAc,EAAE,KAAK,QAAQ;AAC7B,eAAA,cAAc,EAAE,KAAK,kDAAkD;AACvE,eAAA,WAAW,EAAE,KAAK,QAAQ;AAC1B,eAAA,WAAW,EAAE,KAAK,iCAAiC;AAAA,EAChE;AAGA,MAAI,IAAI,WAAW,SAAS,aAAa,KAAK,CAAC,QAAQ,IAAI,KAAK,WAAW,GAAG,CAAC,GAAG;AAChF,mBAAe,YAAY,cAAc;AAAA,MACvC,2BAA2B;AAAA;AAAA,MAC3B,uBAAuB;AAAA,QACrB;AAAA,MACF;AAAA,IAAA,CACD;AAAA,EACH;AAWE,MAAA,CAAC,eAAe,MAAM,EAAE,SAAS,QAAQ,IAAI,YAAY,EAAE,KAC3D,IAAI,WAAW,SACf,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,WAAW,GAAG,CAAC,GACjD;AACA,mBAAe,YAAY,cAAc;AAAA,MACvC,uBAAuB;AAAA,QACrB,YAAY;AAAA,UACV,cAAc,CAAC,UAAU,iBAAiB;AAAA,UAC1C,eAAe,CAAC,UAAU,SAAS,UAAU,KAAK;AAAA,QACpD;AAAA,MACF;AAAA,IAAA,CACD;AAAA,EACH;AAEA,SAAOC,gBAAO,QAAA,YAAY,EAAE,KAAK,IAAI;AACvC;;"}

package/dist/middlewares/security.mjs

@@ -1,4 +1,4 @@
-import { defaultsDeep, merge } from "lodash/fp";
+import { defaultsDeep, mergeWith } from "lodash/fp";
 import helmet from "koa-helmet";
 const defaults = {
   crossOriginEmbedderPolicy: false,
@@ -23,6 +23,13 @@ const defaults = {
     action: "sameorigin"
   }
 };
+const mergeConfig = (existingConfig, newConfig) => {
+  return mergeWith(
+    (obj, src) => Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : void 0,
+    existingConfig,
+    newConfig
+  );
+};
 const security = (config, { strapi }) => (ctx, next) => {
   let helmetConfig = defaultsDeep(defaults, config);
   const specialPaths = ["/documentation"];
@@ -43,7 +50,7 @@ const security = (config, { strapi }) => (ctx, next) => {
     directives["frame-src"].push("sandbox.embed.apollographql.com");
   }
   if (ctx.method === "GET" && specialPaths.some((str) => ctx.path.startsWith(str))) {
-    helmetConfig = merge(helmetConfig, {
+    helmetConfig = mergeConfig(helmetConfig, {
       crossOriginEmbedderPolicy: false,
       // TODO: only use this for graphql playground
       contentSecurityPolicy: {
@@ -51,8 +58,8 @@ const security = (config, { strapi }) => (ctx, next) => {
       }
     });
   }
-  if (process.env.NODE_ENV === "development" && ctx.method === "GET" && ["/admin"].some((str) => ctx.path.startsWith(str))) {
-    helmetConfig = merge(helmetConfig, {
+  if (["development", "test"].includes(process.env.NODE_ENV ?? "") && ctx.method === "GET" && ["/admin"].some((str) => ctx.path.startsWith(str))) {
+    helmetConfig = mergeConfig(helmetConfig, {
       contentSecurityPolicy: {
         directives: {
           "script-src": ["'self'", "'unsafe-inline'"],

package/dist/middlewares/security.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"security.mjs","sources":["../../src/middlewares/security.ts"],"sourcesContent":["import { defaultsDeep, merge } from 'lodash/fp';\nimport helmet, { KoaHelmet } from 'koa-helmet';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = NonNullable<Parameters<KoaHelmet>[0]>;\n\nconst defaults: Config = {\n  crossOriginEmbedderPolicy: false,\n  crossOriginOpenerPolicy: false,\n  crossOriginResourcePolicy: false,\n  originAgentCluster: false,\n  contentSecurityPolicy: {\n    useDefaults: true,\n    directives: {\n      'connect-src': [\"'self'\", 'https:'],\n      'img-src': [\"'self'\", 'data:', 'blob:', 'https://market-assets.strapi.io'],\n      'media-src': [\"'self'\", 'data:', 'blob:'],\n      upgradeInsecureRequests: null,\n    },\n  },\n  xssFilter: false,\n  hsts: {\n    maxAge: 31536000,\n    includeSubDomains: true,\n  },\n  frameguard: {\n    action: 'sameorigin',\n  },\n};\n\nexport const security: Core.MiddlewareFactory<Config> =\n  (config, { strapi }) =>\n  (ctx, next) => {\n    let helmetConfig: Config = defaultsDeep(defaults, config);\n\n    const specialPaths = ['/documentation'];\n\n    const directives: {\n      'script-src': string[];\n      'img-src': string[];\n      'manifest-src': string[];\n      'frame-src': string[];\n    } = {\n      'script-src': [\"'self'\", \"'unsafe-inline'\", 'cdn.jsdelivr.net'],\n      'img-src': [\"'self'\", 'data:', 'cdn.jsdelivr.net', 'strapi.io'],\n      'manifest-src': [],\n      'frame-src': [],\n    };\n\n    // if apollo graphql playground is enabled, add exceptions for it\n    if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {\n      const { config: gqlConfig } = strapi.plugin('graphql');\n      specialPaths.push(gqlConfig('endpoint'));\n\n      directives['script-src'].push(`https: 'unsafe-inline'`);\n      directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);\n      directives['manifest-src'].push(`'self'`);\n      directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');\n      directives['frame-src'].push(`'self'`);\n      directives['frame-src'].push('sandbox.embed.apollographql.com');\n    }\n\n    // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that\n    if (ctx.method === 'GET' && specialPaths.some((str) => ctx.path.startsWith(str))) {\n      helmetConfig = merge(helmetConfig, {\n        crossOriginEmbedderPolicy: false, // TODO: only use this for graphql playground\n        contentSecurityPolicy: {\n          directives,\n        },\n      });\n    }\n\n    /**\n     * These are for vite's watch mode so it can accurately\n     * connect to the HMR websocket & reconnect on failure\n     * or when the server restarts.\n     *\n     * It only applies in development, and only on GET requests\n     * that are part of the admin route.\n     */\n    if (\n      process.env.NODE_ENV === 'development' &&\n      ctx.method === 'GET' &&\n      ['/admin'].some((str) => ctx.path.startsWith(str))\n    ) {\n      helmetConfig = merge(helmetConfig, {\n        contentSecurityPolicy: {\n          directives: {\n            'script-src': [\"'self'\", \"'unsafe-inline'\"],\n            'connect-src': [\"'self'\", 'http:', 'https:', 'ws:'],\n          },\n        },\n      });\n    }\n\n    return helmet(helmetConfig)(ctx, next);\n  };\n"],"names":[],"mappings":";;AAOA,MAAM,WAAmB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAC3B,oBAAoB;AAAA,EACpB,uBAAuB;AAAA,IACrB,aAAa;AAAA,IACb,YAAY;AAAA,MACV,eAAe,CAAC,UAAU,QAAQ;AAAA,MAClC,WAAW,CAAC,UAAU,SAAS,SAAS,iCAAiC;AAAA,MACzE,aAAa,CAAC,UAAU,SAAS,OAAO;AAAA,MACxC,yBAAyB;AAAA,IAC3B;AAAA,EACF;AAAA,EACA,WAAW;AAAA,EACX,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,mBAAmB;AAAA,EACrB;AAAA,EACA,YAAY;AAAA,IACV,QAAQ;AAAA,EACV;AACF;AAEa,MAAA,WACX,CAAC,QAAQ,EAAE,aACX,CAAC,KAAK,SAAS;AACT,MAAA,eAAuB,aAAa,UAAU,MAAM;AAElD,QAAA,eAAe,CAAC,gBAAgB;AAEtC,QAAM,aAKF;AAAA,IACF,cAAc,CAAC,UAAU,mBAAmB,kBAAkB;AAAA,IAC9D,WAAW,CAAC,UAAU,SAAS,oBAAoB,WAAW;AAAA,IAC9D,gBAAgB,CAAC;AAAA,IACjB,aAAa,CAAC;AAAA,EAAA;AAIZ,MAAA,OAAO,OAAO,SAAS,GAAG,QAAQ,OAAO,EAAE,WAAW,aAAa;AACrE,UAAM,EAAE,QAAQ,UAAA,IAAc,OAAO,OAAO,SAAS;AACxC,iBAAA,KAAK,UAAU,UAAU,CAAC;AAE5B,eAAA,YAAY,EAAE,KAAK,wBAAwB;AAC3C,eAAA,SAAS,EAAE,KAAK,oDAAoD;AACpE,eAAA,cAAc,EAAE,KAAK,QAAQ;AAC7B,eAAA,cAAc,EAAE,KAAK,kDAAkD;AACvE,eAAA,WAAW,EAAE,KAAK,QAAQ;AAC1B,eAAA,WAAW,EAAE,KAAK,iCAAiC;AAAA,EAChE;AAGA,MAAI,IAAI,WAAW,SAAS,aAAa,KAAK,CAAC,QAAQ,IAAI,KAAK,WAAW,GAAG,CAAC,GAAG;AAChF,mBAAe,MAAM,cAAc;AAAA,MACjC,2BAA2B;AAAA;AAAA,MAC3B,uBAAuB;AAAA,QACrB;AAAA,MACF;AAAA,IAAA,CACD;AAAA,EACH;AAUA,MACE,QAAQ,IAAI,aAAa,iBACzB,IAAI,WAAW,SACf,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,WAAW,GAAG,CAAC,GACjD;AACA,mBAAe,MAAM,cAAc;AAAA,MACjC,uBAAuB;AAAA,QACrB,YAAY;AAAA,UACV,cAAc,CAAC,UAAU,iBAAiB;AAAA,UAC1C,eAAe,CAAC,UAAU,SAAS,UAAU,KAAK;AAAA,QACpD;AAAA,MACF;AAAA,IAAA,CACD;AAAA,EACH;AAEA,SAAO,OAAO,YAAY,EAAE,KAAK,IAAI;AACvC;"}
+{"version":3,"file":"security.mjs","sources":["../../src/middlewares/security.ts"],"sourcesContent":["import { defaultsDeep, mergeWith } from 'lodash/fp';\nimport helmet, { KoaHelmet } from 'koa-helmet';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = NonNullable<Parameters<KoaHelmet>[0]>;\n\nconst defaults: Config = {\n  crossOriginEmbedderPolicy: false,\n  crossOriginOpenerPolicy: false,\n  crossOriginResourcePolicy: false,\n  originAgentCluster: false,\n  contentSecurityPolicy: {\n    useDefaults: true,\n    directives: {\n      'connect-src': [\"'self'\", 'https:'],\n      'img-src': [\"'self'\", 'data:', 'blob:', 'https://market-assets.strapi.io'],\n      'media-src': [\"'self'\", 'data:', 'blob:'],\n      upgradeInsecureRequests: null,\n    },\n  },\n  xssFilter: false,\n  hsts: {\n    maxAge: 31536000,\n    includeSubDomains: true,\n  },\n  frameguard: {\n    action: 'sameorigin',\n  },\n};\n\nconst mergeConfig = (existingConfig: Config, newConfig: Config) => {\n  return mergeWith(\n    (obj, src) => (Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined),\n    existingConfig,\n    newConfig\n  );\n};\n\nexport const security: Core.MiddlewareFactory<Config> =\n  (config, { strapi }) =>\n  (ctx, next) => {\n    let helmetConfig: Config = defaultsDeep(defaults, config);\n\n    const specialPaths = ['/documentation'];\n\n    const directives: {\n      'script-src': string[];\n      'img-src': string[];\n      'manifest-src': string[];\n      'frame-src': string[];\n    } = {\n      'script-src': [\"'self'\", \"'unsafe-inline'\", 'cdn.jsdelivr.net'],\n      'img-src': [\"'self'\", 'data:', 'cdn.jsdelivr.net', 'strapi.io'],\n      'manifest-src': [],\n      'frame-src': [],\n    };\n\n    // if apollo graphql playground is enabled, add exceptions for it\n    if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {\n      const { config: gqlConfig } = strapi.plugin('graphql');\n      specialPaths.push(gqlConfig('endpoint'));\n\n      directives['script-src'].push(`https: 'unsafe-inline'`);\n      directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);\n      directives['manifest-src'].push(`'self'`);\n      directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');\n      directives['frame-src'].push(`'self'`);\n      directives['frame-src'].push('sandbox.embed.apollographql.com');\n    }\n\n    // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that\n    if (ctx.method === 'GET' && specialPaths.some((str) => ctx.path.startsWith(str))) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        crossOriginEmbedderPolicy: false, // TODO: only use this for graphql playground\n        contentSecurityPolicy: {\n          directives,\n        },\n      });\n    }\n\n    /**\n     * These are for vite's watch mode so it can accurately\n     * connect to the HMR websocket & reconnect on failure\n     * or when the server restarts.\n     *\n     * It only applies in development, and only on GET requests\n     * that are part of the admin route.\n     */\n    if (\n      ['development', 'test'].includes(process.env.NODE_ENV ?? '') &&\n      ctx.method === 'GET' &&\n      ['/admin'].some((str) => ctx.path.startsWith(str))\n    ) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        contentSecurityPolicy: {\n          directives: {\n            'script-src': [\"'self'\", \"'unsafe-inline'\"],\n            'connect-src': [\"'self'\", 'http:', 'https:', 'ws:'],\n          },\n        },\n      });\n    }\n\n    return helmet(helmetConfig)(ctx, next);\n  };\n"],"names":[],"mappings":";;AAOA,MAAM,WAAmB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAC3B,oBAAoB;AAAA,EACpB,uBAAuB;AAAA,IACrB,aAAa;AAAA,IACb,YAAY;AAAA,MACV,eAAe,CAAC,UAAU,QAAQ;AAAA,MAClC,WAAW,CAAC,UAAU,SAAS,SAAS,iCAAiC;AAAA,MACzE,aAAa,CAAC,UAAU,SAAS,OAAO;AAAA,MACxC,yBAAyB;AAAA,IAC3B;AAAA,EACF;AAAA,EACA,WAAW;AAAA,EACX,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,mBAAmB;AAAA,EACrB;AAAA,EACA,YAAY;AAAA,IACV,QAAQ;AAAA,EACV;AACF;AAEA,MAAM,cAAc,CAAC,gBAAwB,cAAsB;AAC1D,SAAA;AAAA,IACL,CAAC,KAAK,QAAS,MAAM,QAAQ,GAAG,KAAK,MAAM,QAAQ,GAAG,IAAI,IAAI,OAAO,GAAG,IAAI;AAAA,IAC5E;AAAA,IACA;AAAA,EAAA;AAEJ;AAEa,MAAA,WACX,CAAC,QAAQ,EAAE,aACX,CAAC,KAAK,SAAS;AACT,MAAA,eAAuB,aAAa,UAAU,MAAM;AAElD,QAAA,eAAe,CAAC,gBAAgB;AAEtC,QAAM,aAKF;AAAA,IACF,cAAc,CAAC,UAAU,mBAAmB,kBAAkB;AAAA,IAC9D,WAAW,CAAC,UAAU,SAAS,oBAAoB,WAAW;AAAA,IAC9D,gBAAgB,CAAC;AAAA,IACjB,aAAa,CAAC;AAAA,EAAA;AAIZ,MAAA,OAAO,OAAO,SAAS,GAAG,QAAQ,OAAO,EAAE,WAAW,aAAa;AACrE,UAAM,EAAE,QAAQ,UAAA,IAAc,OAAO,OAAO,SAAS;AACxC,iBAAA,KAAK,UAAU,UAAU,CAAC;AAE5B,eAAA,YAAY,EAAE,KAAK,wBAAwB;AAC3C,eAAA,SAAS,EAAE,KAAK,oDAAoD;AACpE,eAAA,cAAc,EAAE,KAAK,QAAQ;AAC7B,eAAA,cAAc,EAAE,KAAK,kDAAkD;AACvE,eAAA,WAAW,EAAE,KAAK,QAAQ;AAC1B,eAAA,WAAW,EAAE,KAAK,iCAAiC;AAAA,EAChE;AAGA,MAAI,IAAI,WAAW,SAAS,aAAa,KAAK,CAAC,QAAQ,IAAI,KAAK,WAAW,GAAG,CAAC,GAAG;AAChF,mBAAe,YAAY,cAAc;AAAA,MACvC,2BAA2B;AAAA;AAAA,MAC3B,uBAAuB;AAAA,QACrB;AAAA,MACF;AAAA,IAAA,CACD;AAAA,EACH;AAWE,MAAA,CAAC,eAAe,MAAM,EAAE,SAAS,QAAQ,IAAI,YAAY,EAAE,KAC3D,IAAI,WAAW,SACf,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,WAAW,GAAG,CAAC,GACjD;AACA,mBAAe,YAAY,cAAc;AAAA,MACvC,uBAAuB;AAAA,QACrB,YAAY;AAAA,UACV,cAAc,CAAC,UAAU,iBAAiB;AAAA,UAC1C,eAAe,CAAC,UAAU,SAAS,UAAU,KAAK;AAAA,QACpD;AAAA,MACF;AAAA,IAAA,CACD;AAAA,EACH;AAEA,SAAO,OAAO,YAAY,EAAE,KAAK,IAAI;AACvC;"}

package/dist/services/document-service/utils/populate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"populate.d.ts","sourceRoot":"","sources":["../../../../src/services/document-service/utils/populate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAGpC,UAAU,OAAO;IACf;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAGD,eAAO,MAAM,eAAe,QAAS,IAAI,MAAM,SAAQ,OAAO,QA8C7D,CAAC"}
+{"version":3,"file":"populate.d.ts","sourceRoot":"","sources":["../../../../src/services/document-service/utils/populate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAGpC,UAAU,OAAO;IACf;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAGD,eAAO,MAAM,eAAe,QAAS,IAAI,MAAM,SAAQ,OAAO,QAoD7D,CAAC"}

package/dist/services/document-service/utils/populate.js

@@ -7,6 +7,10 @@ const getDeepPopulate = (uid, opts = {}) => {
   return attributes.reduce((acc, [attributeName, attribute]) => {
     switch (attribute.type) {
       case "relation": {
+        const isMorphRelation = attribute.relation.toLowerCase().startsWith("morph");
+        if (isMorphRelation) {
+          break;
+        }
         const isVisible = strapiUtils.contentTypes.isVisibleAttribute(model, attributeName);
         if (isVisible) {
           acc[attributeName] = { select: opts.relationalFields };

package/dist/services/document-service/utils/populate.js.map

@@ -1 +1 @@
-{"version":3,"file":"populate.js","sources":["../../../../src/services/document-service/utils/populate.ts"],"sourcesContent":["import { UID } from '@strapi/types';\nimport { contentTypes } from '@strapi/utils';\n\ninterface Options {\n  /**\n   * Fields to select when populating relations\n   */\n  relationalFields?: string[];\n}\n\n// We want to build a populate object based on the schema\nexport const getDeepPopulate = (uid: UID.Schema, opts: Options = {}) => {\n  const model = strapi.getModel(uid);\n  const attributes = Object.entries(model.attributes);\n\n  return attributes.reduce((acc: any, [attributeName, attribute]) => {\n    switch (attribute.type) {\n      case 'relation': {\n        // TODO: Should this just be a plain list?\n        // Ignore createdBy, updatedBy, ...\n        const isVisible = contentTypes.isVisibleAttribute(model, attributeName);\n        if (isVisible) {\n          acc[attributeName] = { select: opts.relationalFields };\n        }\n        break;\n      }\n\n      case 'media': {\n        acc[attributeName] = { select: ['id'] };\n        break;\n      }\n\n      case 'component': {\n        const populate = getDeepPopulate(attribute.component, opts);\n        acc[attributeName] = { populate };\n        break;\n      }\n\n      case 'dynamiczone': {\n        // Use fragments to populate the dynamic zone components\n        const populatedComponents = (attribute.components || []).reduce(\n          (acc: any, componentUID: UID.Component) => {\n            acc[componentUID] = { populate: getDeepPopulate(componentUID, opts) };\n            return acc;\n          },\n          {}\n        );\n\n        acc[attributeName] = { on: populatedComponents };\n        break;\n      }\n      default:\n        break;\n    }\n\n    return acc;\n  }, {});\n};\n"],"names":["contentTypes","acc"],"mappings":";;;AAWO,MAAM,kBAAkB,CAAC,KAAiB,OAAgB,OAAO;AAChE,QAAA,QAAQ,OAAO,SAAS,GAAG;AACjC,QAAM,aAAa,OAAO,QAAQ,MAAM,UAAU;AAElD,SAAO,WAAW,OAAO,CAAC,KAAU,CAAC,eAAe,SAAS,MAAM;AACjE,YAAQ,UAAU,MAAM;AAAA,MACtB,KAAK,YAAY;AAGf,cAAM,YAAYA,YAAA,aAAa,mBAAmB,OAAO,aAAa;AACtE,YAAI,WAAW;AACb,cAAI,aAAa,IAAI,EAAE,QAAQ,KAAK,iBAAiB;AAAA,QACvD;AACA;AAAA,MACF;AAAA,MAEA,KAAK,SAAS;AACZ,YAAI,aAAa,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;AACtC;AAAA,MACF;AAAA,MAEA,KAAK,aAAa;AAChB,cAAM,WAAW,gBAAgB,UAAU,WAAW,IAAI;AACtD,YAAA,aAAa,IAAI,EAAE;AACvB;AAAA,MACF;AAAA,MAEA,KAAK,eAAe;AAElB,cAAM,uBAAuB,UAAU,cAAc,CAAI,GAAA;AAAA,UACvD,CAACC,MAAU,iBAAgC;AACzCA,iBAAI,YAAY,IAAI,EAAE,UAAU,gBAAgB,cAAc,IAAI;AAC3DA,mBAAAA;AAAAA,UACT;AAAA,UACA,CAAC;AAAA,QAAA;AAGH,YAAI,aAAa,IAAI,EAAE,IAAI,oBAAoB;AAC/C;AAAA,MACF;AAAA,IAGF;AAEO,WAAA;AAAA,EACT,GAAG,CAAE,CAAA;AACP;;"}
+{"version":3,"file":"populate.js","sources":["../../../../src/services/document-service/utils/populate.ts"],"sourcesContent":["import { UID } from '@strapi/types';\nimport { contentTypes } from '@strapi/utils';\n\ninterface Options {\n  /**\n   * Fields to select when populating relations\n   */\n  relationalFields?: string[];\n}\n\n// We want to build a populate object based on the schema\nexport const getDeepPopulate = (uid: UID.Schema, opts: Options = {}) => {\n  const model = strapi.getModel(uid);\n  const attributes = Object.entries(model.attributes);\n\n  return attributes.reduce((acc: any, [attributeName, attribute]) => {\n    switch (attribute.type) {\n      case 'relation': {\n        // TODO: Support polymorphic relations\n        const isMorphRelation = attribute.relation.toLowerCase().startsWith('morph');\n        if (isMorphRelation) {\n          break;\n        }\n\n        // TODO: Should this just be a plain list?\n        // Ignore createdBy, updatedBy, ...\n        const isVisible = contentTypes.isVisibleAttribute(model, attributeName);\n        if (isVisible) {\n          acc[attributeName] = { select: opts.relationalFields };\n        }\n        break;\n      }\n\n      case 'media': {\n        acc[attributeName] = { select: ['id'] };\n        break;\n      }\n\n      case 'component': {\n        const populate = getDeepPopulate(attribute.component, opts);\n        acc[attributeName] = { populate };\n        break;\n      }\n\n      case 'dynamiczone': {\n        // Use fragments to populate the dynamic zone components\n        const populatedComponents = (attribute.components || []).reduce(\n          (acc: any, componentUID: UID.Component) => {\n            acc[componentUID] = { populate: getDeepPopulate(componentUID, opts) };\n            return acc;\n          },\n          {}\n        );\n\n        acc[attributeName] = { on: populatedComponents };\n        break;\n      }\n      default:\n        break;\n    }\n\n    return acc;\n  }, {});\n};\n"],"names":["contentTypes","acc"],"mappings":";;;AAWO,MAAM,kBAAkB,CAAC,KAAiB,OAAgB,OAAO;AAChE,QAAA,QAAQ,OAAO,SAAS,GAAG;AACjC,QAAM,aAAa,OAAO,QAAQ,MAAM,UAAU;AAElD,SAAO,WAAW,OAAO,CAAC,KAAU,CAAC,eAAe,SAAS,MAAM;AACjE,YAAQ,UAAU,MAAM;AAAA,MACtB,KAAK,YAAY;AAEf,cAAM,kBAAkB,UAAU,SAAS,YAAY,EAAE,WAAW,OAAO;AAC3E,YAAI,iBAAiB;AACnB;AAAA,QACF;AAIA,cAAM,YAAYA,YAAA,aAAa,mBAAmB,OAAO,aAAa;AACtE,YAAI,WAAW;AACb,cAAI,aAAa,IAAI,EAAE,QAAQ,KAAK,iBAAiB;AAAA,QACvD;AACA;AAAA,MACF;AAAA,MAEA,KAAK,SAAS;AACZ,YAAI,aAAa,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;AACtC;AAAA,MACF;AAAA,MAEA,KAAK,aAAa;AAChB,cAAM,WAAW,gBAAgB,UAAU,WAAW,IAAI;AACtD,YAAA,aAAa,IAAI,EAAE;AACvB;AAAA,MACF;AAAA,MAEA,KAAK,eAAe;AAElB,cAAM,uBAAuB,UAAU,cAAc,CAAI,GAAA;AAAA,UACvD,CAACC,MAAU,iBAAgC;AACzCA,iBAAI,YAAY,IAAI,EAAE,UAAU,gBAAgB,cAAc,IAAI;AAC3DA,mBAAAA;AAAAA,UACT;AAAA,UACA,CAAC;AAAA,QAAA;AAGH,YAAI,aAAa,IAAI,EAAE,IAAI,oBAAoB;AAC/C;AAAA,MACF;AAAA,IAGF;AAEO,WAAA;AAAA,EACT,GAAG,CAAE,CAAA;AACP;;"}

package/dist/services/document-service/utils/populate.mjs

@@ -5,6 +5,10 @@ const getDeepPopulate = (uid, opts = {}) => {
   return attributes.reduce((acc, [attributeName, attribute]) => {
     switch (attribute.type) {
       case "relation": {
+        const isMorphRelation = attribute.relation.toLowerCase().startsWith("morph");
+        if (isMorphRelation) {
+          break;
+        }
         const isVisible = contentTypes.isVisibleAttribute(model, attributeName);
         if (isVisible) {
           acc[attributeName] = { select: opts.relationalFields };

package/dist/services/document-service/utils/populate.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"populate.mjs","sources":["../../../../src/services/document-service/utils/populate.ts"],"sourcesContent":["import { UID } from '@strapi/types';\nimport { contentTypes } from '@strapi/utils';\n\ninterface Options {\n  /**\n   * Fields to select when populating relations\n   */\n  relationalFields?: string[];\n}\n\n// We want to build a populate object based on the schema\nexport const getDeepPopulate = (uid: UID.Schema, opts: Options = {}) => {\n  const model = strapi.getModel(uid);\n  const attributes = Object.entries(model.attributes);\n\n  return attributes.reduce((acc: any, [attributeName, attribute]) => {\n    switch (attribute.type) {\n      case 'relation': {\n        // TODO: Should this just be a plain list?\n        // Ignore createdBy, updatedBy, ...\n        const isVisible = contentTypes.isVisibleAttribute(model, attributeName);\n        if (isVisible) {\n          acc[attributeName] = { select: opts.relationalFields };\n        }\n        break;\n      }\n\n      case 'media': {\n        acc[attributeName] = { select: ['id'] };\n        break;\n      }\n\n      case 'component': {\n        const populate = getDeepPopulate(attribute.component, opts);\n        acc[attributeName] = { populate };\n        break;\n      }\n\n      case 'dynamiczone': {\n        // Use fragments to populate the dynamic zone components\n        const populatedComponents = (attribute.components || []).reduce(\n          (acc: any, componentUID: UID.Component) => {\n            acc[componentUID] = { populate: getDeepPopulate(componentUID, opts) };\n            return acc;\n          },\n          {}\n        );\n\n        acc[attributeName] = { on: populatedComponents };\n        break;\n      }\n      default:\n        break;\n    }\n\n    return acc;\n  }, {});\n};\n"],"names":["acc"],"mappings":";AAWO,MAAM,kBAAkB,CAAC,KAAiB,OAAgB,OAAO;AAChE,QAAA,QAAQ,OAAO,SAAS,GAAG;AACjC,QAAM,aAAa,OAAO,QAAQ,MAAM,UAAU;AAElD,SAAO,WAAW,OAAO,CAAC,KAAU,CAAC,eAAe,SAAS,MAAM;AACjE,YAAQ,UAAU,MAAM;AAAA,MACtB,KAAK,YAAY;AAGf,cAAM,YAAY,aAAa,mBAAmB,OAAO,aAAa;AACtE,YAAI,WAAW;AACb,cAAI,aAAa,IAAI,EAAE,QAAQ,KAAK,iBAAiB;AAAA,QACvD;AACA;AAAA,MACF;AAAA,MAEA,KAAK,SAAS;AACZ,YAAI,aAAa,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;AACtC;AAAA,MACF;AAAA,MAEA,KAAK,aAAa;AAChB,cAAM,WAAW,gBAAgB,UAAU,WAAW,IAAI;AACtD,YAAA,aAAa,IAAI,EAAE;AACvB;AAAA,MACF;AAAA,MAEA,KAAK,eAAe;AAElB,cAAM,uBAAuB,UAAU,cAAc,CAAI,GAAA;AAAA,UACvD,CAACA,MAAU,iBAAgC;AACzCA,iBAAI,YAAY,IAAI,EAAE,UAAU,gBAAgB,cAAc,IAAI;AAC3DA,mBAAAA;AAAAA,UACT;AAAA,UACA,CAAC;AAAA,QAAA;AAGH,YAAI,aAAa,IAAI,EAAE,IAAI,oBAAoB;AAC/C;AAAA,MACF;AAAA,IAGF;AAEO,WAAA;AAAA,EACT,GAAG,CAAE,CAAA;AACP;"}
+{"version":3,"file":"populate.mjs","sources":["../../../../src/services/document-service/utils/populate.ts"],"sourcesContent":["import { UID } from '@strapi/types';\nimport { contentTypes } from '@strapi/utils';\n\ninterface Options {\n  /**\n   * Fields to select when populating relations\n   */\n  relationalFields?: string[];\n}\n\n// We want to build a populate object based on the schema\nexport const getDeepPopulate = (uid: UID.Schema, opts: Options = {}) => {\n  const model = strapi.getModel(uid);\n  const attributes = Object.entries(model.attributes);\n\n  return attributes.reduce((acc: any, [attributeName, attribute]) => {\n    switch (attribute.type) {\n      case 'relation': {\n        // TODO: Support polymorphic relations\n        const isMorphRelation = attribute.relation.toLowerCase().startsWith('morph');\n        if (isMorphRelation) {\n          break;\n        }\n\n        // TODO: Should this just be a plain list?\n        // Ignore createdBy, updatedBy, ...\n        const isVisible = contentTypes.isVisibleAttribute(model, attributeName);\n        if (isVisible) {\n          acc[attributeName] = { select: opts.relationalFields };\n        }\n        break;\n      }\n\n      case 'media': {\n        acc[attributeName] = { select: ['id'] };\n        break;\n      }\n\n      case 'component': {\n        const populate = getDeepPopulate(attribute.component, opts);\n        acc[attributeName] = { populate };\n        break;\n      }\n\n      case 'dynamiczone': {\n        // Use fragments to populate the dynamic zone components\n        const populatedComponents = (attribute.components || []).reduce(\n          (acc: any, componentUID: UID.Component) => {\n            acc[componentUID] = { populate: getDeepPopulate(componentUID, opts) };\n            return acc;\n          },\n          {}\n        );\n\n        acc[attributeName] = { on: populatedComponents };\n        break;\n      }\n      default:\n        break;\n    }\n\n    return acc;\n  }, {});\n};\n"],"names":["acc"],"mappings":";AAWO,MAAM,kBAAkB,CAAC,KAAiB,OAAgB,OAAO;AAChE,QAAA,QAAQ,OAAO,SAAS,GAAG;AACjC,QAAM,aAAa,OAAO,QAAQ,MAAM,UAAU;AAElD,SAAO,WAAW,OAAO,CAAC,KAAU,CAAC,eAAe,SAAS,MAAM;AACjE,YAAQ,UAAU,MAAM;AAAA,MACtB,KAAK,YAAY;AAEf,cAAM,kBAAkB,UAAU,SAAS,YAAY,EAAE,WAAW,OAAO;AAC3E,YAAI,iBAAiB;AACnB;AAAA,QACF;AAIA,cAAM,YAAY,aAAa,mBAAmB,OAAO,aAAa;AACtE,YAAI,WAAW;AACb,cAAI,aAAa,IAAI,EAAE,QAAQ,KAAK,iBAAiB;AAAA,QACvD;AACA;AAAA,MACF;AAAA,MAEA,KAAK,SAAS;AACZ,YAAI,aAAa,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;AACtC;AAAA,MACF;AAAA,MAEA,KAAK,aAAa;AAChB,cAAM,WAAW,gBAAgB,UAAU,WAAW,IAAI;AACtD,YAAA,aAAa,IAAI,EAAE;AACvB;AAAA,MACF;AAAA,MAEA,KAAK,eAAe;AAElB,cAAM,uBAAuB,UAAU,cAAc,CAAI,GAAA;AAAA,UACvD,CAACA,MAAU,iBAAgC;AACzCA,iBAAI,YAAY,IAAI,EAAE,UAAU,gBAAgB,cAAc,IAAI;AAC3DA,mBAAAA;AAAAA,UACT;AAAA,UACA,CAAC;AAAA,QAAA;AAGH,YAAI,aAAa,IAAI,EAAE,IAAI,oBAAoB;AAC/C;AAAA,MACF;AAAA,IAGF;AAEO,WAAA;AAAA,EACT,GAAG,CAAE,CAAA;AACP;"}

package/dist/services/entity-validator/index.d.ts

@@ -2,7 +2,20 @@
  * Entity validator
  * Module that will validate input data for entity creation or edition
  */
-import { Modules } from '@strapi/types';
+import { Modules, Struct } from '@strapi/types';
+export type ComponentContext = {
+    parentContent: {
+        model: Struct.Schema;
+        id?: number;
+        options?: ValidatorContext;
+    };
+    pathToComponent: string[];
+    repeatableData: Modules.EntityValidator.Entity[];
+};
+interface ValidatorContext {
+    isDraft?: boolean;
+    locale?: string | null;
+}
 declare const entityValidator: Modules.EntityValidator.EntityValidator;
 export default entityValidator;
 //# sourceMappingURL=index.d.ts.map

package/dist/services/entity-validator/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/entity-validator/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAE,OAAO,EAAuB,MAAM,eAAe,CAAC;AAmf7D,QAAA,MAAM,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,eAG9C,CAAC;AAEF,eAAe,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/entity-validator/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAE,OAAO,EAAO,MAAM,EAAU,MAAM,eAAe,CAAC;AAa7D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,EAAE;QAEb,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QAErB,EAAE,CAAC,EAAE,MAAM,CAAC;QAGZ,OAAO,CAAC,EAAE,gBAAgB,CAAC;KAC5B,CAAC;IAEF,eAAe,EAAE,MAAM,EAAE,CAAC;IAG1B,cAAc,EAAE,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;CAClD,CAAC;AAWF,UAAU,gBAAgB;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AA8hBD,QAAA,MAAM,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,eAG9C,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/services/entity-validator/index.js

@@ -55,7 +55,11 @@ const addDefault = (createOrUpdate) => {
   };
 };
 const preventCast = (validator) => validator.transform((val, originalVal) => originalVal);
-const createComponentValidator = (createOrUpdate) => ({ attr, updatedAttribute }, { isDraft }) => {
+const createComponentValidator = (createOrUpdate) => ({
+  attr,
+  updatedAttribute,
+  componentContext
+}, { isDraft }) => {
   const model = strapi.getModel(attr.component);
   if (!model) {
     throw new Error("Validation failed: Model not found");
@@ -63,7 +67,10 @@ const createComponentValidator = (createOrUpdate) => ({ attr, updatedAttribute }
   if (attr?.repeatable) {
     let validator2 = yup.array().of(
       yup.lazy(
-        (item) => createModelValidator(createOrUpdate)({ model, data: item }, { isDraft }).notNull()
+        (item) => createModelValidator(createOrUpdate)(
+          { componentContext, model, data: item },
+          { isDraft }
+        ).notNull()
       )
     );
     validator2 = addRequiredValidation(createOrUpdate)(validator2, {
@@ -74,7 +81,11 @@ const createComponentValidator = (createOrUpdate) => ({ attr, updatedAttribute }
     return validator2;
   }
   let validator = createModelValidator(createOrUpdate)(
-    { model, data: updatedAttribute.value },
+    {
+      model,
+      data: updatedAttribute.value,
+      componentContext
+    },
     { isDraft }
   );
   validator = addRequiredValidation(createOrUpdate)(validator, {
@@ -83,7 +94,7 @@ const createComponentValidator = (createOrUpdate) => ({ attr, updatedAttribute }
   });
   return validator;
 };
-const createDzValidator = (createOrUpdate) => ({ attr, updatedAttribute }, { isDraft }) => {
+const createDzValidator = (createOrUpdate) => ({ attr, updatedAttribute, componentContext }, { isDraft }) => {
   let validator;
   validator = yup.array().of(
     yup.lazy((item) => {
@@ -91,7 +102,12 @@ const createDzValidator = (createOrUpdate) => ({ attr, updatedAttribute }, { isD
       const schema = yup.object().shape({
         __component: yup.string().required().oneOf(Object.keys(strapi.components))
       }).notNull();
-      return model ? schema.concat(createModelValidator(createOrUpdate)({ model, data: item }, { isDraft })) : schema;
+      return model ? schema.concat(
+        createModelValidator(createOrUpdate)(
+          { model, data: item, componentContext },
+          { isDraft }
+        )
+      ) : schema;
     })
     // FIXME: yup v1
   );
@@ -102,17 +118,15 @@ const createDzValidator = (createOrUpdate) => ({ attr, updatedAttribute }, { isD
   validator = addMinMax(validator, { attr, updatedAttribute });
   return validator;
 };
-const createRelationValidator = (createOrUpdate) => ({ attr, updatedAttribute }, { isDraft }) => {
+const createRelationValidator = ({
+  updatedAttribute
+}) => {
   let validator;
   if (Array.isArray(updatedAttribute.value)) {
     validator = yup.array().of(yup.mixed());
   } else {
     validator = yup.mixed();
   }
-  validator = addRequiredValidation(createOrUpdate)(validator, {
-    attr: { required: !isDraft && attr.required },
-    updatedAttribute
-  });
   return validator;
 };
 const createScalarAttributeValidator = (createOrUpdate) => (metas, options) => {
@@ -136,27 +150,49 @@ const createAttributeValidator = (createOrUpdate) => (metas, options) => {
     validator = createScalarAttributeValidator(createOrUpdate)(metas, options);
   } else {
     if (metas.attr.type === "component") {
+      const pathToComponent = [
+        ...metas?.componentContext?.pathToComponent ?? [],
+        metas.updatedAttribute.name
+      ];
+      const repeatableData = metas.attr.repeatable && pathToComponent.length === 1 ? metas.updatedAttribute.value : metas.componentContext?.repeatableData;
+      const newComponentContext = {
+        ...metas?.componentContext ?? {},
+        pathToComponent,
+        repeatableData
+      };
       validator = createComponentValidator(createOrUpdate)(
-        { attr: metas.attr, updatedAttribute: metas.updatedAttribute },
-        options
-      );
-    } else if (metas.attr.type === "dynamiczone") {
-      validator = createDzValidator(createOrUpdate)(metas, options);
-    } else if (metas.attr.type === "relation") {
-      validator = createRelationValidator(createOrUpdate)(
         {
+          componentContext: newComponentContext,
           attr: metas.attr,
           updatedAttribute: metas.updatedAttribute
         },
         options
       );
+    } else if (metas.attr.type === "dynamiczone") {
+      const pathToComponent = [
+        ...metas?.componentContext?.pathToComponent ?? [],
+        metas.updatedAttribute.name
+      ];
+      const newComponentContext = {
+        ...metas?.componentContext ?? {},
+        pathToComponent
+      };
+      validator = createDzValidator(createOrUpdate)(
+        { ...metas, componentContext: newComponentContext },
+        options
+      );
+    } else if (metas.attr.type === "relation") {
+      validator = createRelationValidator({
+        attr: metas.attr,
+        updatedAttribute: metas.updatedAttribute
+      });
     }
     validator = preventCast(validator);
   }
   validator = addDefault(createOrUpdate)(validator, metas);
   return validator;
 };
-const createModelValidator = (createOrUpdate) => ({ model, data, entity }, options) => {
+const createModelValidator = (createOrUpdate) => ({ componentContext, model, data, entity }, options) => {
   const writableAttributes = model ? getWritableAttributes(model) : [];
   const schema = writableAttributes.reduce(
     (validators2, attributeName) => {
@@ -164,7 +200,8 @@ const createModelValidator = (createOrUpdate) => ({ model, data, entity }, optio
         attr: model.attributes[attributeName],
         updatedAttribute: { name: attributeName, value: _.prop(attributeName, data) },
         model,
-        entity
+        entity,
+        componentContext
       };
       const validator = createAttributeValidator(createOrUpdate)(metas, options);
       validators2[attributeName] = validator;
@@ -183,22 +220,42 @@ const createValidateEntity = (createOrUpdate) => {
       );
     }
     const validator = createModelValidator(createOrUpdate)(
-      { model, data, entity },
+      {
+        model,
+        data,
+        entity,
+        componentContext: {
+          // Set up the initial component context.
+          // Keeping track of parent content type context in which a component will be used.
+          // This is necessary to validate component field constraints such as uniqueness.
+          parentContent: {
+            id: entity?.id,
+            model,
+            options
+          },
+          pathToComponent: [],
+          repeatableData: []
+        }
+      },
       {
         isDraft: options?.isDraft ?? false,
         locale: options?.locale ?? null
       }
-    ).test("relations-test", "check that all relations exist", async function(data2) {
-      try {
-        await checkRelationsExist(buildRelationsStore({ uid: model.uid, data: data2 }));
-      } catch (e) {
-        return this.createError({
-          path: this.path,
-          message: e instanceof ValidationError && e.message || "Invalid relations"
-        });
+    ).test(
+      "relations-test",
+      "check that all relations exist",
+      async function relationsValidation(data2) {
+        try {
+          await checkRelationsExist(buildRelationsStore({ uid: model.uid, data: data2 }));
+        } catch (e) {
+          return this.createError({
+            path: this.path,
+            message: e instanceof ValidationError && e.message || "Invalid relations"
+          });
+        }
+        return true;
       }
-      return true;
-    }).required();
+    ).required();
     return validateYupSchema(validator, {
       strict: false,
       abortEarly: false