@strapi/core 5.12.1 → 5.12.2

package/dist/middlewares/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sources":["../../src/middlewares/query.ts"],"sourcesContent":["import qs from 'qs';\nimport type Koa from 'koa';\nimport type { Core } from '@strapi/types';\n\ntype Config = Parameters<typeof qs.parse>[1];\n\nconst defaults: Config = {\n  strictNullHandling: true,\n  arrayLimit: 100,\n  depth: 20,\n};\n\n/**\n * Body parser hook\n */\nconst addQsParser = (app: Koa, settings: Config) => {\n  Object.defineProperty(app.request, 'query', {\n    configurable: false,\n    enumerable: true,\n    /*\n     * Get parsed query-string.\n     */\n    get() {\n      const qstr = this.querystring;\n\n      this._querycache = this._querycache || {};\n      const cache = this._querycache;\n\n      if (!cache[qstr]) {\n        cache[qstr] = qs.parse(qstr, settings);\n      }\n\n      return cache[qstr];\n    },\n\n    /*\n     * Set query-string as an object.\n     */\n    set(obj) {\n      this.querystring = qs.stringify(obj);\n    },\n  } satisfies PropertyDescriptor & ThisType<Koa.BaseRequest>);\n\n  return app;\n};\n\nexport const query: Core.MiddlewareFactory = (\n  config: Partial<Config>,\n  { strapi }: { strapi: Core.Strapi }\n) => {\n  addQsParser(strapi.server.app, { ...defaults, ...config } as Config);\n};\n"],"names":["defaults","strictNullHandling","arrayLimit","depth","addQsParser","app","settings","Object","defineProperty","request","configurable","enumerable","get","qstr","querystring","_querycache","cache","qs","parse","set","obj","stringify","query","config","strapi","server"],"mappings":";;;;AAMA,MAAMA,QAAmB,GAAA;IACvBC,kBAAoB,EAAA,IAAA;IACpBC,UAAY,EAAA,GAAA;IACZC,KAAO,EAAA;AACT,CAAA;AAEA;;IAGA,MAAMC,WAAc,GAAA,CAACC,GAAUC,EAAAA,QAAAA,GAAAA;AAC7BC,IAAAA,MAAAA,CAAOC,cAAc,CAACH,GAAII,CAAAA,OAAO,EAAE,OAAS,EAAA;QAC1CC,YAAc,EAAA,KAAA;QACdC,UAAY,EAAA,IAAA;AACZ;;QAGAC,GAAAA,CAAAA,GAAAA;YACE,MAAMC,IAAAA,GAAO,IAAI,CAACC,WAAW;AAE7B,YAAA,IAAI,CAACC,WAAW,GAAG,IAAI,CAACA,WAAW,IAAI,EAAC;YACxC,MAAMC,KAAAA,GAAQ,IAAI,CAACD,WAAW;AAE9B,YAAA,IAAI,CAACC,KAAK,CAACH,IAAAA,CAAK,EAAE;AAChBG,gBAAAA,KAAK,CAACH,IAAK,CAAA,GAAGI,EAAGC,CAAAA,KAAK,CAACL,IAAMP,EAAAA,QAAAA,CAAAA;AAC/B;YAEA,OAAOU,KAAK,CAACH,IAAK,CAAA;AACpB,SAAA;AAEA;;AAEC,QACDM,KAAIC,GAAG,EAAA;AACL,YAAA,IAAI,CAACN,WAAW,GAAGG,EAAAA,CAAGI,SAAS,CAACD,GAAAA,CAAAA;AAClC;AACF,KAAA,CAAA;IAEA,OAAOf,GAAAA;AACT,CAAA;MAEaiB,KAAgC,GAAA,CAC3CC,MACA,EAAA,EAAEC,MAAM,EAA2B,GAAA;AAEnCpB,IAAAA,WAAAA,CAAYoB,MAAOC,CAAAA,MAAM,CAACpB,GAAG,EAAE;AAAE,QAAA,GAAGL,QAAQ;AAAE,QAAA,GAAGuB;AAAO,KAAA,CAAA;AAC1D;;;;"}

package/dist/middlewares/query.mjs

@@ -0,0 +1,41 @@
+import qs from 'qs';
+
+const defaults = {
+    strictNullHandling: true,
+    arrayLimit: 100,
+    depth: 20
+};
+/**
+ * Body parser hook
+ */ const addQsParser = (app, settings)=>{
+    Object.defineProperty(app.request, 'query', {
+        configurable: false,
+        enumerable: true,
+        /*
+     * Get parsed query-string.
+     */ get () {
+            const qstr = this.querystring;
+            this._querycache = this._querycache || {};
+            const cache = this._querycache;
+            if (!cache[qstr]) {
+                cache[qstr] = qs.parse(qstr, settings);
+            }
+            return cache[qstr];
+        },
+        /*
+     * Set query-string as an object.
+     */ set (obj) {
+            this.querystring = qs.stringify(obj);
+        }
+    });
+    return app;
+};
+const query = (config, { strapi })=>{
+    addQsParser(strapi.server.app, {
+        ...defaults,
+        ...config
+    });
+};
+
+export { query };
+//# sourceMappingURL=query.mjs.map

package/dist/middlewares/query.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.mjs","sources":["../../src/middlewares/query.ts"],"sourcesContent":["import qs from 'qs';\nimport type Koa from 'koa';\nimport type { Core } from '@strapi/types';\n\ntype Config = Parameters<typeof qs.parse>[1];\n\nconst defaults: Config = {\n  strictNullHandling: true,\n  arrayLimit: 100,\n  depth: 20,\n};\n\n/**\n * Body parser hook\n */\nconst addQsParser = (app: Koa, settings: Config) => {\n  Object.defineProperty(app.request, 'query', {\n    configurable: false,\n    enumerable: true,\n    /*\n     * Get parsed query-string.\n     */\n    get() {\n      const qstr = this.querystring;\n\n      this._querycache = this._querycache || {};\n      const cache = this._querycache;\n\n      if (!cache[qstr]) {\n        cache[qstr] = qs.parse(qstr, settings);\n      }\n\n      return cache[qstr];\n    },\n\n    /*\n     * Set query-string as an object.\n     */\n    set(obj) {\n      this.querystring = qs.stringify(obj);\n    },\n  } satisfies PropertyDescriptor & ThisType<Koa.BaseRequest>);\n\n  return app;\n};\n\nexport const query: Core.MiddlewareFactory = (\n  config: Partial<Config>,\n  { strapi }: { strapi: Core.Strapi }\n) => {\n  addQsParser(strapi.server.app, { ...defaults, ...config } as Config);\n};\n"],"names":["defaults","strictNullHandling","arrayLimit","depth","addQsParser","app","settings","Object","defineProperty","request","configurable","enumerable","get","qstr","querystring","_querycache","cache","qs","parse","set","obj","stringify","query","config","strapi","server"],"mappings":";;AAMA,MAAMA,QAAmB,GAAA;IACvBC,kBAAoB,EAAA,IAAA;IACpBC,UAAY,EAAA,GAAA;IACZC,KAAO,EAAA;AACT,CAAA;AAEA;;IAGA,MAAMC,WAAc,GAAA,CAACC,GAAUC,EAAAA,QAAAA,GAAAA;AAC7BC,IAAAA,MAAAA,CAAOC,cAAc,CAACH,GAAII,CAAAA,OAAO,EAAE,OAAS,EAAA;QAC1CC,YAAc,EAAA,KAAA;QACdC,UAAY,EAAA,IAAA;AACZ;;QAGAC,GAAAA,CAAAA,GAAAA;YACE,MAAMC,IAAAA,GAAO,IAAI,CAACC,WAAW;AAE7B,YAAA,IAAI,CAACC,WAAW,GAAG,IAAI,CAACA,WAAW,IAAI,EAAC;YACxC,MAAMC,KAAAA,GAAQ,IAAI,CAACD,WAAW;AAE9B,YAAA,IAAI,CAACC,KAAK,CAACH,IAAAA,CAAK,EAAE;AAChBG,gBAAAA,KAAK,CAACH,IAAK,CAAA,GAAGI,EAAGC,CAAAA,KAAK,CAACL,IAAMP,EAAAA,QAAAA,CAAAA;AAC/B;YAEA,OAAOU,KAAK,CAACH,IAAK,CAAA;AACpB,SAAA;AAEA;;AAEC,QACDM,KAAIC,GAAG,EAAA;AACL,YAAA,IAAI,CAACN,WAAW,GAAGG,EAAAA,CAAGI,SAAS,CAACD,GAAAA,CAAAA;AAClC;AACF,KAAA,CAAA;IAEA,OAAOf,GAAAA;AACT,CAAA;MAEaiB,KAAgC,GAAA,CAC3CC,MACA,EAAA,EAAEC,MAAM,EAA2B,GAAA;AAEnCpB,IAAAA,WAAAA,CAAYoB,MAAOC,CAAAA,MAAM,CAACpB,GAAG,EAAE;AAAE,QAAA,GAAGL,QAAQ;AAAE,QAAA,GAAGuB;AAAO,KAAA,CAAA;AAC1D;;;;"}

package/dist/middlewares/response-time.js

@@ -0,0 +1,13 @@
+'use strict';
+
+const responseTime = ()=>{
+    return async (ctx, next)=>{
+        const start = Date.now();
+        await next();
+        const delta = Math.ceil(Date.now() - start);
+        ctx.set('X-Response-Time', `${delta}ms`);
+    };
+};
+
+exports.responseTime = responseTime;
+//# sourceMappingURL=response-time.js.map

package/dist/middlewares/response-time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-time.js","sources":["../../src/middlewares/response-time.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\n\nexport const responseTime: Core.MiddlewareFactory = () => {\n  return async (ctx, next) => {\n    const start = Date.now();\n\n    await next();\n\n    const delta = Math.ceil(Date.now() - start);\n    ctx.set('X-Response-Time', `${delta}ms`);\n  };\n};\n"],"names":["responseTime","ctx","next","start","Date","now","delta","Math","ceil","set"],"mappings":";;MAEaA,YAAuC,GAAA,IAAA;AAClD,IAAA,OAAO,OAAOC,GAAKC,EAAAA,IAAAA,GAAAA;QACjB,MAAMC,KAAAA,GAAQC,KAAKC,GAAG,EAAA;QAEtB,MAAMH,IAAAA,EAAAA;AAEN,QAAA,MAAMI,QAAQC,IAAKC,CAAAA,IAAI,CAACJ,IAAAA,CAAKC,GAAG,EAAKF,GAAAA,KAAAA,CAAAA;AACrCF,QAAAA,GAAAA,CAAIQ,GAAG,CAAC,iBAAA,EAAmB,CAAC,EAAEH,KAAAA,CAAM,EAAE,CAAC,CAAA;AACzC,KAAA;AACF;;;;"}

package/dist/middlewares/response-time.mjs

@@ -0,0 +1,11 @@
+const responseTime = ()=>{
+    return async (ctx, next)=>{
+        const start = Date.now();
+        await next();
+        const delta = Math.ceil(Date.now() - start);
+        ctx.set('X-Response-Time', `${delta}ms`);
+    };
+};
+
+export { responseTime };
+//# sourceMappingURL=response-time.mjs.map

package/dist/middlewares/response-time.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-time.mjs","sources":["../../src/middlewares/response-time.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\n\nexport const responseTime: Core.MiddlewareFactory = () => {\n  return async (ctx, next) => {\n    const start = Date.now();\n\n    await next();\n\n    const delta = Math.ceil(Date.now() - start);\n    ctx.set('X-Response-Time', `${delta}ms`);\n  };\n};\n"],"names":["responseTime","ctx","next","start","Date","now","delta","Math","ceil","set"],"mappings":"MAEaA,YAAuC,GAAA,IAAA;AAClD,IAAA,OAAO,OAAOC,GAAKC,EAAAA,IAAAA,GAAAA;QACjB,MAAMC,KAAAA,GAAQC,KAAKC,GAAG,EAAA;QAEtB,MAAMH,IAAAA,EAAAA;AAEN,QAAA,MAAMI,QAAQC,IAAKC,CAAAA,IAAI,CAACJ,IAAAA,CAAKC,GAAG,EAAKF,GAAAA,KAAAA,CAAAA;AACrCF,QAAAA,GAAAA,CAAIQ,GAAG,CAAC,iBAAA,EAAmB,CAAC,EAAEH,KAAAA,CAAM,EAAE,CAAC,CAAA;AACzC,KAAA;AACF;;;;"}

package/dist/middlewares/responses.js

@@ -0,0 +1,17 @@
+'use strict';
+
+var fp = require('lodash/fp');
+
+const responses = (config = {})=>{
+    return async (ctx, next)=>{
+        await next();
+        const { status } = ctx;
+        const handler = config?.handlers?.[status];
+        if (fp.isFunction(handler)) {
+            await handler(ctx, next);
+        }
+    };
+};
+
+exports.responses = responses;
+//# sourceMappingURL=responses.js.map

package/dist/middlewares/responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.js","sources":["../../src/middlewares/responses.ts"],"sourcesContent":["import { isFunction } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\n\nexport interface Config {\n  handlers?: Record<number, Core.MiddlewareHandler>;\n}\n\nexport const responses: Core.MiddlewareFactory<Config> = (config = {}) => {\n  return async (ctx, next) => {\n    await next();\n\n    const { status } = ctx;\n    const handler = config?.handlers?.[status];\n\n    if (isFunction(handler)) {\n      await handler(ctx, next);\n    }\n  };\n};\n"],"names":["responses","config","ctx","next","status","handler","handlers","isFunction"],"mappings":";;;;AAOaA,MAAAA,SAAAA,GAA4C,CAACC,MAAAA,GAAS,EAAE,GAAA;AACnE,IAAA,OAAO,OAAOC,GAAKC,EAAAA,IAAAA,GAAAA;QACjB,MAAMA,IAAAA,EAAAA;QAEN,MAAM,EAAEC,MAAM,EAAE,GAAGF,GAAAA;AACnB,QAAA,MAAMG,OAAUJ,GAAAA,MAAAA,EAAQK,QAAU,GAACF,MAAO,CAAA;AAE1C,QAAA,IAAIG,cAAWF,OAAU,CAAA,EAAA;AACvB,YAAA,MAAMA,QAAQH,GAAKC,EAAAA,IAAAA,CAAAA;AACrB;AACF,KAAA;AACF;;;;"}

package/dist/middlewares/responses.mjs

@@ -0,0 +1,15 @@
+import { isFunction } from 'lodash/fp';
+
+const responses = (config = {})=>{
+    return async (ctx, next)=>{
+        await next();
+        const { status } = ctx;
+        const handler = config?.handlers?.[status];
+        if (isFunction(handler)) {
+            await handler(ctx, next);
+        }
+    };
+};
+
+export { responses };
+//# sourceMappingURL=responses.mjs.map

package/dist/middlewares/responses.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.mjs","sources":["../../src/middlewares/responses.ts"],"sourcesContent":["import { isFunction } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\n\nexport interface Config {\n  handlers?: Record<number, Core.MiddlewareHandler>;\n}\n\nexport const responses: Core.MiddlewareFactory<Config> = (config = {}) => {\n  return async (ctx, next) => {\n    await next();\n\n    const { status } = ctx;\n    const handler = config?.handlers?.[status];\n\n    if (isFunction(handler)) {\n      await handler(ctx, next);\n    }\n  };\n};\n"],"names":["responses","config","ctx","next","status","handler","handlers","isFunction"],"mappings":";;AAOaA,MAAAA,SAAAA,GAA4C,CAACC,MAAAA,GAAS,EAAE,GAAA;AACnE,IAAA,OAAO,OAAOC,GAAKC,EAAAA,IAAAA,GAAAA;QACjB,MAAMA,IAAAA,EAAAA;QAEN,MAAM,EAAEC,MAAM,EAAE,GAAGF,GAAAA;AACnB,QAAA,MAAMG,OAAUJ,GAAAA,MAAAA,EAAQK,QAAU,GAACF,MAAO,CAAA;AAE1C,QAAA,IAAIG,WAAWF,OAAU,CAAA,EAAA;AACvB,YAAA,MAAMA,QAAQH,GAAKC,EAAAA,IAAAA,CAAAA;AACrB;AACF,KAAA;AACF;;;;"}

package/dist/middlewares/security.js

@@ -0,0 +1,116 @@
+'use strict';
+
+var fp = require('lodash/fp');
+var helmet = require('koa-helmet');
+
+const defaults = {
+    crossOriginEmbedderPolicy: false,
+    crossOriginOpenerPolicy: false,
+    crossOriginResourcePolicy: false,
+    originAgentCluster: false,
+    contentSecurityPolicy: {
+        useDefaults: true,
+        directives: {
+            'connect-src': [
+                "'self'",
+                'https:'
+            ],
+            'img-src': [
+                "'self'",
+                'data:',
+                'blob:',
+                'https://market-assets.strapi.io'
+            ],
+            'media-src': [
+                "'self'",
+                'data:',
+                'blob:'
+            ],
+            upgradeInsecureRequests: null
+        }
+    },
+    xssFilter: false,
+    hsts: {
+        maxAge: 31536000,
+        includeSubDomains: true
+    },
+    frameguard: {
+        action: 'sameorigin'
+    }
+};
+const mergeConfig = (existingConfig, newConfig)=>{
+    return fp.mergeWith((obj, src)=>Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined, existingConfig, newConfig);
+};
+const security = (config, { strapi })=>(ctx, next)=>{
+        let helmetConfig = fp.defaultsDeep(defaults, config);
+        const specialPaths = [
+            '/documentation'
+        ];
+        const directives = {
+            'script-src': [
+                "'self'",
+                "'unsafe-inline'",
+                'cdn.jsdelivr.net'
+            ],
+            'img-src': [
+                "'self'",
+                'data:',
+                'cdn.jsdelivr.net',
+                'strapi.io'
+            ],
+            'manifest-src': [],
+            'frame-src': []
+        };
+        // if apollo graphql playground is enabled, add exceptions for it
+        if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {
+            const { config: gqlConfig } = strapi.plugin('graphql');
+            specialPaths.push(gqlConfig('endpoint'));
+            directives['script-src'].push(`https: 'unsafe-inline'`);
+            directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);
+            directives['manifest-src'].push(`'self'`);
+            directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');
+            directives['frame-src'].push(`'self'`);
+            directives['frame-src'].push('sandbox.embed.apollographql.com');
+        }
+        // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that
+        if (ctx.method === 'GET' && specialPaths.some((str)=>ctx.path.startsWith(str))) {
+            helmetConfig = mergeConfig(helmetConfig, {
+                crossOriginEmbedderPolicy: false,
+                contentSecurityPolicy: {
+                    directives
+                }
+            });
+        }
+        /**
+     * These are for vite's watch mode so it can accurately
+     * connect to the HMR websocket & reconnect on failure
+     * or when the server restarts.
+     *
+     * It only applies in development, and only on GET requests
+     * that are part of the admin route.
+     */ if ([
+            'development',
+            'test'
+        ].includes(process.env.NODE_ENV ?? '') && ctx.method === 'GET' && ctx.path.startsWith(strapi.config.get('admin.path'))) {
+            helmetConfig = mergeConfig(helmetConfig, {
+                contentSecurityPolicy: {
+                    directives: {
+                        'script-src': [
+                            "'self'",
+                            "'unsafe-inline'"
+                        ],
+                        'connect-src': [
+                            "'self'",
+                            'http:',
+                            'https:',
+                            'ws:'
+                        ]
+                    }
+                }
+            });
+        }
+        return helmet(helmetConfig)(ctx, next);
+    };
+
+exports.security = security;
+//# sourceMappingURL=security.js.map

package/dist/middlewares/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sources":["../../src/middlewares/security.ts"],"sourcesContent":["import { defaultsDeep, mergeWith } from 'lodash/fp';\nimport helmet, { KoaHelmet } from 'koa-helmet';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = NonNullable<Parameters<KoaHelmet>[0]>;\n\nconst defaults: Config = {\n  crossOriginEmbedderPolicy: false,\n  crossOriginOpenerPolicy: false,\n  crossOriginResourcePolicy: false,\n  originAgentCluster: false,\n  contentSecurityPolicy: {\n    useDefaults: true,\n    directives: {\n      'connect-src': [\"'self'\", 'https:'],\n      'img-src': [\"'self'\", 'data:', 'blob:', 'https://market-assets.strapi.io'],\n      'media-src': [\"'self'\", 'data:', 'blob:'],\n      upgradeInsecureRequests: null,\n    },\n  },\n  xssFilter: false,\n  hsts: {\n    maxAge: 31536000,\n    includeSubDomains: true,\n  },\n  frameguard: {\n    action: 'sameorigin',\n  },\n};\n\nconst mergeConfig = (existingConfig: Config, newConfig: Config) => {\n  return mergeWith(\n    (obj, src) => (Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined),\n    existingConfig,\n    newConfig\n  );\n};\n\nexport const security: Core.MiddlewareFactory<Config> =\n  (config, { strapi }) =>\n  (ctx, next) => {\n    let helmetConfig: Config = defaultsDeep(defaults, config);\n\n    const specialPaths = ['/documentation'];\n\n    const directives: {\n      'script-src': string[];\n      'img-src': string[];\n      'manifest-src': string[];\n      'frame-src': string[];\n    } = {\n      'script-src': [\"'self'\", \"'unsafe-inline'\", 'cdn.jsdelivr.net'],\n      'img-src': [\"'self'\", 'data:', 'cdn.jsdelivr.net', 'strapi.io'],\n      'manifest-src': [],\n      'frame-src': [],\n    };\n\n    // if apollo graphql playground is enabled, add exceptions for it\n    if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {\n      const { config: gqlConfig } = strapi.plugin('graphql');\n      specialPaths.push(gqlConfig('endpoint'));\n\n      directives['script-src'].push(`https: 'unsafe-inline'`);\n      directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);\n      directives['manifest-src'].push(`'self'`);\n      directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');\n      directives['frame-src'].push(`'self'`);\n      directives['frame-src'].push('sandbox.embed.apollographql.com');\n    }\n\n    // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that\n    if (ctx.method === 'GET' && specialPaths.some((str) => ctx.path.startsWith(str))) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        crossOriginEmbedderPolicy: false, // TODO: only use this for graphql playground\n        contentSecurityPolicy: {\n          directives,\n        },\n      });\n    }\n\n    /**\n     * These are for vite's watch mode so it can accurately\n     * connect to the HMR websocket & reconnect on failure\n     * or when the server restarts.\n     *\n     * It only applies in development, and only on GET requests\n     * that are part of the admin route.\n     */\n\n    if (\n      ['development', 'test'].includes(process.env.NODE_ENV ?? '') &&\n      ctx.method === 'GET' &&\n      ctx.path.startsWith(strapi.config.get('admin.path'))\n    ) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        contentSecurityPolicy: {\n          directives: {\n            'script-src': [\"'self'\", \"'unsafe-inline'\"],\n            'connect-src': [\"'self'\", 'http:', 'https:', 'ws:'],\n          },\n        },\n      });\n    }\n\n    return helmet(helmetConfig)(ctx, next);\n  };\n"],"names":["defaults","crossOriginEmbedderPolicy","crossOriginOpenerPolicy","crossOriginResourcePolicy","originAgentCluster","contentSecurityPolicy","useDefaults","directives","upgradeInsecureRequests","xssFilter","hsts","maxAge","includeSubDomains","frameguard","action","mergeConfig","existingConfig","newConfig","mergeWith","obj","src","Array","isArray","concat","undefined","security","config","strapi","ctx","next","helmetConfig","defaultsDeep","specialPaths","plugin","service","playground","isEnabled","gqlConfig","push","method","some","str","path","startsWith","includes","process","env","NODE_ENV","get","helmet"],"mappings":";;;;;AAOA,MAAMA,QAAmB,GAAA;IACvBC,yBAA2B,EAAA,KAAA;IAC3BC,uBAAyB,EAAA,KAAA;IACzBC,yBAA2B,EAAA,KAAA;IAC3BC,kBAAoB,EAAA,KAAA;IACpBC,qBAAuB,EAAA;QACrBC,WAAa,EAAA,IAAA;QACbC,UAAY,EAAA;YACV,aAAe,EAAA;AAAC,gBAAA,QAAA;AAAU,gBAAA;AAAS,aAAA;YACnC,SAAW,EAAA;AAAC,gBAAA,QAAA;AAAU,gBAAA,OAAA;AAAS,gBAAA,OAAA;AAAS,gBAAA;AAAkC,aAAA;YAC1E,WAAa,EAAA;AAAC,gBAAA,QAAA;AAAU,gBAAA,OAAA;AAAS,gBAAA;AAAQ,aAAA;YACzCC,uBAAyB,EAAA;AAC3B;AACF,KAAA;IACAC,SAAW,EAAA,KAAA;IACXC,IAAM,EAAA;QACJC,MAAQ,EAAA,QAAA;QACRC,iBAAmB,EAAA;AACrB,KAAA;IACAC,UAAY,EAAA;QACVC,MAAQ,EAAA;AACV;AACF,CAAA;AAEA,MAAMC,WAAAA,GAAc,CAACC,cAAwBC,EAAAA,SAAAA,GAAAA;AAC3C,IAAA,OAAOC,aACL,CAACC,GAAAA,EAAKC,GAASC,GAAAA,KAAAA,CAAMC,OAAO,CAACH,GAAAA,CAAAA,IAAQE,KAAMC,CAAAA,OAAO,CAACF,GAAOD,CAAAA,GAAAA,GAAAA,CAAII,MAAM,CAACH,GAAAA,CAAAA,GAAOI,WAC5ER,cACAC,EAAAA,SAAAA,CAAAA;AAEJ,CAAA;AAEO,MAAMQ,WACX,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,CAACC,GAAKC,EAAAA,IAAAA,GAAAA;QACJ,IAAIC,YAAAA,GAAuBC,gBAAa/B,QAAU0B,EAAAA,MAAAA,CAAAA;AAElD,QAAA,MAAMM,YAAe,GAAA;AAAC,YAAA;AAAiB,SAAA;AAEvC,QAAA,MAAMzB,UAKF,GAAA;YACF,YAAc,EAAA;AAAC,gBAAA,QAAA;AAAU,gBAAA,iBAAA;AAAmB,gBAAA;AAAmB,aAAA;YAC/D,SAAW,EAAA;AAAC,gBAAA,QAAA;AAAU,gBAAA,OAAA;AAAS,gBAAA,kBAAA;AAAoB,gBAAA;AAAY,aAAA;AAC/D,YAAA,cAAA,EAAgB,EAAE;AAClB,YAAA,WAAA,EAAa;AACf,SAAA;;AAGA,QAAA,IAAIoB,OAAOM,MAAM,CAAC,YAAYC,OAAQ,CAAA,OAAA,CAAA,CAASC,WAAWC,SAAa,EAAA,EAAA;AACrE,YAAA,MAAM,EAAEV,MAAQW,EAAAA,SAAS,EAAE,GAAGV,MAAAA,CAAOM,MAAM,CAAC,SAAA,CAAA;YAC5CD,YAAaM,CAAAA,IAAI,CAACD,SAAU,CAAA,UAAA,CAAA,CAAA;AAE5B9B,YAAAA,UAAU,CAAC,YAAa,CAAA,CAAC+B,IAAI,CAAC,CAAC,sBAAsB,CAAC,CAAA;AACtD/B,YAAAA,UAAU,CAAC,SAAU,CAAA,CAAC+B,IAAI,CAAC,CAAC,kDAAkD,CAAC,CAAA;AAC/E/B,YAAAA,UAAU,CAAC,cAAe,CAAA,CAAC+B,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACxC/B,YAAAA,UAAU,CAAC,cAAA,CAAe,CAAC+B,IAAI,CAAC,kDAAA,CAAA;AAChC/B,YAAAA,UAAU,CAAC,WAAY,CAAA,CAAC+B,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACrC/B,YAAAA,UAAU,CAAC,WAAA,CAAY,CAAC+B,IAAI,CAAC,iCAAA,CAAA;AAC/B;;AAGA,QAAA,IAAIV,GAAIW,CAAAA,MAAM,KAAK,KAAA,IAASP,aAAaQ,IAAI,CAAC,CAACC,GAAAA,GAAQb,GAAIc,CAAAA,IAAI,CAACC,UAAU,CAACF,GAAO,CAAA,CAAA,EAAA;AAChFX,YAAAA,YAAAA,GAAef,YAAYe,YAAc,EAAA;gBACvC7B,yBAA2B,EAAA,KAAA;gBAC3BI,qBAAuB,EAAA;AACrBE,oBAAAA;AACF;AACF,aAAA,CAAA;AACF;AAEA;;;;;;;AAOC,QAED,IACE;AAAC,YAAA,aAAA;AAAe,YAAA;SAAO,CAACqC,QAAQ,CAACC,OAAQC,CAAAA,GAAG,CAACC,QAAQ,IAAI,EACzDnB,CAAAA,IAAAA,GAAAA,CAAIW,MAAM,KAAK,SACfX,GAAIc,CAAAA,IAAI,CAACC,UAAU,CAAChB,OAAOD,MAAM,CAACsB,GAAG,CAAC,YACtC,CAAA,CAAA,EAAA;AACAlB,YAAAA,YAAAA,GAAef,YAAYe,YAAc,EAAA;gBACvCzB,qBAAuB,EAAA;oBACrBE,UAAY,EAAA;wBACV,YAAc,EAAA;AAAC,4BAAA,QAAA;AAAU,4BAAA;AAAkB,yBAAA;wBAC3C,aAAe,EAAA;AAAC,4BAAA,QAAA;AAAU,4BAAA,OAAA;AAAS,4BAAA,QAAA;AAAU,4BAAA;AAAM;AACrD;AACF;AACF,aAAA,CAAA;AACF;QAEA,OAAO0C,MAAAA,CAAOnB,cAAcF,GAAKC,EAAAA,IAAAA,CAAAA;;;;;"}

package/dist/middlewares/security.mjs

@@ -0,0 +1,114 @@
+import { defaultsDeep, mergeWith } from 'lodash/fp';
+import helmet from 'koa-helmet';
+
+const defaults = {
+    crossOriginEmbedderPolicy: false,
+    crossOriginOpenerPolicy: false,
+    crossOriginResourcePolicy: false,
+    originAgentCluster: false,
+    contentSecurityPolicy: {
+        useDefaults: true,
+        directives: {
+            'connect-src': [
+                "'self'",
+                'https:'
+            ],
+            'img-src': [
+                "'self'",
+                'data:',
+                'blob:',
+                'https://market-assets.strapi.io'
+            ],
+            'media-src': [
+                "'self'",
+                'data:',
+                'blob:'
+            ],
+            upgradeInsecureRequests: null
+        }
+    },
+    xssFilter: false,
+    hsts: {
+        maxAge: 31536000,
+        includeSubDomains: true
+    },
+    frameguard: {
+        action: 'sameorigin'
+    }
+};
+const mergeConfig = (existingConfig, newConfig)=>{
+    return mergeWith((obj, src)=>Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined, existingConfig, newConfig);
+};
+const security = (config, { strapi })=>(ctx, next)=>{
+        let helmetConfig = defaultsDeep(defaults, config);
+        const specialPaths = [
+            '/documentation'
+        ];
+        const directives = {
+            'script-src': [
+                "'self'",
+                "'unsafe-inline'",
+                'cdn.jsdelivr.net'
+            ],
+            'img-src': [
+                "'self'",
+                'data:',
+                'cdn.jsdelivr.net',
+                'strapi.io'
+            ],
+            'manifest-src': [],
+            'frame-src': []
+        };
+        // if apollo graphql playground is enabled, add exceptions for it
+        if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {
+            const { config: gqlConfig } = strapi.plugin('graphql');
+            specialPaths.push(gqlConfig('endpoint'));
+            directives['script-src'].push(`https: 'unsafe-inline'`);
+            directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);
+            directives['manifest-src'].push(`'self'`);
+            directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');
+            directives['frame-src'].push(`'self'`);
+            directives['frame-src'].push('sandbox.embed.apollographql.com');
+        }
+        // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that
+        if (ctx.method === 'GET' && specialPaths.some((str)=>ctx.path.startsWith(str))) {
+            helmetConfig = mergeConfig(helmetConfig, {
+                crossOriginEmbedderPolicy: false,
+                contentSecurityPolicy: {
+                    directives
+                }
+            });
+        }
+        /**
+     * These are for vite's watch mode so it can accurately
+     * connect to the HMR websocket & reconnect on failure
+     * or when the server restarts.
+     *
+     * It only applies in development, and only on GET requests
+     * that are part of the admin route.
+     */ if ([
+            'development',
+            'test'
+        ].includes(process.env.NODE_ENV ?? '') && ctx.method === 'GET' && ctx.path.startsWith(strapi.config.get('admin.path'))) {
+            helmetConfig = mergeConfig(helmetConfig, {
+                contentSecurityPolicy: {
+                    directives: {
+                        'script-src': [
+                            "'self'",
+                            "'unsafe-inline'"
+                        ],
+                        'connect-src': [
+                            "'self'",
+                            'http:',
+                            'https:',
+                            'ws:'
+                        ]
+                    }
+                }
+            });
+        }
+        return helmet(helmetConfig)(ctx, next);
+    };
+
+export { security };
+//# sourceMappingURL=security.mjs.map

package/dist/middlewares/security.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.mjs","sources":["../../src/middlewares/security.ts"],"sourcesContent":["import { defaultsDeep, mergeWith } from 'lodash/fp';\nimport helmet, { KoaHelmet } from 'koa-helmet';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = NonNullable<Parameters<KoaHelmet>[0]>;\n\nconst defaults: Config = {\n  crossOriginEmbedderPolicy: false,\n  crossOriginOpenerPolicy: false,\n  crossOriginResourcePolicy: false,\n  originAgentCluster: false,\n  contentSecurityPolicy: {\n    useDefaults: true,\n    directives: {\n      'connect-src': [\"'self'\", 'https:'],\n      'img-src': [\"'self'\", 'data:', 'blob:', 'https://market-assets.strapi.io'],\n      'media-src': [\"'self'\", 'data:', 'blob:'],\n      upgradeInsecureRequests: null,\n    },\n  },\n  xssFilter: false,\n  hsts: {\n    maxAge: 31536000,\n    includeSubDomains: true,\n  },\n  frameguard: {\n    action: 'sameorigin',\n  },\n};\n\nconst mergeConfig = (existingConfig: Config, newConfig: Config) => {\n  return mergeWith(\n    (obj, src) => (Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined),\n    existingConfig,\n    newConfig\n  );\n};\n\nexport const security: Core.MiddlewareFactory<Config> =\n  (config, { strapi }) =>\n  (ctx, next) => {\n    let helmetConfig: Config = defaultsDeep(defaults, config);\n\n    const specialPaths = ['/documentation'];\n\n    const directives: {\n      'script-src': string[];\n      'img-src': string[];\n      'manifest-src': string[];\n      'frame-src': string[];\n    } = {\n      'script-src': [\"'self'\", \"'unsafe-inline'\", 'cdn.jsdelivr.net'],\n      'img-src': [\"'self'\", 'data:', 'cdn.jsdelivr.net', 'strapi.io'],\n      'manifest-src': [],\n      'frame-src': [],\n    };\n\n    // if apollo graphql playground is enabled, add exceptions for it\n    if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {\n      const { config: gqlConfig } = strapi.plugin('graphql');\n      specialPaths.push(gqlConfig('endpoint'));\n\n      directives['script-src'].push(`https: 'unsafe-inline'`);\n      directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);\n      directives['manifest-src'].push(`'self'`);\n      directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');\n      directives['frame-src'].push(`'self'`);\n      directives['frame-src'].push('sandbox.embed.apollographql.com');\n    }\n\n    // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that\n    if (ctx.method === 'GET' && specialPaths.some((str) => ctx.path.startsWith(str))) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        crossOriginEmbedderPolicy: false, // TODO: only use this for graphql playground\n        contentSecurityPolicy: {\n          directives,\n        },\n      });\n    }\n\n    /**\n     * These are for vite's watch mode so it can accurately\n     * connect to the HMR websocket & reconnect on failure\n     * or when the server restarts.\n     *\n     * It only applies in development, and only on GET requests\n     * that are part of the admin route.\n     */\n\n    if (\n      ['development', 'test'].includes(process.env.NODE_ENV ?? '') &&\n      ctx.method === 'GET' &&\n      ctx.path.startsWith(strapi.config.get('admin.path'))\n    ) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        contentSecurityPolicy: {\n          directives: {\n            'script-src': [\"'self'\", \"'unsafe-inline'\"],\n            'connect-src': [\"'self'\", 'http:', 'https:', 'ws:'],\n          },\n        },\n      });\n    }\n\n    return helmet(helmetConfig)(ctx, next);\n  };\n"],"names":["defaults","crossOriginEmbedderPolicy","crossOriginOpenerPolicy","crossOriginResourcePolicy","originAgentCluster","contentSecurityPolicy","useDefaults","directives","upgradeInsecureRequests","xssFilter","hsts","maxAge","includeSubDomains","frameguard","action","mergeConfig","existingConfig","newConfig","mergeWith","obj","src","Array","isArray","concat","undefined","security","config","strapi","ctx","next","helmetConfig","defaultsDeep","specialPaths","plugin","service","playground","isEnabled","gqlConfig","push","method","some","str","path","startsWith","includes","process","env","NODE_ENV","get","helmet"],"mappings":";;;AAOA,MAAMA,QAAmB,GAAA;IACvBC,yBAA2B,EAAA,KAAA;IAC3BC,uBAAyB,EAAA,KAAA;IACzBC,yBAA2B,EAAA,KAAA;IAC3BC,kBAAoB,EAAA,KAAA;IACpBC,qBAAuB,EAAA;QACrBC,WAAa,EAAA,IAAA;QACbC,UAAY,EAAA;YACV,aAAe,EAAA;AAAC,gBAAA,QAAA;AAAU,gBAAA;AAAS,aAAA;YACnC,SAAW,EAAA;AAAC,gBAAA,QAAA;AAAU,gBAAA,OAAA;AAAS,gBAAA,OAAA;AAAS,gBAAA;AAAkC,aAAA;YAC1E,WAAa,EAAA;AAAC,gBAAA,QAAA;AAAU,gBAAA,OAAA;AAAS,gBAAA;AAAQ,aAAA;YACzCC,uBAAyB,EAAA;AAC3B;AACF,KAAA;IACAC,SAAW,EAAA,KAAA;IACXC,IAAM,EAAA;QACJC,MAAQ,EAAA,QAAA;QACRC,iBAAmB,EAAA;AACrB,KAAA;IACAC,UAAY,EAAA;QACVC,MAAQ,EAAA;AACV;AACF,CAAA;AAEA,MAAMC,WAAAA,GAAc,CAACC,cAAwBC,EAAAA,SAAAA,GAAAA;AAC3C,IAAA,OAAOC,UACL,CAACC,GAAAA,EAAKC,GAASC,GAAAA,KAAAA,CAAMC,OAAO,CAACH,GAAAA,CAAAA,IAAQE,KAAMC,CAAAA,OAAO,CAACF,GAAOD,CAAAA,GAAAA,GAAAA,CAAII,MAAM,CAACH,GAAAA,CAAAA,GAAOI,WAC5ER,cACAC,EAAAA,SAAAA,CAAAA;AAEJ,CAAA;AAEO,MAAMQ,WACX,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,CAACC,GAAKC,EAAAA,IAAAA,GAAAA;QACJ,IAAIC,YAAAA,GAAuBC,aAAa/B,QAAU0B,EAAAA,MAAAA,CAAAA;AAElD,QAAA,MAAMM,YAAe,GAAA;AAAC,YAAA;AAAiB,SAAA;AAEvC,QAAA,MAAMzB,UAKF,GAAA;YACF,YAAc,EAAA;AAAC,gBAAA,QAAA;AAAU,gBAAA,iBAAA;AAAmB,gBAAA;AAAmB,aAAA;YAC/D,SAAW,EAAA;AAAC,gBAAA,QAAA;AAAU,gBAAA,OAAA;AAAS,gBAAA,kBAAA;AAAoB,gBAAA;AAAY,aAAA;AAC/D,YAAA,cAAA,EAAgB,EAAE;AAClB,YAAA,WAAA,EAAa;AACf,SAAA;;AAGA,QAAA,IAAIoB,OAAOM,MAAM,CAAC,YAAYC,OAAQ,CAAA,OAAA,CAAA,CAASC,WAAWC,SAAa,EAAA,EAAA;AACrE,YAAA,MAAM,EAAEV,MAAQW,EAAAA,SAAS,EAAE,GAAGV,MAAAA,CAAOM,MAAM,CAAC,SAAA,CAAA;YAC5CD,YAAaM,CAAAA,IAAI,CAACD,SAAU,CAAA,UAAA,CAAA,CAAA;AAE5B9B,YAAAA,UAAU,CAAC,YAAa,CAAA,CAAC+B,IAAI,CAAC,CAAC,sBAAsB,CAAC,CAAA;AACtD/B,YAAAA,UAAU,CAAC,SAAU,CAAA,CAAC+B,IAAI,CAAC,CAAC,kDAAkD,CAAC,CAAA;AAC/E/B,YAAAA,UAAU,CAAC,cAAe,CAAA,CAAC+B,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACxC/B,YAAAA,UAAU,CAAC,cAAA,CAAe,CAAC+B,IAAI,CAAC,kDAAA,CAAA;AAChC/B,YAAAA,UAAU,CAAC,WAAY,CAAA,CAAC+B,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACrC/B,YAAAA,UAAU,CAAC,WAAA,CAAY,CAAC+B,IAAI,CAAC,iCAAA,CAAA;AAC/B;;AAGA,QAAA,IAAIV,GAAIW,CAAAA,MAAM,KAAK,KAAA,IAASP,aAAaQ,IAAI,CAAC,CAACC,GAAAA,GAAQb,GAAIc,CAAAA,IAAI,CAACC,UAAU,CAACF,GAAO,CAAA,CAAA,EAAA;AAChFX,YAAAA,YAAAA,GAAef,YAAYe,YAAc,EAAA;gBACvC7B,yBAA2B,EAAA,KAAA;gBAC3BI,qBAAuB,EAAA;AACrBE,oBAAAA;AACF;AACF,aAAA,CAAA;AACF;AAEA;;;;;;;AAOC,QAED,IACE;AAAC,YAAA,aAAA;AAAe,YAAA;SAAO,CAACqC,QAAQ,CAACC,OAAQC,CAAAA,GAAG,CAACC,QAAQ,IAAI,EACzDnB,CAAAA,IAAAA,GAAAA,CAAIW,MAAM,KAAK,SACfX,GAAIc,CAAAA,IAAI,CAACC,UAAU,CAAChB,OAAOD,MAAM,CAACsB,GAAG,CAAC,YACtC,CAAA,CAAA,EAAA;AACAlB,YAAAA,YAAAA,GAAef,YAAYe,YAAc,EAAA;gBACvCzB,qBAAuB,EAAA;oBACrBE,UAAY,EAAA;wBACV,YAAc,EAAA;AAAC,4BAAA,QAAA;AAAU,4BAAA;AAAkB,yBAAA;wBAC3C,aAAe,EAAA;AAAC,4BAAA,QAAA;AAAU,4BAAA,OAAA;AAAS,4BAAA,QAAA;AAAU,4BAAA;AAAM;AACrD;AACF;AACF,aAAA,CAAA;AACF;QAEA,OAAO0C,MAAAA,CAAOnB,cAAcF,GAAKC,EAAAA,IAAAA,CAAAA;;;;;"}

package/dist/middlewares/session.js

@@ -0,0 +1,31 @@
+'use strict';
+
+var fp = require('lodash/fp');
+var koaSession = require('koa-session');
+
+const defaultConfig = {
+    key: 'koa.sess',
+    maxAge: 86400000,
+    autoCommit: true,
+    overwrite: true,
+    httpOnly: true,
+    signed: true,
+    rolling: false,
+    renew: false,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: undefined
+};
+const session = (userConfig, { strapi })=>{
+    const { keys } = strapi.server.app;
+    if (!fp.isArray(keys) || fp.isEmpty(keys) || keys.some(fp.isEmpty)) {
+        throw new Error(`App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`);
+    }
+    const config = {
+        ...defaultConfig,
+        ...userConfig
+    };
+    strapi.server.use(koaSession(config, strapi.server.app));
+};
+
+exports.session = session;
+//# sourceMappingURL=session.js.map

package/dist/middlewares/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sources":["../../src/middlewares/session.ts"],"sourcesContent":["import { isEmpty, isArray } from 'lodash/fp';\nimport koaSession from 'koa-session';\nimport type { Core } from '@strapi/types';\n\nconst defaultConfig = {\n  key: 'koa.sess',\n  maxAge: 86400000,\n  autoCommit: true,\n  overwrite: true,\n  httpOnly: true,\n  signed: true,\n  rolling: false,\n  renew: false,\n  secure: process.env.NODE_ENV === 'production',\n  sameSite: undefined,\n};\n\nexport const session: Core.MiddlewareFactory<Partial<koaSession.opts>> = (\n  userConfig,\n  { strapi }\n) => {\n  const { keys } = strapi.server.app;\n  if (!isArray(keys) || isEmpty(keys) || keys.some(isEmpty)) {\n    throw new Error(\n      `App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`\n    );\n  }\n\n  const config: Partial<koaSession.opts> = { ...defaultConfig, ...userConfig };\n\n  strapi.server.use(koaSession(config, strapi.server.app));\n};\n"],"names":["defaultConfig","key","maxAge","autoCommit","overwrite","httpOnly","signed","rolling","renew","secure","process","env","NODE_ENV","sameSite","undefined","session","userConfig","strapi","keys","server","app","isArray","isEmpty","some","Error","config","use","koaSession"],"mappings":";;;;;AAIA,MAAMA,aAAgB,GAAA;IACpBC,GAAK,EAAA,UAAA;IACLC,MAAQ,EAAA,QAAA;IACRC,UAAY,EAAA,IAAA;IACZC,SAAW,EAAA,IAAA;IACXC,QAAU,EAAA,IAAA;IACVC,MAAQ,EAAA,IAAA;IACRC,OAAS,EAAA,KAAA;IACTC,KAAO,EAAA,KAAA;AACPC,IAAAA,MAAAA,EAAQC,OAAQC,CAAAA,GAAG,CAACC,QAAQ,KAAK,YAAA;IACjCC,QAAUC,EAAAA;AACZ,CAAA;MAEaC,OAA4D,GAAA,CACvEC,UACA,EAAA,EAAEC,MAAM,EAAE,GAAA;AAEV,IAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,MAAOE,CAAAA,MAAM,CAACC,GAAG;IAClC,IAAI,CAACC,WAAQH,IAASI,CAAAA,IAAAA,UAAAA,CAAQJ,SAASA,IAAKK,CAAAA,IAAI,CAACD,UAAU,CAAA,EAAA;AACzD,QAAA,MAAM,IAAIE,KAAAA,CACR,CAAC,+FAA+F,CAAC,CAAA;AAErG;AAEA,IAAA,MAAMC,MAAmC,GAAA;AAAE,QAAA,GAAGzB,aAAa;AAAE,QAAA,GAAGgB;AAAW,KAAA;IAE3EC,MAAOE,CAAAA,MAAM,CAACO,GAAG,CAACC,WAAWF,MAAQR,EAAAA,MAAAA,CAAOE,MAAM,CAACC,GAAG,CAAA,CAAA;AACxD;;;;"}

package/dist/middlewares/session.mjs

@@ -0,0 +1,29 @@
+import { isArray, isEmpty } from 'lodash/fp';
+import koaSession from 'koa-session';
+
+const defaultConfig = {
+    key: 'koa.sess',
+    maxAge: 86400000,
+    autoCommit: true,
+    overwrite: true,
+    httpOnly: true,
+    signed: true,
+    rolling: false,
+    renew: false,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: undefined
+};
+const session = (userConfig, { strapi })=>{
+    const { keys } = strapi.server.app;
+    if (!isArray(keys) || isEmpty(keys) || keys.some(isEmpty)) {
+        throw new Error(`App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`);
+    }
+    const config = {
+        ...defaultConfig,
+        ...userConfig
+    };
+    strapi.server.use(koaSession(config, strapi.server.app));
+};
+
+export { session };
+//# sourceMappingURL=session.mjs.map

package/dist/middlewares/session.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.mjs","sources":["../../src/middlewares/session.ts"],"sourcesContent":["import { isEmpty, isArray } from 'lodash/fp';\nimport koaSession from 'koa-session';\nimport type { Core } from '@strapi/types';\n\nconst defaultConfig = {\n  key: 'koa.sess',\n  maxAge: 86400000,\n  autoCommit: true,\n  overwrite: true,\n  httpOnly: true,\n  signed: true,\n  rolling: false,\n  renew: false,\n  secure: process.env.NODE_ENV === 'production',\n  sameSite: undefined,\n};\n\nexport const session: Core.MiddlewareFactory<Partial<koaSession.opts>> = (\n  userConfig,\n  { strapi }\n) => {\n  const { keys } = strapi.server.app;\n  if (!isArray(keys) || isEmpty(keys) || keys.some(isEmpty)) {\n    throw new Error(\n      `App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`\n    );\n  }\n\n  const config: Partial<koaSession.opts> = { ...defaultConfig, ...userConfig };\n\n  strapi.server.use(koaSession(config, strapi.server.app));\n};\n"],"names":["defaultConfig","key","maxAge","autoCommit","overwrite","httpOnly","signed","rolling","renew","secure","process","env","NODE_ENV","sameSite","undefined","session","userConfig","strapi","keys","server","app","isArray","isEmpty","some","Error","config","use","koaSession"],"mappings":";;;AAIA,MAAMA,aAAgB,GAAA;IACpBC,GAAK,EAAA,UAAA;IACLC,MAAQ,EAAA,QAAA;IACRC,UAAY,EAAA,IAAA;IACZC,SAAW,EAAA,IAAA;IACXC,QAAU,EAAA,IAAA;IACVC,MAAQ,EAAA,IAAA;IACRC,OAAS,EAAA,KAAA;IACTC,KAAO,EAAA,KAAA;AACPC,IAAAA,MAAAA,EAAQC,OAAQC,CAAAA,GAAG,CAACC,QAAQ,KAAK,YAAA;IACjCC,QAAUC,EAAAA;AACZ,CAAA;MAEaC,OAA4D,GAAA,CACvEC,UACA,EAAA,EAAEC,MAAM,EAAE,GAAA;AAEV,IAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,MAAOE,CAAAA,MAAM,CAACC,GAAG;IAClC,IAAI,CAACC,QAAQH,IAASI,CAAAA,IAAAA,OAAAA,CAAQJ,SAASA,IAAKK,CAAAA,IAAI,CAACD,OAAU,CAAA,EAAA;AACzD,QAAA,MAAM,IAAIE,KAAAA,CACR,CAAC,+FAA+F,CAAC,CAAA;AAErG;AAEA,IAAA,MAAMC,MAAmC,GAAA;AAAE,QAAA,GAAGzB,aAAa;AAAE,QAAA,GAAGgB;AAAW,KAAA;IAE3EC,MAAOE,CAAAA,MAAM,CAACO,GAAG,CAACC,WAAWF,MAAQR,EAAAA,MAAAA,CAAOE,MAAM,CAACC,GAAG,CAAA,CAAA;AACxD;;;;"}

package/dist/migrations/database/5.0.0-discard-drafts.js

@@ -0,0 +1,168 @@
+'use strict';
+
+var strapiUtils = require('@strapi/utils');
+var index = require('../../services/document-service/index.js');
+
+/**
+ * Check if the model has draft and publish enabled.
+ */ const hasDraftAndPublish = async (trx, meta)=>{
+    const hasTable = await trx.schema.hasTable(meta.tableName);
+    if (!hasTable) {
+        return false;
+    }
+    const uid = meta.uid;
+    const model = strapi.getModel(uid);
+    const hasDP = strapiUtils.contentTypes.hasDraftAndPublish(model);
+    if (!hasDP) {
+        return false;
+    }
+    return true;
+};
+/**
+ * Copy all the published entries to draft entries, without it's components, dynamic zones or relations.
+ * This ensures all necessary draft's exist before copying it's relations.
+ */ async function copyPublishedEntriesToDraft({ db, trx, uid }) {
+    // Extract all scalar attributes to use in the insert query
+    const meta = db.metadata.get(uid);
+    // Get scalar attributes that will be copied over the new draft
+    const scalarAttributes = Object.values(meta.attributes).reduce((acc, attribute)=>{
+        if ([
+            'id'
+        ].includes(attribute.columnName)) {
+            return acc;
+        }
+        if (strapiUtils.contentTypes.isScalarAttribute(attribute)) {
+            acc.push(attribute.columnName);
+        }
+        return acc;
+    }, []);
+    /**
+   * Query to copy the published entries into draft entries.
+   *
+   * INSERT INTO tableName (columnName1, columnName2, columnName3, ...)
+   * SELECT columnName1, columnName2, columnName3, ...
+   * FROM tableName
+   */ await trx// INSERT INTO tableName (columnName1, columnName2, columnName3, ...)
+    .into(trx.raw(`?? (${scalarAttributes.map(()=>`??`).join(', ')})`, [
+        meta.tableName,
+        ...scalarAttributes
+    ])).insert((subQb)=>{
+        // SELECT columnName1, columnName2, columnName3, ...
+        subQb.select(...scalarAttributes.map((att)=>{
+            // Override 'publishedAt' and 'updatedAt' attributes
+            if (att === 'published_at') {
+                return trx.raw('NULL as ??', 'published_at');
+            }
+            return att;
+        })).from(meta.tableName)// Only select entries that were published
+        .whereNotNull('published_at');
+    });
+}
+/**
+ * Load a batch of versions to discard.
+ *
+ * Versions with only a draft version will be ignored.
+ * Only versions with a published version (which always have a draft version) will be discarded.
+ */ async function* getBatchToDiscard({ db, trx, uid, defaultBatchSize = 1000 }) {
+    const client = db.config.connection.client;
+    const isSQLite = typeof client === 'string' && [
+        'sqlite',
+        'sqlite3',
+        'better-sqlite3'
+    ].includes(client);
+    // The SQLite documentation states that the maximum number of terms in a
+    // compound SELECT statement is 500 by default.
+    // See: https://www.sqlite.org/limits.html
+    // To ensure a successful migration, we limit the batch size to 500 for SQLite.
+    const batchSize = isSQLite ? Math.min(defaultBatchSize, 500) : defaultBatchSize;
+    let offset = 0;
+    let hasMore = true;
+    while(hasMore){
+        // Look for the published entries to discard
+        const batch = await db.queryBuilder(uid).select([
+            'id',
+            'documentId',
+            'locale'
+        ]).where({
+            publishedAt: {
+                $ne: null
+            }
+        }).limit(batchSize).offset(offset).orderBy('id').transacting(trx).execute();
+        if (batch.length < batchSize) {
+            hasMore = false;
+        }
+        offset += batchSize;
+        yield batch;
+    }
+}
+/**
+ * 2 pass migration to create the draft entries for all the published entries.
+ * And then discard the drafts to copy the relations.
+ */ const migrateUp = async (trx, db)=>{
+    const dpModels = [];
+    for (const meta of db.metadata.values()){
+        const hasDP = await hasDraftAndPublish(trx, meta);
+        if (hasDP) {
+            dpModels.push(meta);
+        }
+    }
+    /**
+   * Create plain draft entries for all the entries that were published.
+   */ for (const model of dpModels){
+        await copyPublishedEntriesToDraft({
+            db,
+            trx,
+            uid: model.uid
+        });
+    }
+    /**
+   * Discard the drafts will copy the relations from the published entries to the newly created drafts.
+   *
+   * Load a batch of entries (batched to prevent loading millions of rows at once ),
+   * and discard them using the document service.
+   *
+   * NOTE: This is using a custom document service without any validations,
+   *       to prevent the migration from failing if users already had invalid data in V4.
+   *       E.g. @see https://github.com/strapi/strapi/issues/21583
+   */ const documentService = index.createDocumentService(strapi, {
+        async validateEntityCreation (_, data) {
+            return data;
+        },
+        async validateEntityUpdate (_, data) {
+            // Data can be partially empty on partial updates
+            // This migration doesn't trigger any update (or partial update),
+            // so it's safe to return the data as is.
+            return data;
+        }
+    });
+    for (const model of dpModels){
+        const discardDraft = async (entry)=>documentService(model.uid).discardDraft({
+                documentId: entry.documentId,
+                locale: entry.locale
+            });
+        for await (const batch of getBatchToDiscard({
+            db,
+            trx,
+            uid: model.uid
+        })){
+            // NOTE: concurrency had to be disabled to prevent a race condition with self-references
+            // TODO: improve performance in a safe way
+            await strapiUtils.async.map(batch, discardDraft, {
+                concurrency: 1
+            });
+        }
+    }
+};
+const discardDocumentDrafts = {
+    name: 'core::5.0.0-discard-drafts',
+    async up (trx, db) {
+        await migrateUp(trx, db);
+    },
+    async down () {
+        throw new Error('not implemented');
+    }
+};
+
+exports.discardDocumentDrafts = discardDocumentDrafts;
+exports.getBatchToDiscard = getBatchToDiscard;
+//# sourceMappingURL=5.0.0-discard-drafts.js.map