@strapi/core 5.48.0 → 5.49.0

package/dist/migrations/first-published-at.js

@@ -3,6 +3,10 @@
 var strapiUtils = require('@strapi/utils');
 var _ = require('lodash');
 
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var ___default = /*#__PURE__*/_interopDefault(_);
+
 const enableFirstPublishedAt = async ({ oldContentTypes, contentTypes })=>{
     if (!oldContentTypes) {
         return;
@@ -22,7 +26,7 @@ const enableFirstPublishedAt = async ({ oldContentTypes, contentTypes })=>{
             const content = await strapi.db.queryBuilder(uid).select('*').transacting(trx).execute();
             // Process content types in pairs: draft and published.
             // If only one exist, which means the value is not published yet and we can ignore it
-            const groupedContent = _.groupBy(content, (item)=>`${item.documentId}-${item.locale}`);
+            const groupedContent = ___default.default.groupBy(content, (item)=>`${item.documentId}-${item.locale}`);
             for (const items of Object.values(groupedContent)){
                 // If there is only one item, which means nothing is published yet for this locale
                 if (items.length <= 1) {

package/dist/migrations/first-published-at.js.map

@@ -1 +1 @@
-{"version":3,"file":"first-published-at.js","sources":["../../src/migrations/first-published-at.ts"],"sourcesContent":["import { contentTypes as contentTypesUtils } from '@strapi/utils';\nimport _ from 'lodash';\nimport { Input } from './draft-publish';\n\ninterface ContentTypeData {\n  id: number;\n  documentId: string;\n  publishedAt: Date;\n  firstPublishedAt: Date;\n  locale: string;\n}\n\nconst enableFirstPublishedAt = async ({ oldContentTypes, contentTypes }: Input) => {\n  if (!oldContentTypes) {\n    return;\n  }\n\n  return strapi.db.transaction(async (trx) => {\n    for (const uid in contentTypes) {\n      if (!oldContentTypes[uid]) {\n        continue;\n      }\n\n      const contentType = contentTypes[uid];\n\n      if (!contentTypesUtils.hasFirstPublishedAtField(contentType)) {\n        continue;\n      }\n\n      if (!contentType.attributes?.firstPublishedAt) {\n        continue;\n      }\n\n      const content: ContentTypeData[] = await strapi.db\n        .queryBuilder(uid)\n        .select('*')\n        .transacting(trx)\n        .execute();\n\n      // Process content types in pairs: draft and published.\n      // If only one exist, which means the value is not published yet and we can ignore it\n      const groupedContent = _.groupBy(content, (item) => `${item.documentId}-${item.locale}`);\n\n      for (const items of Object.values(groupedContent)) {\n        // If there is only one item, which means nothing is published yet for this locale\n        if (items.length <= 1) {\n          continue;\n        }\n\n        // If firstPublishedAt is already present, do not do anything\n        if (items[0].firstPublishedAt != null && items[1].firstPublishedAt != null) {\n          continue;\n        }\n\n        const publishedContent = items.filter((item) => item.publishedAt != null).at(0);\n        if (!publishedContent) {\n          continue;\n        }\n\n        await strapi.db\n          .queryBuilder(uid)\n          .update({\n            firstPublishedAt: new Date(publishedContent.publishedAt),\n          })\n          .where({\n            documentId: publishedContent.documentId,\n            locale: publishedContent.locale,\n          })\n          .transacting(trx)\n          .execute();\n      }\n    }\n  });\n};\n\nexport { enableFirstPublishedAt as enable };\n"],"names":["enableFirstPublishedAt","oldContentTypes","contentTypes","strapi","db","transaction","trx","uid","contentType","contentTypesUtils","hasFirstPublishedAtField","attributes","firstPublishedAt","content","queryBuilder","select","transacting","execute","groupedContent","_","groupBy","item","documentId","locale","items","Object","values","length","publishedContent","filter","publishedAt","at","update","Date","where"],"mappings":";;;;;AAYA,MAAMA,yBAAyB,OAAO,EAAEC,eAAe,EAAEC,YAAY,EAAS,GAAA;AAC5E,IAAA,IAAI,CAACD,eAAAA,EAAiB;AACpB,QAAA;AACF,IAAA;AAEA,IAAA,OAAOE,MAAAA,CAAOC,EAAE,CAACC,WAAW,CAAC,OAAOC,GAAAA,GAAAA;QAClC,IAAK,MAAMC,OAAOL,YAAAA,CAAc;AAC9B,YAAA,IAAI,CAACD,eAAe,CAACM,GAAAA,CAAI,EAAE;AACzB,gBAAA;AACF,YAAA;YAEA,MAAMC,WAAAA,GAAcN,YAAY,CAACK,GAAAA,CAAI;AAErC,YAAA,IAAI,CAACE,wBAAAA,CAAkBC,wBAAwB,CAACF,WAAAA,CAAAA,EAAc;AAC5D,gBAAA;AACF,YAAA;AAEA,YAAA,IAAI,CAACA,WAAAA,CAAYG,UAAU,EAAEC,gBAAAA,EAAkB;AAC7C,gBAAA;AACF,YAAA;AAEA,YAAA,MAAMC,OAAAA,GAA6B,MAAMV,MAAAA,CAAOC,EAAE,CAC/CU,YAAY,CAACP,GAAAA,CAAAA,CACbQ,MAAM,CAAC,GAAA,CAAA,CACPC,WAAW,CAACV,KACZW,OAAO,EAAA;;;AAIV,YAAA,MAAMC,cAAAA,GAAiBC,CAAAA,CAAEC,OAAO,CAACP,SAAS,CAACQ,IAAAA,GAAS,CAAA,EAAGA,IAAAA,CAAKC,UAAU,CAAC,CAAC,EAAED,IAAAA,CAAKE,MAAM,CAAA,CAAE,CAAA;AAEvF,YAAA,KAAK,MAAMC,KAAAA,IAASC,MAAAA,CAAOC,MAAM,CAACR,cAAAA,CAAAA,CAAiB;;gBAEjD,IAAIM,KAAAA,CAAMG,MAAM,IAAI,CAAA,EAAG;AACrB,oBAAA;AACF,gBAAA;;AAGA,gBAAA,IAAIH,KAAK,CAAC,CAAA,CAAE,CAACZ,gBAAgB,IAAI,IAAA,IAAQY,KAAK,CAAC,CAAA,CAAE,CAACZ,gBAAgB,IAAI,IAAA,EAAM;AAC1E,oBAAA;AACF,gBAAA;gBAEA,MAAMgB,gBAAAA,GAAmBJ,KAAAA,CAAMK,MAAM,CAAC,CAACR,IAAAA,GAASA,IAAAA,CAAKS,WAAW,IAAI,IAAA,CAAA,CAAMC,EAAE,CAAC,CAAA,CAAA;AAC7E,gBAAA,IAAI,CAACH,gBAAAA,EAAkB;AACrB,oBAAA;AACF,gBAAA;AAEA,gBAAA,MAAMzB,OAAOC,EAAE,CACZU,YAAY,CAACP,GAAAA,CAAAA,CACbyB,MAAM,CAAC;oBACNpB,gBAAAA,EAAkB,IAAIqB,IAAAA,CAAKL,gBAAAA,CAAiBE,WAAW;AACzD,iBAAA,CAAA,CACCI,KAAK,CAAC;AACLZ,oBAAAA,UAAAA,EAAYM,iBAAiBN,UAAU;AACvCC,oBAAAA,MAAAA,EAAQK,iBAAiBL;iBAC3B,CAAA,CACCP,WAAW,CAACV,GAAAA,CAAAA,CACZW,OAAO,EAAA;AACZ,YAAA;AACF,QAAA;AACF,IAAA,CAAA,CAAA;AACF;;;;"}
+{"version":3,"file":"first-published-at.js","sources":["../../src/migrations/first-published-at.ts"],"sourcesContent":["import { contentTypes as contentTypesUtils } from '@strapi/utils';\nimport _ from 'lodash';\nimport { Input } from './draft-publish';\n\ninterface ContentTypeData {\n  id: number;\n  documentId: string;\n  publishedAt: Date;\n  firstPublishedAt: Date;\n  locale: string;\n}\n\nconst enableFirstPublishedAt = async ({ oldContentTypes, contentTypes }: Input) => {\n  if (!oldContentTypes) {\n    return;\n  }\n\n  return strapi.db.transaction(async (trx) => {\n    for (const uid in contentTypes) {\n      if (!oldContentTypes[uid]) {\n        continue;\n      }\n\n      const contentType = contentTypes[uid];\n\n      if (!contentTypesUtils.hasFirstPublishedAtField(contentType)) {\n        continue;\n      }\n\n      if (!contentType.attributes?.firstPublishedAt) {\n        continue;\n      }\n\n      const content: ContentTypeData[] = await strapi.db\n        .queryBuilder(uid)\n        .select('*')\n        .transacting(trx)\n        .execute();\n\n      // Process content types in pairs: draft and published.\n      // If only one exist, which means the value is not published yet and we can ignore it\n      const groupedContent = _.groupBy(content, (item) => `${item.documentId}-${item.locale}`);\n\n      for (const items of Object.values(groupedContent)) {\n        // If there is only one item, which means nothing is published yet for this locale\n        if (items.length <= 1) {\n          continue;\n        }\n\n        // If firstPublishedAt is already present, do not do anything\n        if (items[0].firstPublishedAt != null && items[1].firstPublishedAt != null) {\n          continue;\n        }\n\n        const publishedContent = items.filter((item) => item.publishedAt != null).at(0);\n        if (!publishedContent) {\n          continue;\n        }\n\n        await strapi.db\n          .queryBuilder(uid)\n          .update({\n            firstPublishedAt: new Date(publishedContent.publishedAt),\n          })\n          .where({\n            documentId: publishedContent.documentId,\n            locale: publishedContent.locale,\n          })\n          .transacting(trx)\n          .execute();\n      }\n    }\n  });\n};\n\nexport { enableFirstPublishedAt as enable };\n"],"names":["enableFirstPublishedAt","oldContentTypes","contentTypes","strapi","db","transaction","trx","uid","contentType","contentTypesUtils","hasFirstPublishedAtField","attributes","firstPublishedAt","content","queryBuilder","select","transacting","execute","groupedContent","_","groupBy","item","documentId","locale","items","Object","values","length","publishedContent","filter","publishedAt","at","update","Date","where"],"mappings":";;;;;;;;;AAYA,MAAMA,yBAAyB,OAAO,EAAEC,eAAe,EAAEC,YAAY,EAAS,GAAA;AAC5E,IAAA,IAAI,CAACD,eAAAA,EAAiB;AACpB,QAAA;AACF,IAAA;AAEA,IAAA,OAAOE,MAAAA,CAAOC,EAAE,CAACC,WAAW,CAAC,OAAOC,GAAAA,GAAAA;QAClC,IAAK,MAAMC,OAAOL,YAAAA,CAAc;AAC9B,YAAA,IAAI,CAACD,eAAe,CAACM,GAAAA,CAAI,EAAE;AACzB,gBAAA;AACF,YAAA;YAEA,MAAMC,WAAAA,GAAcN,YAAY,CAACK,GAAAA,CAAI;AAErC,YAAA,IAAI,CAACE,wBAAAA,CAAkBC,wBAAwB,CAACF,WAAAA,CAAAA,EAAc;AAC5D,gBAAA;AACF,YAAA;AAEA,YAAA,IAAI,CAACA,WAAAA,CAAYG,UAAU,EAAEC,gBAAAA,EAAkB;AAC7C,gBAAA;AACF,YAAA;AAEA,YAAA,MAAMC,OAAAA,GAA6B,MAAMV,MAAAA,CAAOC,EAAE,CAC/CU,YAAY,CAACP,GAAAA,CAAAA,CACbQ,MAAM,CAAC,GAAA,CAAA,CACPC,WAAW,CAACV,KACZW,OAAO,EAAA;;;AAIV,YAAA,MAAMC,cAAAA,GAAiBC,kBAAAA,CAAEC,OAAO,CAACP,SAAS,CAACQ,IAAAA,GAAS,CAAA,EAAGA,IAAAA,CAAKC,UAAU,CAAC,CAAC,EAAED,IAAAA,CAAKE,MAAM,CAAA,CAAE,CAAA;AAEvF,YAAA,KAAK,MAAMC,KAAAA,IAASC,MAAAA,CAAOC,MAAM,CAACR,cAAAA,CAAAA,CAAiB;;gBAEjD,IAAIM,KAAAA,CAAMG,MAAM,IAAI,CAAA,EAAG;AACrB,oBAAA;AACF,gBAAA;;AAGA,gBAAA,IAAIH,KAAK,CAAC,CAAA,CAAE,CAACZ,gBAAgB,IAAI,IAAA,IAAQY,KAAK,CAAC,CAAA,CAAE,CAACZ,gBAAgB,IAAI,IAAA,EAAM;AAC1E,oBAAA;AACF,gBAAA;gBAEA,MAAMgB,gBAAAA,GAAmBJ,KAAAA,CAAMK,MAAM,CAAC,CAACR,IAAAA,GAASA,IAAAA,CAAKS,WAAW,IAAI,IAAA,CAAA,CAAMC,EAAE,CAAC,CAAA,CAAA;AAC7E,gBAAA,IAAI,CAACH,gBAAAA,EAAkB;AACrB,oBAAA;AACF,gBAAA;AAEA,gBAAA,MAAMzB,OAAOC,EAAE,CACZU,YAAY,CAACP,GAAAA,CAAAA,CACbyB,MAAM,CAAC;oBACNpB,gBAAAA,EAAkB,IAAIqB,IAAAA,CAAKL,gBAAAA,CAAiBE,WAAW;AACzD,iBAAA,CAAA,CACCI,KAAK,CAAC;AACLZ,oBAAAA,UAAAA,EAAYM,iBAAiBN,UAAU;AACvCC,oBAAAA,MAAAA,EAAQK,iBAAiBL;iBAC3B,CAAA,CACCP,WAAW,CAACV,GAAAA,CAAAA,CACZW,OAAO,EAAA;AACZ,YAAA;AACF,QAAA;AACF,IAAA,CAAA,CAAA;AACF;;;;"}

package/dist/package.json.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var name = "@strapi/core";
-var version = "5.48.0";
+var version = "5.49.0";
 var description = "Core of Strapi";
 var homepage = "https://strapi.io";
 var bugs = {
@@ -64,15 +64,15 @@ var dependencies = {
     "@koa/router": "12.0.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@paralleldrive/cuid2": "2.2.2",
-    "@strapi/admin": "5.48.0",
-    "@strapi/database": "5.48.0",
-    "@strapi/generators": "5.48.0",
-    "@strapi/logger": "5.48.0",
-    "@strapi/openapi": "5.48.0",
-    "@strapi/permissions": "5.48.0",
-    "@strapi/types": "5.48.0",
-    "@strapi/typescript-utils": "5.48.0",
-    "@strapi/utils": "5.48.0",
+    "@strapi/admin": "5.49.0",
+    "@strapi/database": "5.49.0",
+    "@strapi/generators": "5.49.0",
+    "@strapi/logger": "5.49.0",
+    "@strapi/openapi": "5.49.0",
+    "@strapi/permissions": "5.49.0",
+    "@strapi/types": "5.49.0",
+    "@strapi/typescript-utils": "5.49.0",
+    "@strapi/utils": "5.49.0",
     "@vercel/stega": "0.1.2",
     bcryptjs: "2.4.3",
     boxen: "5.1.2",
@@ -88,6 +88,7 @@ var dependencies = {
     "fs-extra": "11.3.4",
     glob: "13.0.6",
     "global-agent": "4.1.3",
+    helmet: "6.2.0",
     "http-errors": "2.0.0",
     inquirer: "9.3.8",
     "is-docker": "2.2.1",
@@ -98,23 +99,23 @@ var dependencies = {
     "koa-compose": "4.1.0",
     "koa-compress": "5.1.1",
     "koa-favicon": "2.1.0",
-    "koa-helmet": "7.0.2",
+    "koa-helmet": "7.1.0",
     "koa-ip": "^2.1.3",
     "koa-session": "7.0.2",
     "koa-static": "5.0.0",
     lodash: "4.18.1",
     "mime-types": "2.1.35",
     "node-schedule": "2.1.1",
-    open: "8.4.0",
+    open: "8.4.2",
     ora: "5.4.1",
-    "package-json": "7.0.0",
+    "package-json": "10.0.1",
     "pkg-up": "3.1.0",
     qs: "6.15.2",
     "resolve.exports": "2.0.2",
     semver: "7.7.4",
     statuses: "2.0.1",
     typescript: "5.4.5",
-    undici: "6.25.0",
+    undici: "6.27.0",
     yup: "0.32.9",
     zod: "3.25.67"
 };
@@ -138,14 +139,14 @@ var devDependencies = {
     "@types/node": "24.10.0",
     "@types/node-schedule": "2.1.7",
     "@types/statuses": "2.0.1",
-    "eslint-config-custom": "5.48.0",
+    "eslint-config-custom": "5.49.0",
     supertest: "7.2.2",
-    tsconfig: "5.48.0",
+    tsconfig: "5.49.0",
     vitest: "catalog:",
-    "vitest-config": "5.48.0"
+    "vitest-config": "5.49.0"
 };
 var engines = {
-    node: ">=20.0.0 <=24.x.x",
+    node: ">=20.0.0 <=26.x.x",
     npm: ">=6.0.0"
 };
 var pkg = {

package/dist/package.json.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.json.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"package.json.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/package.json.mjs

@@ -1,5 +1,5 @@
 var name = "@strapi/core";
-var version = "5.48.0";
+var version = "5.49.0";
 var description = "Core of Strapi";
 var homepage = "https://strapi.io";
 var bugs = {
@@ -60,15 +60,15 @@ var dependencies = {
     "@koa/router": "12.0.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@paralleldrive/cuid2": "2.2.2",
-    "@strapi/admin": "5.48.0",
-    "@strapi/database": "5.48.0",
-    "@strapi/generators": "5.48.0",
-    "@strapi/logger": "5.48.0",
-    "@strapi/openapi": "5.48.0",
-    "@strapi/permissions": "5.48.0",
-    "@strapi/types": "5.48.0",
-    "@strapi/typescript-utils": "5.48.0",
-    "@strapi/utils": "5.48.0",
+    "@strapi/admin": "5.49.0",
+    "@strapi/database": "5.49.0",
+    "@strapi/generators": "5.49.0",
+    "@strapi/logger": "5.49.0",
+    "@strapi/openapi": "5.49.0",
+    "@strapi/permissions": "5.49.0",
+    "@strapi/types": "5.49.0",
+    "@strapi/typescript-utils": "5.49.0",
+    "@strapi/utils": "5.49.0",
     "@vercel/stega": "0.1.2",
     bcryptjs: "2.4.3",
     boxen: "5.1.2",
@@ -84,6 +84,7 @@ var dependencies = {
     "fs-extra": "11.3.4",
     glob: "13.0.6",
     "global-agent": "4.1.3",
+    helmet: "6.2.0",
     "http-errors": "2.0.0",
     inquirer: "9.3.8",
     "is-docker": "2.2.1",
@@ -94,23 +95,23 @@ var dependencies = {
     "koa-compose": "4.1.0",
     "koa-compress": "5.1.1",
     "koa-favicon": "2.1.0",
-    "koa-helmet": "7.0.2",
+    "koa-helmet": "7.1.0",
     "koa-ip": "^2.1.3",
     "koa-session": "7.0.2",
     "koa-static": "5.0.0",
     lodash: "4.18.1",
     "mime-types": "2.1.35",
     "node-schedule": "2.1.1",
-    open: "8.4.0",
+    open: "8.4.2",
     ora: "5.4.1",
-    "package-json": "7.0.0",
+    "package-json": "10.0.1",
     "pkg-up": "3.1.0",
     qs: "6.15.2",
     "resolve.exports": "2.0.2",
     semver: "7.7.4",
     statuses: "2.0.1",
     typescript: "5.4.5",
-    undici: "6.25.0",
+    undici: "6.27.0",
     yup: "0.32.9",
     zod: "3.25.67"
 };
@@ -134,14 +135,14 @@ var devDependencies = {
     "@types/node": "24.10.0",
     "@types/node-schedule": "2.1.7",
     "@types/statuses": "2.0.1",
-    "eslint-config-custom": "5.48.0",
+    "eslint-config-custom": "5.49.0",
     supertest: "7.2.2",
-    tsconfig: "5.48.0",
+    tsconfig: "5.49.0",
     vitest: "catalog:",
-    "vitest-config": "5.48.0"
+    "vitest-config": "5.49.0"
 };
 var engines = {
-    node: ">=20.0.0 <=24.x.x",
+    node: ">=20.0.0 <=26.x.x",
     npm: ">=6.0.0"
 };
 var pkg = {

package/dist/package.json.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"package.json.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"package.json.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/registries/sanitizers.js

@@ -2,22 +2,26 @@
 
 var _ = require('lodash');
 
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var ___default = /*#__PURE__*/_interopDefault(_);
+
 const sanitizersRegistry = ()=>{
     const sanitizers = {};
     return {
         get (path) {
-            return _.get(sanitizers, path, []);
+            return ___default.default.get(sanitizers, path, []);
         },
         add (path, sanitizer) {
             this.get(path).push(sanitizer);
             return this;
         },
         set (path, value = []) {
-            _.set(sanitizers, path, value);
+            ___default.default.set(sanitizers, path, value);
             return this;
         },
         has (path) {
-            return _.has(sanitizers, path);
+            return ___default.default.has(sanitizers, path);
         }
     };
 };

package/dist/registries/sanitizers.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizers.js","sources":["../../src/registries/sanitizers.ts"],"sourcesContent":["import _, { PropertyName } from 'lodash';\n\ntype Sanitizer = (value: unknown) => unknown;\n\nconst sanitizersRegistry = () => {\n  const sanitizers: Record<string, Sanitizer[]> = {};\n\n  return {\n    get(path: PropertyName): Sanitizer[] {\n      return _.get(sanitizers, path, []);\n    },\n\n    add(path: PropertyName, sanitizer: Sanitizer) {\n      this.get(path).push(sanitizer);\n      return this;\n    },\n\n    set(path: PropertyName, value = []) {\n      _.set(sanitizers, path, value);\n      return this;\n    },\n\n    has(path: PropertyName) {\n      return _.has(sanitizers, path);\n    },\n  };\n};\n\nexport default sanitizersRegistry;\n"],"names":["sanitizersRegistry","sanitizers","get","path","_","add","sanitizer","push","set","value","has"],"mappings":";;;;AAIA,MAAMA,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAMC,aAA0C,EAAC;IAEjD,OAAO;AACLC,QAAAA,GAAAA,CAAAA,CAAIC,IAAkB,EAAA;AACpB,YAAA,OAAOC,CAAAA,CAAEF,GAAG,CAACD,UAAAA,EAAYE,MAAM,EAAE,CAAA;AACnC,QAAA,CAAA;QAEAE,GAAAA,CAAAA,CAAIF,IAAkB,EAAEG,SAAoB,EAAA;AAC1C,YAAA,IAAI,CAACJ,GAAG,CAACC,IAAAA,CAAAA,CAAMI,IAAI,CAACD,SAAAA,CAAAA;AACpB,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;QAEAE,GAAAA,CAAAA,CAAIL,IAAkB,EAAEM,KAAAA,GAAQ,EAAE,EAAA;YAChCL,CAAAA,CAAEI,GAAG,CAACP,UAAAA,EAAYE,IAAAA,EAAMM,KAAAA,CAAAA;AACxB,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;AAEAC,QAAAA,GAAAA,CAAAA,CAAIP,IAAkB,EAAA;YACpB,OAAOC,CAAAA,CAAEM,GAAG,CAACT,UAAAA,EAAYE,IAAAA,CAAAA;AAC3B,QAAA;AACF,KAAA;AACF;;;;"}
+{"version":3,"file":"sanitizers.js","sources":["../../src/registries/sanitizers.ts"],"sourcesContent":["import _, { PropertyName } from 'lodash';\n\ntype Sanitizer = (value: unknown) => unknown;\n\nconst sanitizersRegistry = () => {\n  const sanitizers: Record<string, Sanitizer[]> = {};\n\n  return {\n    get(path: PropertyName): Sanitizer[] {\n      return _.get(sanitizers, path, []);\n    },\n\n    add(path: PropertyName, sanitizer: Sanitizer) {\n      this.get(path).push(sanitizer);\n      return this;\n    },\n\n    set(path: PropertyName, value = []) {\n      _.set(sanitizers, path, value);\n      return this;\n    },\n\n    has(path: PropertyName) {\n      return _.has(sanitizers, path);\n    },\n  };\n};\n\nexport default sanitizersRegistry;\n"],"names":["sanitizersRegistry","sanitizers","get","path","_","add","sanitizer","push","set","value","has"],"mappings":";;;;;;;;AAIA,MAAMA,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAMC,aAA0C,EAAC;IAEjD,OAAO;AACLC,QAAAA,GAAAA,CAAAA,CAAIC,IAAkB,EAAA;AACpB,YAAA,OAAOC,kBAAAA,CAAEF,GAAG,CAACD,UAAAA,EAAYE,MAAM,EAAE,CAAA;AACnC,QAAA,CAAA;QAEAE,GAAAA,CAAAA,CAAIF,IAAkB,EAAEG,SAAoB,EAAA;AAC1C,YAAA,IAAI,CAACJ,GAAG,CAACC,IAAAA,CAAAA,CAAMI,IAAI,CAACD,SAAAA,CAAAA;AACpB,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;QAEAE,GAAAA,CAAAA,CAAIL,IAAkB,EAAEM,KAAAA,GAAQ,EAAE,EAAA;YAChCL,kBAAAA,CAAEI,GAAG,CAACP,UAAAA,EAAYE,IAAAA,EAAMM,KAAAA,CAAAA;AACxB,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;AAEAC,QAAAA,GAAAA,CAAAA,CAAIP,IAAkB,EAAA;YACpB,OAAOC,kBAAAA,CAAEM,GAAG,CAACT,UAAAA,EAAYE,IAAAA,CAAAA;AAC3B,QAAA;AACF,KAAA;AACF;;;;"}

package/dist/registries/validators.js

@@ -2,22 +2,26 @@
 
 var _ = require('lodash');
 
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var ___default = /*#__PURE__*/_interopDefault(_);
+
 const validatorsRegistry = ()=>{
     const validators = {};
     return {
         get (path) {
-            return _.get(validators, path, []);
+            return ___default.default.get(validators, path, []);
         },
         add (path, validator) {
             this.get(path).push(validator);
             return this;
         },
         set (path, value = []) {
-            _.set(validators, path, value);
+            ___default.default.set(validators, path, value);
             return this;
         },
         has (path) {
-            return _.has(validators, path);
+            return ___default.default.has(validators, path);
         }
     };
 };

package/dist/registries/validators.js.map

@@ -1 +1 @@
-{"version":3,"file":"validators.js","sources":["../../src/registries/validators.ts"],"sourcesContent":["import _, { PropertyName } from 'lodash';\n\ntype Validator = unknown;\n\nconst validatorsRegistry = () => {\n  const validators: Record<string, Validator[]> = {};\n\n  return {\n    get(path: PropertyName): Validator[] {\n      return _.get(validators, path, []);\n    },\n\n    add(path: PropertyName, validator: Validator) {\n      this.get(path).push(validator);\n      return this;\n    },\n\n    set(path: PropertyName, value = []) {\n      _.set(validators, path, value);\n      return this;\n    },\n\n    has(path: PropertyName) {\n      return _.has(validators, path);\n    },\n  };\n};\n\nexport default validatorsRegistry;\n"],"names":["validatorsRegistry","validators","get","path","_","add","validator","push","set","value","has"],"mappings":";;;;AAIA,MAAMA,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAMC,aAA0C,EAAC;IAEjD,OAAO;AACLC,QAAAA,GAAAA,CAAAA,CAAIC,IAAkB,EAAA;AACpB,YAAA,OAAOC,CAAAA,CAAEF,GAAG,CAACD,UAAAA,EAAYE,MAAM,EAAE,CAAA;AACnC,QAAA,CAAA;QAEAE,GAAAA,CAAAA,CAAIF,IAAkB,EAAEG,SAAoB,EAAA;AAC1C,YAAA,IAAI,CAACJ,GAAG,CAACC,IAAAA,CAAAA,CAAMI,IAAI,CAACD,SAAAA,CAAAA;AACpB,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;QAEAE,GAAAA,CAAAA,CAAIL,IAAkB,EAAEM,KAAAA,GAAQ,EAAE,EAAA;YAChCL,CAAAA,CAAEI,GAAG,CAACP,UAAAA,EAAYE,IAAAA,EAAMM,KAAAA,CAAAA;AACxB,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;AAEAC,QAAAA,GAAAA,CAAAA,CAAIP,IAAkB,EAAA;YACpB,OAAOC,CAAAA,CAAEM,GAAG,CAACT,UAAAA,EAAYE,IAAAA,CAAAA;AAC3B,QAAA;AACF,KAAA;AACF;;;;"}
+{"version":3,"file":"validators.js","sources":["../../src/registries/validators.ts"],"sourcesContent":["import _, { PropertyName } from 'lodash';\n\ntype Validator = unknown;\n\nconst validatorsRegistry = () => {\n  const validators: Record<string, Validator[]> = {};\n\n  return {\n    get(path: PropertyName): Validator[] {\n      return _.get(validators, path, []);\n    },\n\n    add(path: PropertyName, validator: Validator) {\n      this.get(path).push(validator);\n      return this;\n    },\n\n    set(path: PropertyName, value = []) {\n      _.set(validators, path, value);\n      return this;\n    },\n\n    has(path: PropertyName) {\n      return _.has(validators, path);\n    },\n  };\n};\n\nexport default validatorsRegistry;\n"],"names":["validatorsRegistry","validators","get","path","_","add","validator","push","set","value","has"],"mappings":";;;;;;;;AAIA,MAAMA,kBAAAA,GAAqB,IAAA;AACzB,IAAA,MAAMC,aAA0C,EAAC;IAEjD,OAAO;AACLC,QAAAA,GAAAA,CAAAA,CAAIC,IAAkB,EAAA;AACpB,YAAA,OAAOC,kBAAAA,CAAEF,GAAG,CAACD,UAAAA,EAAYE,MAAM,EAAE,CAAA;AACnC,QAAA,CAAA;QAEAE,GAAAA,CAAAA,CAAIF,IAAkB,EAAEG,SAAoB,EAAA;AAC1C,YAAA,IAAI,CAACJ,GAAG,CAACC,IAAAA,CAAAA,CAAMI,IAAI,CAACD,SAAAA,CAAAA;AACpB,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;QAEAE,GAAAA,CAAAA,CAAIL,IAAkB,EAAEM,KAAAA,GAAQ,EAAE,EAAA;YAChCL,kBAAAA,CAAEI,GAAG,CAACP,UAAAA,EAAYE,IAAAA,EAAMM,KAAAA,CAAAA;AACxB,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;AAEAC,QAAAA,GAAAA,CAAAA,CAAIP,IAAkB,EAAA;YACpB,OAAOC,kBAAAA,CAAEM,GAAG,CAACT,UAAAA,EAAYE,IAAAA,CAAAA;AAC3B,QAAA;AACF,KAAA;AACF;;;;"}

package/dist/services/auth/index.js

@@ -4,12 +4,16 @@ var assert = require('assert/strict');
 var fp = require('lodash/fp');
 var strapiUtils = require('@strapi/utils');
 
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var assert__default = /*#__PURE__*/_interopDefault(assert);
+
 const INVALID_STRATEGY_MSG = 'Invalid auth strategy. Expecting an object with properties {name: string, authenticate: function, verify: function}';
 const validStrategy = (strategy)=>{
-    assert(fp.has('authenticate', strategy), INVALID_STRATEGY_MSG);
-    assert(typeof strategy.authenticate === 'function', INVALID_STRATEGY_MSG);
+    assert__default.default(fp.has('authenticate', strategy), INVALID_STRATEGY_MSG);
+    assert__default.default(typeof strategy.authenticate === 'function', INVALID_STRATEGY_MSG);
     if (fp.has('verify', strategy)) {
-        assert(typeof strategy.verify === 'function', INVALID_STRATEGY_MSG);
+        assert__default.default(typeof strategy.verify === 'function', INVALID_STRATEGY_MSG);
     }
 };
 const createAuthentication = ()=>{

package/dist/services/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../src/services/auth/index.ts"],"sourcesContent":["import assert from 'assert/strict';\nimport { has } from 'lodash/fp';\n\nimport { errors } from '@strapi/utils';\nimport type { Core } from '@strapi/types';\nimport type { ParameterizedContext } from 'koa';\n\ninterface AuthenticationResponse {\n  authenticated?: boolean;\n  credentials?: unknown;\n  ability?: unknown;\n  error?: Error | null;\n}\n\ninterface AuthenticationInfo {\n  strategy: Strategy;\n  credentials: unknown;\n  ability: unknown;\n}\n\ninterface Strategy {\n  name: string;\n  authenticate: (ctx: ParameterizedContext) => Promise<AuthenticationResponse>;\n  verify?: (auth: AuthenticationInfo, config: Core.RouteConfig['auth']) => Promise<any>;\n}\n\ninterface Authentication {\n  register: (type: string, strategy: Strategy) => Authentication;\n  authenticate: Core.MiddlewareHandler;\n  verify: (auth: AuthenticationInfo, config?: Core.RouteConfig['auth']) => Promise<any>;\n}\n\nconst INVALID_STRATEGY_MSG =\n  'Invalid auth strategy. Expecting an object with properties {name: string, authenticate: function, verify: function}';\n\nconst validStrategy = (strategy: Strategy) => {\n  assert(has('authenticate', strategy), INVALID_STRATEGY_MSG);\n  assert(typeof strategy.authenticate === 'function', INVALID_STRATEGY_MSG);\n\n  if (has('verify', strategy)) {\n    assert(typeof strategy.verify === 'function', INVALID_STRATEGY_MSG);\n  }\n};\n\nconst createAuthentication = (): Authentication => {\n  const strategies: Record<string, Strategy[]> = {};\n\n  return {\n    register(type, strategy) {\n      validStrategy(strategy);\n\n      if (!strategies[type]) {\n        strategies[type] = [];\n      }\n\n      strategies[type].push(strategy);\n\n      return this;\n    },\n\n    async authenticate(ctx, next) {\n      const route: Core.Route = ctx.state.route;\n\n      // use route strategy\n      const config = route?.config?.auth;\n\n      if (config === false) {\n        return next();\n      }\n\n      const routeStrategies = route.info.type ? strategies[route.info.type] : [];\n      const configStrategies = (config?.strategies ?? routeStrategies ?? []) as Array<\n        string | Strategy\n      >;\n\n      const strategiesToUse: Strategy[] = configStrategies.reduce(\n        (acc, strategy: string | Strategy) => {\n          // Resolve by strategy name\n          if (typeof strategy === 'string') {\n            const routeStrategy = routeStrategies.find((rs) => rs.name === strategy);\n\n            if (routeStrategy) {\n              acc.push(routeStrategy);\n            }\n          }\n\n          // Use the given strategy as is\n          else if (typeof strategy === 'object') {\n            validStrategy(strategy);\n\n            acc.push(strategy);\n          }\n\n          return acc;\n        },\n        [] as Strategy[]\n      );\n\n      for (const strategy of strategiesToUse) {\n        const result = await strategy.authenticate(ctx);\n\n        const { authenticated = false, credentials, ability = null, error = null } = result || {};\n\n        if (error !== null) {\n          return ctx.unauthorized(error);\n        }\n\n        if (authenticated) {\n          ctx.state.isAuthenticated = true;\n          ctx.state.auth = {\n            strategy,\n            credentials,\n            ability,\n          };\n\n          return next();\n        }\n      }\n\n      return ctx.unauthorized('Missing or invalid credentials');\n    },\n\n    async verify(auth, config = {}) {\n      if (config === false) {\n        return;\n      }\n\n      if (!auth) {\n        throw new errors.UnauthorizedError();\n      }\n\n      if (typeof auth.strategy.verify === 'function') {\n        return auth.strategy.verify(auth, config);\n      }\n    },\n  };\n};\n\nexport default createAuthentication;\n"],"names":["INVALID_STRATEGY_MSG","validStrategy","strategy","assert","has","authenticate","verify","createAuthentication","strategies","register","type","push","ctx","next","route","state","config","auth","routeStrategies","info","configStrategies","strategiesToUse","reduce","acc","routeStrategy","find","rs","name","result","authenticated","credentials","ability","error","unauthorized","isAuthenticated","errors","UnauthorizedError"],"mappings":";;;;;;AAgCA,MAAMA,oBAAAA,GACJ,qHAAA;AAEF,MAAMC,gBAAgB,CAACC,QAAAA,GAAAA;IACrBC,MAAAA,CAAOC,MAAAA,CAAI,gBAAgBF,QAAAA,CAAAA,EAAWF,oBAAAA,CAAAA;AACtCG,IAAAA,MAAAA,CAAO,OAAOD,QAAAA,CAASG,YAAY,KAAK,UAAA,EAAYL,oBAAAA,CAAAA;IAEpD,IAAII,MAAAA,CAAI,UAAUF,QAAAA,CAAAA,EAAW;AAC3BC,QAAAA,MAAAA,CAAO,OAAOD,QAAAA,CAASI,MAAM,KAAK,UAAA,EAAYN,oBAAAA,CAAAA;AAChD,IAAA;AACF,CAAA;AAEA,MAAMO,oBAAAA,GAAuB,IAAA;AAC3B,IAAA,MAAMC,aAAyC,EAAC;IAEhD,OAAO;QACLC,QAAAA,CAAAA,CAASC,IAAI,EAAER,QAAQ,EAAA;YACrBD,aAAAA,CAAcC,QAAAA,CAAAA;AAEd,YAAA,IAAI,CAACM,UAAU,CAACE,IAAAA,CAAK,EAAE;gBACrBF,UAAU,CAACE,IAAAA,CAAK,GAAG,EAAE;AACvB,YAAA;AAEAF,YAAAA,UAAU,CAACE,IAAAA,CAAK,CAACC,IAAI,CAACT,QAAAA,CAAAA;AAEtB,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;QAEA,MAAMG,YAAAA,CAAAA,CAAaO,GAAG,EAAEC,IAAI,EAAA;AAC1B,YAAA,MAAMC,KAAAA,GAAoBF,GAAAA,CAAIG,KAAK,CAACD,KAAK;;YAGzC,MAAME,MAAAA,GAASF,OAAOE,MAAAA,EAAQC,IAAAA;AAE9B,YAAA,IAAID,WAAW,KAAA,EAAO;gBACpB,OAAOH,IAAAA,EAAAA;AACT,YAAA;AAEA,YAAA,MAAMK,eAAAA,GAAkBJ,KAAAA,CAAMK,IAAI,CAACT,IAAI,GAAGF,UAAU,CAACM,KAAAA,CAAMK,IAAI,CAACT,IAAI,CAAC,GAAG,EAAE;AAC1E,YAAA,MAAMU,gBAAAA,GAAoBJ,MAAAA,EAAQR,UAAAA,IAAcU,eAAAA,IAAmB,EAAE;AAIrE,YAAA,MAAMG,eAAAA,GAA8BD,gBAAAA,CAAiBE,MAAM,CACzD,CAACC,GAAAA,EAAKrB,QAAAA,GAAAA;;gBAEJ,IAAI,OAAOA,aAAa,QAAA,EAAU;oBAChC,MAAMsB,aAAAA,GAAgBN,gBAAgBO,IAAI,CAAC,CAACC,EAAAA,GAAOA,EAAAA,CAAGC,IAAI,KAAKzB,QAAAA,CAAAA;AAE/D,oBAAA,IAAIsB,aAAAA,EAAe;AACjBD,wBAAAA,GAAAA,CAAIZ,IAAI,CAACa,aAAAA,CAAAA;AACX,oBAAA;gBACF,CAAA,MAGK,IAAI,OAAOtB,QAAAA,KAAa,QAAA,EAAU;oBACrCD,aAAAA,CAAcC,QAAAA,CAAAA;AAEdqB,oBAAAA,GAAAA,CAAIZ,IAAI,CAACT,QAAAA,CAAAA;AACX,gBAAA;gBAEA,OAAOqB,GAAAA;AACT,YAAA,CAAA,EACA,EAAE,CAAA;YAGJ,KAAK,MAAMrB,YAAYmB,eAAAA,CAAiB;AACtC,gBAAA,MAAMO,MAAAA,GAAS,MAAM1B,QAAAA,CAASG,YAAY,CAACO,GAAAA,CAAAA;AAE3C,gBAAA,MAAM,EAAEiB,aAAAA,GAAgB,KAAK,EAAEC,WAAW,EAAEC,OAAAA,GAAU,IAAI,EAAEC,KAAAA,GAAQ,IAAI,EAAE,GAAGJ,UAAU,EAAC;AAExF,gBAAA,IAAII,UAAU,IAAA,EAAM;oBAClB,OAAOpB,GAAAA,CAAIqB,YAAY,CAACD,KAAAA,CAAAA;AAC1B,gBAAA;AAEA,gBAAA,IAAIH,aAAAA,EAAe;oBACjBjB,GAAAA,CAAIG,KAAK,CAACmB,eAAe,GAAG,IAAA;oBAC5BtB,GAAAA,CAAIG,KAAK,CAACE,IAAI,GAAG;AACff,wBAAAA,QAAAA;AACA4B,wBAAAA,WAAAA;AACAC,wBAAAA;AACF,qBAAA;oBAEA,OAAOlB,IAAAA,EAAAA;AACT,gBAAA;AACF,YAAA;YAEA,OAAOD,GAAAA,CAAIqB,YAAY,CAAC,gCAAA,CAAA;AAC1B,QAAA,CAAA;AAEA,QAAA,MAAM3B,MAAAA,CAAAA,CAAOW,IAAI,EAAED,MAAAA,GAAS,EAAE,EAAA;AAC5B,YAAA,IAAIA,WAAW,KAAA,EAAO;AACpB,gBAAA;AACF,YAAA;AAEA,YAAA,IAAI,CAACC,IAAAA,EAAM;gBACT,MAAM,IAAIkB,mBAAOC,iBAAiB,EAAA;AACpC,YAAA;AAEA,YAAA,IAAI,OAAOnB,IAAAA,CAAKf,QAAQ,CAACI,MAAM,KAAK,UAAA,EAAY;AAC9C,gBAAA,OAAOW,IAAAA,CAAKf,QAAQ,CAACI,MAAM,CAACW,IAAAA,EAAMD,MAAAA,CAAAA;AACpC,YAAA;AACF,QAAA;AACF,KAAA;AACF;;;;"}
+{"version":3,"file":"index.js","sources":["../../../src/services/auth/index.ts"],"sourcesContent":["import assert from 'assert/strict';\nimport { has } from 'lodash/fp';\n\nimport { errors } from '@strapi/utils';\nimport type { Core } from '@strapi/types';\nimport type { ParameterizedContext } from 'koa';\n\ninterface AuthenticationResponse {\n  authenticated?: boolean;\n  credentials?: unknown;\n  ability?: unknown;\n  error?: Error | null;\n}\n\ninterface AuthenticationInfo {\n  strategy: Strategy;\n  credentials: unknown;\n  ability: unknown;\n}\n\ninterface Strategy {\n  name: string;\n  authenticate: (ctx: ParameterizedContext) => Promise<AuthenticationResponse>;\n  verify?: (auth: AuthenticationInfo, config: Core.RouteConfig['auth']) => Promise<any>;\n}\n\ninterface Authentication {\n  register: (type: string, strategy: Strategy) => Authentication;\n  authenticate: Core.MiddlewareHandler;\n  verify: (auth: AuthenticationInfo, config?: Core.RouteConfig['auth']) => Promise<any>;\n}\n\nconst INVALID_STRATEGY_MSG =\n  'Invalid auth strategy. Expecting an object with properties {name: string, authenticate: function, verify: function}';\n\nconst validStrategy = (strategy: Strategy) => {\n  assert(has('authenticate', strategy), INVALID_STRATEGY_MSG);\n  assert(typeof strategy.authenticate === 'function', INVALID_STRATEGY_MSG);\n\n  if (has('verify', strategy)) {\n    assert(typeof strategy.verify === 'function', INVALID_STRATEGY_MSG);\n  }\n};\n\nconst createAuthentication = (): Authentication => {\n  const strategies: Record<string, Strategy[]> = {};\n\n  return {\n    register(type, strategy) {\n      validStrategy(strategy);\n\n      if (!strategies[type]) {\n        strategies[type] = [];\n      }\n\n      strategies[type].push(strategy);\n\n      return this;\n    },\n\n    async authenticate(ctx, next) {\n      const route: Core.Route = ctx.state.route;\n\n      // use route strategy\n      const config = route?.config?.auth;\n\n      if (config === false) {\n        return next();\n      }\n\n      const routeStrategies = route.info.type ? strategies[route.info.type] : [];\n      const configStrategies = (config?.strategies ?? routeStrategies ?? []) as Array<\n        string | Strategy\n      >;\n\n      const strategiesToUse: Strategy[] = configStrategies.reduce(\n        (acc, strategy: string | Strategy) => {\n          // Resolve by strategy name\n          if (typeof strategy === 'string') {\n            const routeStrategy = routeStrategies.find((rs) => rs.name === strategy);\n\n            if (routeStrategy) {\n              acc.push(routeStrategy);\n            }\n          }\n\n          // Use the given strategy as is\n          else if (typeof strategy === 'object') {\n            validStrategy(strategy);\n\n            acc.push(strategy);\n          }\n\n          return acc;\n        },\n        [] as Strategy[]\n      );\n\n      for (const strategy of strategiesToUse) {\n        const result = await strategy.authenticate(ctx);\n\n        const { authenticated = false, credentials, ability = null, error = null } = result || {};\n\n        if (error !== null) {\n          return ctx.unauthorized(error);\n        }\n\n        if (authenticated) {\n          ctx.state.isAuthenticated = true;\n          ctx.state.auth = {\n            strategy,\n            credentials,\n            ability,\n          };\n\n          return next();\n        }\n      }\n\n      return ctx.unauthorized('Missing or invalid credentials');\n    },\n\n    async verify(auth, config = {}) {\n      if (config === false) {\n        return;\n      }\n\n      if (!auth) {\n        throw new errors.UnauthorizedError();\n      }\n\n      if (typeof auth.strategy.verify === 'function') {\n        return auth.strategy.verify(auth, config);\n      }\n    },\n  };\n};\n\nexport default createAuthentication;\n"],"names":["INVALID_STRATEGY_MSG","validStrategy","strategy","assert","has","authenticate","verify","createAuthentication","strategies","register","type","push","ctx","next","route","state","config","auth","routeStrategies","info","configStrategies","strategiesToUse","reduce","acc","routeStrategy","find","rs","name","result","authenticated","credentials","ability","error","unauthorized","isAuthenticated","errors","UnauthorizedError"],"mappings":";;;;;;;;;;AAgCA,MAAMA,oBAAAA,GACJ,qHAAA;AAEF,MAAMC,gBAAgB,CAACC,QAAAA,GAAAA;IACrBC,uBAAAA,CAAOC,MAAAA,CAAI,gBAAgBF,QAAAA,CAAAA,EAAWF,oBAAAA,CAAAA;AACtCG,IAAAA,uBAAAA,CAAO,OAAOD,QAAAA,CAASG,YAAY,KAAK,UAAA,EAAYL,oBAAAA,CAAAA;IAEpD,IAAII,MAAAA,CAAI,UAAUF,QAAAA,CAAAA,EAAW;AAC3BC,QAAAA,uBAAAA,CAAO,OAAOD,QAAAA,CAASI,MAAM,KAAK,UAAA,EAAYN,oBAAAA,CAAAA;AAChD,IAAA;AACF,CAAA;AAEA,MAAMO,oBAAAA,GAAuB,IAAA;AAC3B,IAAA,MAAMC,aAAyC,EAAC;IAEhD,OAAO;QACLC,QAAAA,CAAAA,CAASC,IAAI,EAAER,QAAQ,EAAA;YACrBD,aAAAA,CAAcC,QAAAA,CAAAA;AAEd,YAAA,IAAI,CAACM,UAAU,CAACE,IAAAA,CAAK,EAAE;gBACrBF,UAAU,CAACE,IAAAA,CAAK,GAAG,EAAE;AACvB,YAAA;AAEAF,YAAAA,UAAU,CAACE,IAAAA,CAAK,CAACC,IAAI,CAACT,QAAAA,CAAAA;AAEtB,YAAA,OAAO,IAAI;AACb,QAAA,CAAA;QAEA,MAAMG,YAAAA,CAAAA,CAAaO,GAAG,EAAEC,IAAI,EAAA;AAC1B,YAAA,MAAMC,KAAAA,GAAoBF,GAAAA,CAAIG,KAAK,CAACD,KAAK;;YAGzC,MAAME,MAAAA,GAASF,OAAOE,MAAAA,EAAQC,IAAAA;AAE9B,YAAA,IAAID,WAAW,KAAA,EAAO;gBACpB,OAAOH,IAAAA,EAAAA;AACT,YAAA;AAEA,YAAA,MAAMK,eAAAA,GAAkBJ,KAAAA,CAAMK,IAAI,CAACT,IAAI,GAAGF,UAAU,CAACM,KAAAA,CAAMK,IAAI,CAACT,IAAI,CAAC,GAAG,EAAE;AAC1E,YAAA,MAAMU,gBAAAA,GAAoBJ,MAAAA,EAAQR,UAAAA,IAAcU,eAAAA,IAAmB,EAAE;AAIrE,YAAA,MAAMG,eAAAA,GAA8BD,gBAAAA,CAAiBE,MAAM,CACzD,CAACC,GAAAA,EAAKrB,QAAAA,GAAAA;;gBAEJ,IAAI,OAAOA,aAAa,QAAA,EAAU;oBAChC,MAAMsB,aAAAA,GAAgBN,gBAAgBO,IAAI,CAAC,CAACC,EAAAA,GAAOA,EAAAA,CAAGC,IAAI,KAAKzB,QAAAA,CAAAA;AAE/D,oBAAA,IAAIsB,aAAAA,EAAe;AACjBD,wBAAAA,GAAAA,CAAIZ,IAAI,CAACa,aAAAA,CAAAA;AACX,oBAAA;gBACF,CAAA,MAGK,IAAI,OAAOtB,QAAAA,KAAa,QAAA,EAAU;oBACrCD,aAAAA,CAAcC,QAAAA,CAAAA;AAEdqB,oBAAAA,GAAAA,CAAIZ,IAAI,CAACT,QAAAA,CAAAA;AACX,gBAAA;gBAEA,OAAOqB,GAAAA;AACT,YAAA,CAAA,EACA,EAAE,CAAA;YAGJ,KAAK,MAAMrB,YAAYmB,eAAAA,CAAiB;AACtC,gBAAA,MAAMO,MAAAA,GAAS,MAAM1B,QAAAA,CAASG,YAAY,CAACO,GAAAA,CAAAA;AAE3C,gBAAA,MAAM,EAAEiB,aAAAA,GAAgB,KAAK,EAAEC,WAAW,EAAEC,OAAAA,GAAU,IAAI,EAAEC,KAAAA,GAAQ,IAAI,EAAE,GAAGJ,UAAU,EAAC;AAExF,gBAAA,IAAII,UAAU,IAAA,EAAM;oBAClB,OAAOpB,GAAAA,CAAIqB,YAAY,CAACD,KAAAA,CAAAA;AAC1B,gBAAA;AAEA,gBAAA,IAAIH,aAAAA,EAAe;oBACjBjB,GAAAA,CAAIG,KAAK,CAACmB,eAAe,GAAG,IAAA;oBAC5BtB,GAAAA,CAAIG,KAAK,CAACE,IAAI,GAAG;AACff,wBAAAA,QAAAA;AACA4B,wBAAAA,WAAAA;AACAC,wBAAAA;AACF,qBAAA;oBAEA,OAAOlB,IAAAA,EAAAA;AACT,gBAAA;AACF,YAAA;YAEA,OAAOD,GAAAA,CAAIqB,YAAY,CAAC,gCAAA,CAAA;AAC1B,QAAA,CAAA;AAEA,QAAA,MAAM3B,MAAAA,CAAAA,CAAOW,IAAI,EAAED,MAAAA,GAAS,EAAE,EAAA;AAC5B,YAAA,IAAIA,WAAW,KAAA,EAAO;AACpB,gBAAA;AACF,YAAA;AAEA,YAAA,IAAI,CAACC,IAAAA,EAAM;gBACT,MAAM,IAAIkB,mBAAOC,iBAAiB,EAAA;AACpC,YAAA;AAEA,YAAA,IAAI,OAAOnB,IAAAA,CAAKf,QAAQ,CAACI,MAAM,KAAK,UAAA,EAAY;AAC9C,gBAAA,OAAOW,IAAAA,CAAKf,QAAQ,CAACI,MAAM,CAACW,IAAAA,EAAMD,MAAAA,CAAAA;AACpC,YAAA;AACF,QAAA;AACF,KAAA;AACF;;;;"}

package/dist/services/content-api/index.js

@@ -5,7 +5,10 @@ var strapiUtils = require('@strapi/utils');
 var z = require('zod/v4');
 var index = require('./permissions/index.js');
 
-function _interopNamespaceDefault(e) {
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
   var n = Object.create(null);
   if (e) {
     Object.keys(e).forEach(function (k) {
@@ -22,7 +25,8 @@ function _interopNamespaceDefault(e) {
   return Object.freeze(n);
 }
 
-var z__namespace = /*#__PURE__*/_interopNamespaceDefault(z);
+var ___default = /*#__PURE__*/_interopDefault(_);
+var z__namespace = /*#__PURE__*/_interopNamespace(z);
 
 const transformRoutePrefixFor = (pluginName)=>(route)=>{
         const prefix = route.config && route.config.prefix;
@@ -179,8 +183,8 @@ const mergeOneInputParamIntoRoute = (route, param, schema, matchRoute)=>{
     };
     const getRoutesMap = async ()=>{
         const routesMap = {};
-        _.forEach(strapi.apis, (api, apiName)=>{
-            const routes = _.flatMap(api.routes, (route)=>{
+        ___default.default.forEach(strapi.apis, (api, apiName)=>{
+            const routes = ___default.default.flatMap(api.routes, (route)=>{
                 if ('routes' in route) {
                     return route.routes;
                 }
@@ -195,12 +199,12 @@ const mergeOneInputParamIntoRoute = (route, param, schema, matchRoute)=>{
                     path: `${apiPrefix}${route.path}`
                 }));
         });
-        _.forEach(strapi.plugins, (plugin, pluginName)=>{
+        ___default.default.forEach(strapi.plugins, (plugin, pluginName)=>{
             const transformPrefix = transformRoutePrefixFor(pluginName);
             if (Array.isArray(plugin.routes)) {
                 return plugin.routes.map(transformPrefix).filter(filterContentAPI);
             }
-            const routes = _.flatMap(plugin.routes, (route)=>route.routes.map(transformPrefix)).filter(filterContentAPI);
+            const routes = ___default.default.flatMap(plugin.routes, (route)=>route.routes.map(transformPrefix)).filter(filterContentAPI);
             if (routes.length === 0) {
                 return;
             }

package/dist/services/content-api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../src/services/content-api/index.ts"],"sourcesContent":["import _ from 'lodash';\nimport {\n  sanitize,\n  validate,\n  sanitizeRoutesMapForSerialization,\n  ALLOWED_QUERY_PARAM_KEYS,\n  RESERVED_INPUT_PARAM_KEYS,\n} from '@strapi/utils';\nimport * as z from 'zod/v4';\n\nimport type { Core, Modules, UID } from '@strapi/types';\n\nimport instantiatePermissionsUtilities from './permissions';\n\nconst transformRoutePrefixFor = (pluginName: string) => (route: Core.Route) => {\n  const prefix = route.config && route.config.prefix;\n  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;\n\n  return {\n    ...route,\n    path,\n  };\n};\n\nconst filterContentAPI = (route: Core.Route) => route.info.type === 'content-api';\n\n/**\n * Runtime check for addQueryParams: we only allow scalar or array-of-scalar schemas (no nested objects).\n * We keep this in addition to the ZodQueryParamSchema type because: (1) TypeScript can be bypassed (JS,\n * any, or schema from another Zod instance); (2) it gives a clear, immediate error at registration\n * time instead of a later failure in validate/sanitize. This list is intentionally tied to Zod v4\n * constructor names; if Zod changes internals, this may need updating.\n * Compatibility: Zod 3 and Zod 4 Classic (zod/v4) both use these constructor names and\n * expose ._def with .innerType / .element for Optional/Default/Array. Zod 4 Core/Mini use\n * ._zod.def instead; we only accept schemas from the same zod/v4 instance used here.\n */\nconst ALLOWED_QUERY_SCHEMA_NAMES = new Set([\n  'ZodString',\n  'ZodNumber',\n  'ZodBoolean',\n  'ZodEnum',\n  'ZodOptional',\n  'ZodDefault',\n  'ZodArray',\n]);\n\nfunction assertQueryParamSchema(schema: unknown, param: string): void {\n  const name = (schema as { constructor?: { name?: string } })?.constructor?.name ?? '';\n  if (!ALLOWED_QUERY_SCHEMA_NAMES.has(name)) {\n    throw new Error(\n      `contentAPI.addQueryParams: param \"${param}\" schema must be a scalar (string, number, boolean, enum) or array of scalars; got ${name}. Use addInputParams for nested objects.`\n    );\n  }\n  if (name === 'ZodOptional' || name === 'ZodDefault') {\n    const inner = (schema as { _def?: { innerType?: unknown } })?._def?.innerType;\n    if (inner) assertQueryParamSchema(inner, param);\n    return;\n  }\n  if (name === 'ZodArray') {\n    const element = (schema as { _def?: { element?: unknown } })?._def?.element;\n    if (element) assertQueryParamSchema(element, param);\n  }\n}\n\nfunction resolveSchema<T>(schemaOrFactory: T | ((zInstance: typeof z) => T)): T {\n  if (typeof schemaOrFactory === 'function') {\n    return (schemaOrFactory as (zInstance: typeof z) => T)(z);\n  }\n  return schemaOrFactory;\n}\n\nconst mergeOneQueryParamIntoRoute = (\n  route: Core.Route,\n  param: string,\n  schema: z.ZodType,\n  matchRoute?: (route: Core.Route) => boolean\n): void => {\n  if (matchRoute && !matchRoute(route)) return;\n  const query = { ...(route.request?.query ?? {}) };\n  if (param in query) {\n    throw new Error(\n      `contentAPI.addQueryParams: param \"${param}\" already exists on route ${route.method} ${route.path}`\n    );\n  }\n  route.request = { ...route.request, query: { ...query, [param]: schema } };\n};\n\nconst mergeOneInputParamIntoRoute = (\n  route: Core.Route,\n  param: string,\n  schema: z.ZodType,\n  matchRoute?: (route: Core.Route) => boolean\n): void => {\n  if (matchRoute && !matchRoute(route)) return;\n  const jsonKey = 'application/json';\n  type RouteBody = NonNullable<NonNullable<Core.Route['request']>['body']>;\n  const body: RouteBody = route.request?.body ? { ...route.request.body } : ({} as RouteBody);\n  const existing = body[jsonKey];\n  const base =\n    existing && typeof existing === 'object' && 'shape' in existing\n      ? (existing as { shape: Record<string, z.ZodType> }).shape\n      : {};\n  if (param in base) {\n    throw new Error(\n      `contentAPI.addInputParams: param \"${param}\" already exists on route ${route.method} ${route.path}`\n    );\n  }\n  body[jsonKey] = z.object({ ...base, [param]: schema }) as RouteBody[keyof RouteBody];\n  route.request = { ...route.request, body };\n};\n\n/** Stored options with schema always resolved (never a function). */\ntype ResolvedQueryParamEntry = {\n  param: string;\n  schema: z.ZodType;\n  matchRoute?: (route: Core.Route) => boolean;\n};\ntype ResolvedInputParamEntry = {\n  param: string;\n  schema: z.ZodType;\n  matchRoute?: (route: Core.Route) => boolean;\n};\n\n/**\n * Create a content API container that holds logic, tools and utils. (eg: permissions, ...)\n */\nconst createContentAPI = (strapi: Core.Strapi) => {\n  const extraQueryParams: ResolvedQueryParamEntry[] = [];\n  const extraInputParams: ResolvedInputParamEntry[] = [];\n\n  const addQueryParam = (options: Modules.ContentAPI.QueryParamEntry & { param: string }) => {\n    const { param, schema: schemaOrFactory, matchRoute } = options;\n    const schema = resolveSchema(schemaOrFactory);\n    assertQueryParamSchema(schema, param);\n    if ((ALLOWED_QUERY_PARAM_KEYS as readonly string[]).includes(param)) {\n      throw new Error(\n        `contentAPI.addQueryParams: param \"${param}\" is reserved by Strapi; use a different name`\n      );\n    }\n    if (extraQueryParams.some((o) => o.param === param)) {\n      throw new Error(`contentAPI.addQueryParams: param \"${param}\" has already been added`);\n    }\n    extraQueryParams.push({ param, schema, matchRoute });\n    // Params are merged into routes when initRouting() runs (applyExtraParamsToRoutes).\n    // We do not merge here: at register() time routes may not exist yet (lazy creation), and\n    // merging here would cause double-merge when initRouting runs and 400 \"invalid param\" or\n    // \"param already exists\" errors.\n  };\n\n  const addInputParam = (options: Modules.ContentAPI.InputParamEntry & { param: string }) => {\n    const { param, schema: schemaOrFactory, matchRoute } = options;\n    const schema = resolveSchema(schemaOrFactory);\n    if ((RESERVED_INPUT_PARAM_KEYS as readonly string[]).includes(param)) {\n      throw new Error(\n        `contentAPI.addInputParams: param \"${param}\" is reserved by Strapi; use a different name`\n      );\n    }\n    if (extraInputParams.some((o) => o.param === param)) {\n      throw new Error(`contentAPI.addInputParams: param \"${param}\" has already been added`);\n    }\n    extraInputParams.push({ param, schema, matchRoute });\n    // Params are merged into routes when initRouting() runs (applyExtraParamsToRoutes).\n  };\n\n  /**\n   * Register extra query params. Keys = param names; values = { schema, matchRoute? }.\n   * Schemas must be Zod scalar or array-of-scalars (enforced at runtime via assertQueryParamSchema).\n   */\n  const addQueryParams = (options: Modules.ContentAPI.AddQueryParamsOptions) => {\n    Object.entries(options).forEach(([param, rest]) => addQueryParam({ param, ...rest }));\n  };\n\n  /**\n   * Register extra input params (root-level body.data). Keys = param names; values = { schema, matchRoute? }.\n   * Any Zod type allowed; enforced at registration time.\n   */\n  const addInputParams = (options: Modules.ContentAPI.AddInputParamsOptions) => {\n    Object.entries(options).forEach(([param, rest]) => addInputParam({ param, ...rest }));\n  };\n\n  /** Merge all registered extra params into the given routes (mutates in place). Called at route registration. Throws if a param key already exists. */\n  const applyExtraParamsToRoutes = (routes: Core.Route[]): void => {\n    routes.forEach((route) => {\n      for (const { param, schema, matchRoute } of extraQueryParams) {\n        mergeOneQueryParamIntoRoute(route, param, schema, matchRoute);\n      }\n      for (const { param, schema, matchRoute } of extraInputParams) {\n        mergeOneInputParamIntoRoute(route, param, schema, matchRoute);\n      }\n    });\n  };\n\n  const getRoutesMap = async () => {\n    const routesMap: Record<string, Core.Route[]> = {};\n\n    _.forEach(strapi.apis, (api, apiName) => {\n      const routes = _.flatMap(api.routes, (route) => {\n        if ('routes' in route) {\n          return route.routes;\n        }\n\n        return route;\n      }).filter(filterContentAPI);\n\n      if (routes.length === 0) {\n        return;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`api::${apiName}`] = routes.map((route) => ({\n        ...route,\n        path: `${apiPrefix}${route.path}`,\n      }));\n    });\n\n    _.forEach(strapi.plugins, (plugin, pluginName) => {\n      const transformPrefix = transformRoutePrefixFor(pluginName);\n\n      if (Array.isArray(plugin.routes)) {\n        return plugin.routes.map(transformPrefix).filter(filterContentAPI);\n      }\n\n      const routes = _.flatMap(plugin.routes, (route) => route.routes.map(transformPrefix)).filter(\n        filterContentAPI\n      );\n\n      if (routes.length === 0) {\n        return;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({\n        ...route,\n        path: `${apiPrefix}${route.path}`,\n      }));\n    });\n\n    return sanitizeRoutesMapForSerialization(routesMap);\n  };\n\n  const sanitizer = sanitize.createAPISanitizers({\n    getModel(uid: string) {\n      return strapi.getModel(uid as UID.Schema);\n    },\n    get sanitizers() {\n      return {\n        input: strapi.sanitizers.get('content-api.input'),\n        output: strapi.sanitizers.get('content-api.output'),\n      };\n    },\n  });\n\n  const validator = validate.createAPIValidators({\n    getModel(uid: string) {\n      return strapi.getModel(uid as UID.Schema);\n    },\n    get validators() {\n      return {\n        input: strapi.validators.get('content-api.input'),\n      };\n    },\n  });\n\n  return {\n    permissions: instantiatePermissionsUtilities(strapi),\n    getRoutesMap,\n    sanitize: sanitizer,\n    validate: validator,\n    addQueryParams,\n    addInputParams,\n    applyExtraParamsToRoutes,\n  };\n};\n\nexport default createContentAPI;\n"],"names":["transformRoutePrefixFor","pluginName","route","prefix","config","path","undefined","filterContentAPI","info","type","ALLOWED_QUERY_SCHEMA_NAMES","Set","assertQueryParamSchema","schema","param","name","has","Error","inner","_def","innerType","element","resolveSchema","schemaOrFactory","z","mergeOneQueryParamIntoRoute","matchRoute","query","request","method","mergeOneInputParamIntoRoute","jsonKey","body","existing","base","shape","object","createContentAPI","strapi","extraQueryParams","extraInputParams","addQueryParam","options","ALLOWED_QUERY_PARAM_KEYS","includes","some","o","push","addInputParam","RESERVED_INPUT_PARAM_KEYS","addQueryParams","Object","entries","forEach","rest","addInputParams","applyExtraParamsToRoutes","routes","getRoutesMap","routesMap","_","apis","api","apiName","flatMap","filter","length","apiPrefix","get","map","plugins","plugin","transformPrefix","Array","isArray","sanitizeRoutesMapForSerialization","sanitizer","sanitize","createAPISanitizers","getModel","uid","sanitizers","input","output","validator","validate","createAPIValidators","validators","permissions","instantiatePermissionsUtilities"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAMA,uBAAAA,GAA0B,CAACC,UAAAA,GAAuB,CAACC,KAAAA,GAAAA;AACvD,QAAA,MAAMC,SAASD,KAAAA,CAAME,MAAM,IAAIF,KAAAA,CAAME,MAAM,CAACD,MAAM;AAClD,QAAA,MAAME,IAAAA,GAAOF,MAAAA,KAAWG,SAAAA,GAAY,CAAA,EAAGH,SAASD,KAAAA,CAAMG,IAAI,CAAA,CAAE,GAAG,CAAC,CAAC,EAAEJ,UAAAA,CAAAA,EAAaC,KAAAA,CAAMG,IAAI,CAAA,CAAE;QAE5F,OAAO;AACL,YAAA,GAAGH,KAAK;AACRG,YAAAA;AACF,SAAA;AACF,IAAA,CAAA;AAEA,MAAME,mBAAmB,CAACL,KAAAA,GAAsBA,MAAMM,IAAI,CAACC,IAAI,KAAK,aAAA;AAEpE;;;;;;;;;IAUA,MAAMC,0BAAAA,GAA6B,IAAIC,GAAAA,CAAI;AACzC,IAAA,WAAA;AACA,IAAA,WAAA;AACA,IAAA,YAAA;AACA,IAAA,SAAA;AACA,IAAA,aAAA;AACA,IAAA,YAAA;AACA,IAAA;AACD,CAAA,CAAA;AAED,SAASC,sBAAAA,CAAuBC,MAAe,EAAEC,KAAa,EAAA;AAC5D,IAAA,MAAMC,IAAAA,GAAQF,MAAAA,EAAgD,WAAA,EAAaE,IAAAA,IAAQ,EAAA;AACnF,IAAA,IAAI,CAACL,0BAAAA,CAA2BM,GAAG,CAACD,IAAAA,CAAAA,EAAO;QACzC,MAAM,IAAIE,KAAAA,CACR,CAAC,kCAAkC,EAAEH,MAAM,mFAAmF,EAAEC,IAAAA,CAAK,wCAAwC,CAAC,CAAA;AAElL,IAAA;IACA,IAAIA,IAAAA,KAAS,aAAA,IAAiBA,IAAAA,KAAS,YAAA,EAAc;QACnD,MAAMG,KAAAA,GAASL,QAA+CM,IAAAA,EAAMC,SAAAA;QACpE,IAAIF,KAAAA,EAAON,uBAAuBM,KAAAA,EAAOJ,KAAAA,CAAAA;AACzC,QAAA;AACF,IAAA;AACA,IAAA,IAAIC,SAAS,UAAA,EAAY;QACvB,MAAMM,OAAAA,GAAWR,QAA6CM,IAAAA,EAAME,OAAAA;QACpE,IAAIA,OAAAA,EAAST,uBAAuBS,OAAAA,EAASP,KAAAA,CAAAA;AAC/C,IAAA;AACF;AAEA,SAASQ,cAAiBC,eAAiD,EAAA;IACzE,IAAI,OAAOA,oBAAoB,UAAA,EAAY;AACzC,QAAA,OAAO,eAACA,CAA+CC,YAAAA,CAAAA;AACzD,IAAA;IACA,OAAOD,eAAAA;AACT;AAEA,MAAME,2BAAAA,GAA8B,CAClCvB,KAAAA,EACAY,KAAAA,EACAD,MAAAA,EACAa,UAAAA,GAAAA;IAEA,IAAIA,UAAAA,IAAc,CAACA,UAAAA,CAAWxB,KAAAA,CAAAA,EAAQ;AACtC,IAAA,MAAMyB,KAAAA,GAAQ;AAAE,QAAA,GAAIzB,KAAAA,CAAM0B,OAAO,EAAED,KAAAA,IAAS;AAAI,KAAA;AAChD,IAAA,IAAIb,SAASa,KAAAA,EAAO;AAClB,QAAA,MAAM,IAAIV,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,0BAA0B,EAAEZ,KAAAA,CAAM2B,MAAM,CAAC,CAAC,EAAE3B,KAAAA,CAAMG,IAAI,CAAA,CAAE,CAAA;AAEvG,IAAA;AACAH,IAAAA,KAAAA,CAAM0B,OAAO,GAAG;AAAE,QAAA,GAAG1B,MAAM0B,OAAO;QAAED,KAAAA,EAAO;AAAE,YAAA,GAAGA,KAAK;AAAE,YAAA,CAACb,QAAQD;AAAO;AAAE,KAAA;AAC3E,CAAA;AAEA,MAAMiB,2BAAAA,GAA8B,CAClC5B,KAAAA,EACAY,KAAAA,EACAD,MAAAA,EACAa,UAAAA,GAAAA;IAEA,IAAIA,UAAAA,IAAc,CAACA,UAAAA,CAAWxB,KAAAA,CAAAA,EAAQ;AACtC,IAAA,MAAM6B,OAAAA,GAAU,kBAAA;AAEhB,IAAA,MAAMC,IAAAA,GAAkB9B,KAAAA,CAAM0B,OAAO,EAAEI,IAAAA,GAAO;QAAE,GAAG9B,KAAAA,CAAM0B,OAAO,CAACI;AAAK,KAAA,GAAK,EAAC;IAC5E,MAAMC,QAAAA,GAAWD,IAAI,CAACD,OAAAA,CAAQ;IAC9B,MAAMG,IAAAA,GACJD,QAAAA,IAAY,OAAOA,QAAAA,KAAa,QAAA,IAAY,OAAA,IAAWA,QAAAA,GACnD,QAACA,CAAkDE,KAAK,GACxD,EAAC;AACP,IAAA,IAAIrB,SAASoB,IAAAA,EAAM;AACjB,QAAA,MAAM,IAAIjB,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,0BAA0B,EAAEZ,KAAAA,CAAM2B,MAAM,CAAC,CAAC,EAAE3B,KAAAA,CAAMG,IAAI,CAAA,CAAE,CAAA;AAEvG,IAAA;AACA2B,IAAAA,IAAI,CAACD,OAAAA,CAAQ,GAAGP,YAAAA,CAAEY,MAAM,CAAC;AAAE,QAAA,GAAGF,IAAI;AAAE,QAAA,CAACpB,QAAQD;AAAO,KAAA,CAAA;AACpDX,IAAAA,KAAAA,CAAM0B,OAAO,GAAG;AAAE,QAAA,GAAG1B,MAAM0B,OAAO;AAAEI,QAAAA;AAAK,KAAA;AAC3C,CAAA;AAcA;;IAGA,MAAMK,mBAAmB,CAACC,MAAAA,GAAAA;AACxB,IAAA,MAAMC,mBAA8C,EAAE;AACtD,IAAA,MAAMC,mBAA8C,EAAE;AAEtD,IAAA,MAAMC,gBAAgB,CAACC,OAAAA,GAAAA;QACrB,MAAM,EAAE5B,KAAK,EAAED,MAAAA,EAAQU,eAAe,EAAEG,UAAU,EAAE,GAAGgB,OAAAA;AACvD,QAAA,MAAM7B,SAASS,aAAAA,CAAcC,eAAAA,CAAAA;AAC7BX,QAAAA,sBAAAA,CAAuBC,MAAAA,EAAQC,KAAAA,CAAAA;AAC/B,QAAA,IAAI6B,oCAACA,CAA+CC,QAAQ,CAAC9B,KAAAA,CAAAA,EAAQ;AACnE,YAAA,MAAM,IAAIG,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,6CAA6C,CAAC,CAAA;AAE7F,QAAA;QACA,IAAIyB,gBAAAA,CAAiBM,IAAI,CAAC,CAACC,IAAMA,CAAAA,CAAEhC,KAAK,KAAKA,KAAAA,CAAAA,EAAQ;AACnD,YAAA,MAAM,IAAIG,KAAAA,CAAM,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,wBAAwB,CAAC,CAAA;AACtF,QAAA;AACAyB,QAAAA,gBAAAA,CAAiBQ,IAAI,CAAC;AAAEjC,YAAAA,KAAAA;AAAOD,YAAAA,MAAAA;AAAQa,YAAAA;AAAW,SAAA,CAAA;;;;;AAKpD,IAAA,CAAA;AAEA,IAAA,MAAMsB,gBAAgB,CAACN,OAAAA,GAAAA;QACrB,MAAM,EAAE5B,KAAK,EAAED,MAAAA,EAAQU,eAAe,EAAEG,UAAU,EAAE,GAAGgB,OAAAA;AACvD,QAAA,MAAM7B,SAASS,aAAAA,CAAcC,eAAAA,CAAAA;AAC7B,QAAA,IAAI0B,qCAACA,CAAgDL,QAAQ,CAAC9B,KAAAA,CAAAA,EAAQ;AACpE,YAAA,MAAM,IAAIG,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,6CAA6C,CAAC,CAAA;AAE7F,QAAA;QACA,IAAI0B,gBAAAA,CAAiBK,IAAI,CAAC,CAACC,IAAMA,CAAAA,CAAEhC,KAAK,KAAKA,KAAAA,CAAAA,EAAQ;AACnD,YAAA,MAAM,IAAIG,KAAAA,CAAM,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,wBAAwB,CAAC,CAAA;AACtF,QAAA;AACA0B,QAAAA,gBAAAA,CAAiBO,IAAI,CAAC;AAAEjC,YAAAA,KAAAA;AAAOD,YAAAA,MAAAA;AAAQa,YAAAA;AAAW,SAAA,CAAA;;AAEpD,IAAA,CAAA;AAEA;;;MAIA,MAAMwB,iBAAiB,CAACR,OAAAA,GAAAA;QACtBS,MAAAA,CAAOC,OAAO,CAACV,OAAAA,CAAAA,CAASW,OAAO,CAAC,CAAC,CAACvC,KAAAA,EAAOwC,IAAAA,CAAK,GAAKb,aAAAA,CAAc;AAAE3B,gBAAAA,KAAAA;AAAO,gBAAA,GAAGwC;AAAK,aAAA,CAAA,CAAA;AACpF,IAAA,CAAA;AAEA;;;MAIA,MAAMC,iBAAiB,CAACb,OAAAA,GAAAA;QACtBS,MAAAA,CAAOC,OAAO,CAACV,OAAAA,CAAAA,CAASW,OAAO,CAAC,CAAC,CAACvC,KAAAA,EAAOwC,IAAAA,CAAK,GAAKN,aAAAA,CAAc;AAAElC,gBAAAA,KAAAA;AAAO,gBAAA,GAAGwC;AAAK,aAAA,CAAA,CAAA;AACpF,IAAA,CAAA;2JAGA,MAAME,wBAAAA,GAA2B,CAACC,MAAAA,GAAAA;QAChCA,MAAAA,CAAOJ,OAAO,CAAC,CAACnD,KAAAA,GAAAA;YACd,KAAK,MAAM,EAAEY,KAAK,EAAED,MAAM,EAAEa,UAAU,EAAE,IAAIa,gBAAAA,CAAkB;gBAC5Dd,2BAAAA,CAA4BvB,KAAAA,EAAOY,OAAOD,MAAAA,EAAQa,UAAAA,CAAAA;AACpD,YAAA;YACA,KAAK,MAAM,EAAEZ,KAAK,EAAED,MAAM,EAAEa,UAAU,EAAE,IAAIc,gBAAAA,CAAkB;gBAC5DV,2BAAAA,CAA4B5B,KAAAA,EAAOY,OAAOD,MAAAA,EAAQa,UAAAA,CAAAA;AACpD,YAAA;AACF,QAAA,CAAA,CAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMgC,YAAAA,GAAe,UAAA;AACnB,QAAA,MAAMC,YAA0C,EAAC;AAEjDC,QAAAA,CAAAA,CAAEP,OAAO,CAACf,MAAAA,CAAOuB,IAAI,EAAE,CAACC,GAAAA,EAAKC,OAAAA,GAAAA;AAC3B,YAAA,MAAMN,SAASG,CAAAA,CAAEI,OAAO,CAACF,GAAAA,CAAIL,MAAM,EAAE,CAACvD,KAAAA,GAAAA;AACpC,gBAAA,IAAI,YAAYA,KAAAA,EAAO;AACrB,oBAAA,OAAOA,MAAMuD,MAAM;AACrB,gBAAA;gBAEA,OAAOvD,KAAAA;AACT,YAAA,CAAA,CAAA,CAAG+D,MAAM,CAAC1D,gBAAAA,CAAAA;YAEV,IAAIkD,MAAAA,CAAOS,MAAM,KAAK,CAAA,EAAG;AACvB,gBAAA;AACF,YAAA;AAEA,YAAA,MAAMC,SAAAA,GAAY7B,MAAAA,CAAOlC,MAAM,CAACgE,GAAG,CAAC,iBAAA,CAAA;AACpCT,YAAAA,SAAS,CAAC,CAAC,KAAK,EAAEI,OAAAA,CAAAA,CAAS,CAAC,GAAGN,MAAAA,CAAOY,GAAG,CAAC,CAACnE,KAAAA,IAAW;AACpD,oBAAA,GAAGA,KAAK;AACRG,oBAAAA,IAAAA,EAAM,CAAA,EAAG8D,SAAAA,CAAAA,EAAYjE,KAAAA,CAAMG,IAAI,CAAA;iBACjC,CAAA,CAAA;AACF,QAAA,CAAA,CAAA;AAEAuD,QAAAA,CAAAA,CAAEP,OAAO,CAACf,MAAAA,CAAOgC,OAAO,EAAE,CAACC,MAAAA,EAAQtE,UAAAA,GAAAA;AACjC,YAAA,MAAMuE,kBAAkBxE,uBAAAA,CAAwBC,UAAAA,CAAAA;AAEhD,YAAA,IAAIwE,KAAAA,CAAMC,OAAO,CAACH,MAAAA,CAAOd,MAAM,CAAA,EAAG;AAChC,gBAAA,OAAOc,OAAOd,MAAM,CAACY,GAAG,CAACG,eAAAA,CAAAA,CAAiBP,MAAM,CAAC1D,gBAAAA,CAAAA;AACnD,YAAA;AAEA,YAAA,MAAMkD,SAASG,CAAAA,CAAEI,OAAO,CAACO,MAAAA,CAAOd,MAAM,EAAE,CAACvD,KAAAA,GAAUA,KAAAA,CAAMuD,MAAM,CAACY,GAAG,CAACG,eAAAA,CAAAA,CAAAA,CAAkBP,MAAM,CAC1F1D,gBAAAA,CAAAA;YAGF,IAAIkD,MAAAA,CAAOS,MAAM,KAAK,CAAA,EAAG;AACvB,gBAAA;AACF,YAAA;AAEA,YAAA,MAAMC,SAAAA,GAAY7B,MAAAA,CAAOlC,MAAM,CAACgE,GAAG,CAAC,iBAAA,CAAA;AACpCT,YAAAA,SAAS,CAAC,CAAC,QAAQ,EAAE1D,UAAAA,CAAAA,CAAY,CAAC,GAAGwD,MAAAA,CAAOY,GAAG,CAAC,CAACnE,KAAAA,IAAW;AAC1D,oBAAA,GAAGA,KAAK;AACRG,oBAAAA,IAAAA,EAAM,CAAA,EAAG8D,SAAAA,CAAAA,EAAYjE,KAAAA,CAAMG,IAAI,CAAA;iBACjC,CAAA,CAAA;AACF,QAAA,CAAA,CAAA;AAEA,QAAA,OAAOsE,6CAAAA,CAAkChB,SAAAA,CAAAA;AAC3C,IAAA,CAAA;IAEA,MAAMiB,SAAAA,GAAYC,oBAAAA,CAASC,mBAAmB,CAAC;AAC7CC,QAAAA,QAAAA,CAAAA,CAASC,GAAW,EAAA;YAClB,OAAO1C,MAAAA,CAAOyC,QAAQ,CAACC,GAAAA,CAAAA;AACzB,QAAA,CAAA;AACA,QAAA,IAAIC,UAAAA,CAAAA,GAAa;YACf,OAAO;AACLC,gBAAAA,KAAAA,EAAO5C,MAAAA,CAAO2C,UAAU,CAACb,GAAG,CAAC,mBAAA,CAAA;AAC7Be,gBAAAA,MAAAA,EAAQ7C,MAAAA,CAAO2C,UAAU,CAACb,GAAG,CAAC,oBAAA;AAChC,aAAA;AACF,QAAA;AACF,KAAA,CAAA;IAEA,MAAMgB,SAAAA,GAAYC,oBAAAA,CAASC,mBAAmB,CAAC;AAC7CP,QAAAA,QAAAA,CAAAA,CAASC,GAAW,EAAA;YAClB,OAAO1C,MAAAA,CAAOyC,QAAQ,CAACC,GAAAA,CAAAA;AACzB,QAAA,CAAA;AACA,QAAA,IAAIO,UAAAA,CAAAA,GAAa;YACf,OAAO;AACLL,gBAAAA,KAAAA,EAAO5C,MAAAA,CAAOiD,UAAU,CAACnB,GAAG,CAAC,mBAAA;AAC/B,aAAA;AACF,QAAA;AACF,KAAA,CAAA;IAEA,OAAO;AACLoB,QAAAA,WAAAA,EAAaC,KAAAA,CAAgCnD,MAAAA,CAAAA;AAC7CoB,QAAAA,YAAAA;QACAmB,QAAAA,EAAUD,SAAAA;QACVS,QAAAA,EAAUD,SAAAA;AACVlC,QAAAA,cAAAA;AACAK,QAAAA,cAAAA;AACAC,QAAAA;AACF,KAAA;AACF;;;;"}
+{"version":3,"file":"index.js","sources":["../../../src/services/content-api/index.ts"],"sourcesContent":["import _ from 'lodash';\nimport {\n  sanitize,\n  validate,\n  sanitizeRoutesMapForSerialization,\n  ALLOWED_QUERY_PARAM_KEYS,\n  RESERVED_INPUT_PARAM_KEYS,\n} from '@strapi/utils';\nimport * as z from 'zod/v4';\n\nimport type { Core, Modules, UID } from '@strapi/types';\n\nimport instantiatePermissionsUtilities from './permissions';\n\nconst transformRoutePrefixFor = (pluginName: string) => (route: Core.Route) => {\n  const prefix = route.config && route.config.prefix;\n  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;\n\n  return {\n    ...route,\n    path,\n  };\n};\n\nconst filterContentAPI = (route: Core.Route) => route.info.type === 'content-api';\n\n/**\n * Runtime check for addQueryParams: we only allow scalar or array-of-scalar schemas (no nested objects).\n * We keep this in addition to the ZodQueryParamSchema type because: (1) TypeScript can be bypassed (JS,\n * any, or schema from another Zod instance); (2) it gives a clear, immediate error at registration\n * time instead of a later failure in validate/sanitize. This list is intentionally tied to Zod v4\n * constructor names; if Zod changes internals, this may need updating.\n * Compatibility: Zod 3 and Zod 4 Classic (zod/v4) both use these constructor names and\n * expose ._def with .innerType / .element for Optional/Default/Array. Zod 4 Core/Mini use\n * ._zod.def instead; we only accept schemas from the same zod/v4 instance used here.\n */\nconst ALLOWED_QUERY_SCHEMA_NAMES = new Set([\n  'ZodString',\n  'ZodNumber',\n  'ZodBoolean',\n  'ZodEnum',\n  'ZodOptional',\n  'ZodDefault',\n  'ZodArray',\n]);\n\nfunction assertQueryParamSchema(schema: unknown, param: string): void {\n  const name = (schema as { constructor?: { name?: string } })?.constructor?.name ?? '';\n  if (!ALLOWED_QUERY_SCHEMA_NAMES.has(name)) {\n    throw new Error(\n      `contentAPI.addQueryParams: param \"${param}\" schema must be a scalar (string, number, boolean, enum) or array of scalars; got ${name}. Use addInputParams for nested objects.`\n    );\n  }\n  if (name === 'ZodOptional' || name === 'ZodDefault') {\n    const inner = (schema as { _def?: { innerType?: unknown } })?._def?.innerType;\n    if (inner) assertQueryParamSchema(inner, param);\n    return;\n  }\n  if (name === 'ZodArray') {\n    const element = (schema as { _def?: { element?: unknown } })?._def?.element;\n    if (element) assertQueryParamSchema(element, param);\n  }\n}\n\nfunction resolveSchema<T>(schemaOrFactory: T | ((zInstance: typeof z) => T)): T {\n  if (typeof schemaOrFactory === 'function') {\n    return (schemaOrFactory as (zInstance: typeof z) => T)(z);\n  }\n  return schemaOrFactory;\n}\n\nconst mergeOneQueryParamIntoRoute = (\n  route: Core.Route,\n  param: string,\n  schema: z.ZodType,\n  matchRoute?: (route: Core.Route) => boolean\n): void => {\n  if (matchRoute && !matchRoute(route)) return;\n  const query = { ...(route.request?.query ?? {}) };\n  if (param in query) {\n    throw new Error(\n      `contentAPI.addQueryParams: param \"${param}\" already exists on route ${route.method} ${route.path}`\n    );\n  }\n  route.request = { ...route.request, query: { ...query, [param]: schema } };\n};\n\nconst mergeOneInputParamIntoRoute = (\n  route: Core.Route,\n  param: string,\n  schema: z.ZodType,\n  matchRoute?: (route: Core.Route) => boolean\n): void => {\n  if (matchRoute && !matchRoute(route)) return;\n  const jsonKey = 'application/json';\n  type RouteBody = NonNullable<NonNullable<Core.Route['request']>['body']>;\n  const body: RouteBody = route.request?.body ? { ...route.request.body } : ({} as RouteBody);\n  const existing = body[jsonKey];\n  const base =\n    existing && typeof existing === 'object' && 'shape' in existing\n      ? (existing as { shape: Record<string, z.ZodType> }).shape\n      : {};\n  if (param in base) {\n    throw new Error(\n      `contentAPI.addInputParams: param \"${param}\" already exists on route ${route.method} ${route.path}`\n    );\n  }\n  body[jsonKey] = z.object({ ...base, [param]: schema }) as RouteBody[keyof RouteBody];\n  route.request = { ...route.request, body };\n};\n\n/** Stored options with schema always resolved (never a function). */\ntype ResolvedQueryParamEntry = {\n  param: string;\n  schema: z.ZodType;\n  matchRoute?: (route: Core.Route) => boolean;\n};\ntype ResolvedInputParamEntry = {\n  param: string;\n  schema: z.ZodType;\n  matchRoute?: (route: Core.Route) => boolean;\n};\n\n/**\n * Create a content API container that holds logic, tools and utils. (eg: permissions, ...)\n */\nconst createContentAPI = (strapi: Core.Strapi) => {\n  const extraQueryParams: ResolvedQueryParamEntry[] = [];\n  const extraInputParams: ResolvedInputParamEntry[] = [];\n\n  const addQueryParam = (options: Modules.ContentAPI.QueryParamEntry & { param: string }) => {\n    const { param, schema: schemaOrFactory, matchRoute } = options;\n    const schema = resolveSchema(schemaOrFactory);\n    assertQueryParamSchema(schema, param);\n    if ((ALLOWED_QUERY_PARAM_KEYS as readonly string[]).includes(param)) {\n      throw new Error(\n        `contentAPI.addQueryParams: param \"${param}\" is reserved by Strapi; use a different name`\n      );\n    }\n    if (extraQueryParams.some((o) => o.param === param)) {\n      throw new Error(`contentAPI.addQueryParams: param \"${param}\" has already been added`);\n    }\n    extraQueryParams.push({ param, schema, matchRoute });\n    // Params are merged into routes when initRouting() runs (applyExtraParamsToRoutes).\n    // We do not merge here: at register() time routes may not exist yet (lazy creation), and\n    // merging here would cause double-merge when initRouting runs and 400 \"invalid param\" or\n    // \"param already exists\" errors.\n  };\n\n  const addInputParam = (options: Modules.ContentAPI.InputParamEntry & { param: string }) => {\n    const { param, schema: schemaOrFactory, matchRoute } = options;\n    const schema = resolveSchema(schemaOrFactory);\n    if ((RESERVED_INPUT_PARAM_KEYS as readonly string[]).includes(param)) {\n      throw new Error(\n        `contentAPI.addInputParams: param \"${param}\" is reserved by Strapi; use a different name`\n      );\n    }\n    if (extraInputParams.some((o) => o.param === param)) {\n      throw new Error(`contentAPI.addInputParams: param \"${param}\" has already been added`);\n    }\n    extraInputParams.push({ param, schema, matchRoute });\n    // Params are merged into routes when initRouting() runs (applyExtraParamsToRoutes).\n  };\n\n  /**\n   * Register extra query params. Keys = param names; values = { schema, matchRoute? }.\n   * Schemas must be Zod scalar or array-of-scalars (enforced at runtime via assertQueryParamSchema).\n   */\n  const addQueryParams = (options: Modules.ContentAPI.AddQueryParamsOptions) => {\n    Object.entries(options).forEach(([param, rest]) => addQueryParam({ param, ...rest }));\n  };\n\n  /**\n   * Register extra input params (root-level body.data). Keys = param names; values = { schema, matchRoute? }.\n   * Any Zod type allowed; enforced at registration time.\n   */\n  const addInputParams = (options: Modules.ContentAPI.AddInputParamsOptions) => {\n    Object.entries(options).forEach(([param, rest]) => addInputParam({ param, ...rest }));\n  };\n\n  /** Merge all registered extra params into the given routes (mutates in place). Called at route registration. Throws if a param key already exists. */\n  const applyExtraParamsToRoutes = (routes: Core.Route[]): void => {\n    routes.forEach((route) => {\n      for (const { param, schema, matchRoute } of extraQueryParams) {\n        mergeOneQueryParamIntoRoute(route, param, schema, matchRoute);\n      }\n      for (const { param, schema, matchRoute } of extraInputParams) {\n        mergeOneInputParamIntoRoute(route, param, schema, matchRoute);\n      }\n    });\n  };\n\n  const getRoutesMap = async () => {\n    const routesMap: Record<string, Core.Route[]> = {};\n\n    _.forEach(strapi.apis, (api, apiName) => {\n      const routes = _.flatMap(api.routes, (route) => {\n        if ('routes' in route) {\n          return route.routes;\n        }\n\n        return route;\n      }).filter(filterContentAPI);\n\n      if (routes.length === 0) {\n        return;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`api::${apiName}`] = routes.map((route) => ({\n        ...route,\n        path: `${apiPrefix}${route.path}`,\n      }));\n    });\n\n    _.forEach(strapi.plugins, (plugin, pluginName) => {\n      const transformPrefix = transformRoutePrefixFor(pluginName);\n\n      if (Array.isArray(plugin.routes)) {\n        return plugin.routes.map(transformPrefix).filter(filterContentAPI);\n      }\n\n      const routes = _.flatMap(plugin.routes, (route) => route.routes.map(transformPrefix)).filter(\n        filterContentAPI\n      );\n\n      if (routes.length === 0) {\n        return;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({\n        ...route,\n        path: `${apiPrefix}${route.path}`,\n      }));\n    });\n\n    return sanitizeRoutesMapForSerialization(routesMap);\n  };\n\n  const sanitizer = sanitize.createAPISanitizers({\n    getModel(uid: string) {\n      return strapi.getModel(uid as UID.Schema);\n    },\n    get sanitizers() {\n      return {\n        input: strapi.sanitizers.get('content-api.input'),\n        output: strapi.sanitizers.get('content-api.output'),\n      };\n    },\n  });\n\n  const validator = validate.createAPIValidators({\n    getModel(uid: string) {\n      return strapi.getModel(uid as UID.Schema);\n    },\n    get validators() {\n      return {\n        input: strapi.validators.get('content-api.input'),\n      };\n    },\n  });\n\n  return {\n    permissions: instantiatePermissionsUtilities(strapi),\n    getRoutesMap,\n    sanitize: sanitizer,\n    validate: validator,\n    addQueryParams,\n    addInputParams,\n    applyExtraParamsToRoutes,\n  };\n};\n\nexport default createContentAPI;\n"],"names":["transformRoutePrefixFor","pluginName","route","prefix","config","path","undefined","filterContentAPI","info","type","ALLOWED_QUERY_SCHEMA_NAMES","Set","assertQueryParamSchema","schema","param","name","has","Error","inner","_def","innerType","element","resolveSchema","schemaOrFactory","z","mergeOneQueryParamIntoRoute","matchRoute","query","request","method","mergeOneInputParamIntoRoute","jsonKey","body","existing","base","shape","object","createContentAPI","strapi","extraQueryParams","extraInputParams","addQueryParam","options","ALLOWED_QUERY_PARAM_KEYS","includes","some","o","push","addInputParam","RESERVED_INPUT_PARAM_KEYS","addQueryParams","Object","entries","forEach","rest","addInputParams","applyExtraParamsToRoutes","routes","getRoutesMap","routesMap","_","apis","api","apiName","flatMap","filter","length","apiPrefix","get","map","plugins","plugin","transformPrefix","Array","isArray","sanitizeRoutesMapForSerialization","sanitizer","sanitize","createAPISanitizers","getModel","uid","sanitizers","input","output","validator","validate","createAPIValidators","validators","permissions","instantiatePermissionsUtilities"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAMA,uBAAAA,GAA0B,CAACC,UAAAA,GAAuB,CAACC,KAAAA,GAAAA;AACvD,QAAA,MAAMC,SAASD,KAAAA,CAAME,MAAM,IAAIF,KAAAA,CAAME,MAAM,CAACD,MAAM;AAClD,QAAA,MAAME,IAAAA,GAAOF,MAAAA,KAAWG,SAAAA,GAAY,CAAA,EAAGH,SAASD,KAAAA,CAAMG,IAAI,CAAA,CAAE,GAAG,CAAC,CAAC,EAAEJ,UAAAA,CAAAA,EAAaC,KAAAA,CAAMG,IAAI,CAAA,CAAE;QAE5F,OAAO;AACL,YAAA,GAAGH,KAAK;AACRG,YAAAA;AACF,SAAA;AACF,IAAA,CAAA;AAEA,MAAME,mBAAmB,CAACL,KAAAA,GAAsBA,MAAMM,IAAI,CAACC,IAAI,KAAK,aAAA;AAEpE;;;;;;;;;IAUA,MAAMC,0BAAAA,GAA6B,IAAIC,GAAAA,CAAI;AACzC,IAAA,WAAA;AACA,IAAA,WAAA;AACA,IAAA,YAAA;AACA,IAAA,SAAA;AACA,IAAA,aAAA;AACA,IAAA,YAAA;AACA,IAAA;AACD,CAAA,CAAA;AAED,SAASC,sBAAAA,CAAuBC,MAAe,EAAEC,KAAa,EAAA;AAC5D,IAAA,MAAMC,IAAAA,GAAQF,MAAAA,EAAgD,WAAA,EAAaE,IAAAA,IAAQ,EAAA;AACnF,IAAA,IAAI,CAACL,0BAAAA,CAA2BM,GAAG,CAACD,IAAAA,CAAAA,EAAO;QACzC,MAAM,IAAIE,KAAAA,CACR,CAAC,kCAAkC,EAAEH,MAAM,mFAAmF,EAAEC,IAAAA,CAAK,wCAAwC,CAAC,CAAA;AAElL,IAAA;IACA,IAAIA,IAAAA,KAAS,aAAA,IAAiBA,IAAAA,KAAS,YAAA,EAAc;QACnD,MAAMG,KAAAA,GAASL,QAA+CM,IAAAA,EAAMC,SAAAA;QACpE,IAAIF,KAAAA,EAAON,uBAAuBM,KAAAA,EAAOJ,KAAAA,CAAAA;AACzC,QAAA;AACF,IAAA;AACA,IAAA,IAAIC,SAAS,UAAA,EAAY;QACvB,MAAMM,OAAAA,GAAWR,QAA6CM,IAAAA,EAAME,OAAAA;QACpE,IAAIA,OAAAA,EAAST,uBAAuBS,OAAAA,EAASP,KAAAA,CAAAA;AAC/C,IAAA;AACF;AAEA,SAASQ,cAAiBC,eAAiD,EAAA;IACzE,IAAI,OAAOA,oBAAoB,UAAA,EAAY;AACzC,QAAA,OAAO,eAACA,CAA+CC,YAAAA,CAAAA;AACzD,IAAA;IACA,OAAOD,eAAAA;AACT;AAEA,MAAME,2BAAAA,GAA8B,CAClCvB,KAAAA,EACAY,KAAAA,EACAD,MAAAA,EACAa,UAAAA,GAAAA;IAEA,IAAIA,UAAAA,IAAc,CAACA,UAAAA,CAAWxB,KAAAA,CAAAA,EAAQ;AACtC,IAAA,MAAMyB,KAAAA,GAAQ;AAAE,QAAA,GAAIzB,KAAAA,CAAM0B,OAAO,EAAED,KAAAA,IAAS;AAAI,KAAA;AAChD,IAAA,IAAIb,SAASa,KAAAA,EAAO;AAClB,QAAA,MAAM,IAAIV,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,0BAA0B,EAAEZ,KAAAA,CAAM2B,MAAM,CAAC,CAAC,EAAE3B,KAAAA,CAAMG,IAAI,CAAA,CAAE,CAAA;AAEvG,IAAA;AACAH,IAAAA,KAAAA,CAAM0B,OAAO,GAAG;AAAE,QAAA,GAAG1B,MAAM0B,OAAO;QAAED,KAAAA,EAAO;AAAE,YAAA,GAAGA,KAAK;AAAE,YAAA,CAACb,QAAQD;AAAO;AAAE,KAAA;AAC3E,CAAA;AAEA,MAAMiB,2BAAAA,GAA8B,CAClC5B,KAAAA,EACAY,KAAAA,EACAD,MAAAA,EACAa,UAAAA,GAAAA;IAEA,IAAIA,UAAAA,IAAc,CAACA,UAAAA,CAAWxB,KAAAA,CAAAA,EAAQ;AACtC,IAAA,MAAM6B,OAAAA,GAAU,kBAAA;AAEhB,IAAA,MAAMC,IAAAA,GAAkB9B,KAAAA,CAAM0B,OAAO,EAAEI,IAAAA,GAAO;QAAE,GAAG9B,KAAAA,CAAM0B,OAAO,CAACI;AAAK,KAAA,GAAK,EAAC;IAC5E,MAAMC,QAAAA,GAAWD,IAAI,CAACD,OAAAA,CAAQ;IAC9B,MAAMG,IAAAA,GACJD,QAAAA,IAAY,OAAOA,QAAAA,KAAa,QAAA,IAAY,OAAA,IAAWA,QAAAA,GACnD,QAACA,CAAkDE,KAAK,GACxD,EAAC;AACP,IAAA,IAAIrB,SAASoB,IAAAA,EAAM;AACjB,QAAA,MAAM,IAAIjB,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,0BAA0B,EAAEZ,KAAAA,CAAM2B,MAAM,CAAC,CAAC,EAAE3B,KAAAA,CAAMG,IAAI,CAAA,CAAE,CAAA;AAEvG,IAAA;AACA2B,IAAAA,IAAI,CAACD,OAAAA,CAAQ,GAAGP,YAAAA,CAAEY,MAAM,CAAC;AAAE,QAAA,GAAGF,IAAI;AAAE,QAAA,CAACpB,QAAQD;AAAO,KAAA,CAAA;AACpDX,IAAAA,KAAAA,CAAM0B,OAAO,GAAG;AAAE,QAAA,GAAG1B,MAAM0B,OAAO;AAAEI,QAAAA;AAAK,KAAA;AAC3C,CAAA;AAcA;;IAGA,MAAMK,mBAAmB,CAACC,MAAAA,GAAAA;AACxB,IAAA,MAAMC,mBAA8C,EAAE;AACtD,IAAA,MAAMC,mBAA8C,EAAE;AAEtD,IAAA,MAAMC,gBAAgB,CAACC,OAAAA,GAAAA;QACrB,MAAM,EAAE5B,KAAK,EAAED,MAAAA,EAAQU,eAAe,EAAEG,UAAU,EAAE,GAAGgB,OAAAA;AACvD,QAAA,MAAM7B,SAASS,aAAAA,CAAcC,eAAAA,CAAAA;AAC7BX,QAAAA,sBAAAA,CAAuBC,MAAAA,EAAQC,KAAAA,CAAAA;AAC/B,QAAA,IAAI6B,oCAACA,CAA+CC,QAAQ,CAAC9B,KAAAA,CAAAA,EAAQ;AACnE,YAAA,MAAM,IAAIG,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,6CAA6C,CAAC,CAAA;AAE7F,QAAA;QACA,IAAIyB,gBAAAA,CAAiBM,IAAI,CAAC,CAACC,IAAMA,CAAAA,CAAEhC,KAAK,KAAKA,KAAAA,CAAAA,EAAQ;AACnD,YAAA,MAAM,IAAIG,KAAAA,CAAM,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,wBAAwB,CAAC,CAAA;AACtF,QAAA;AACAyB,QAAAA,gBAAAA,CAAiBQ,IAAI,CAAC;AAAEjC,YAAAA,KAAAA;AAAOD,YAAAA,MAAAA;AAAQa,YAAAA;AAAW,SAAA,CAAA;;;;;AAKpD,IAAA,CAAA;AAEA,IAAA,MAAMsB,gBAAgB,CAACN,OAAAA,GAAAA;QACrB,MAAM,EAAE5B,KAAK,EAAED,MAAAA,EAAQU,eAAe,EAAEG,UAAU,EAAE,GAAGgB,OAAAA;AACvD,QAAA,MAAM7B,SAASS,aAAAA,CAAcC,eAAAA,CAAAA;AAC7B,QAAA,IAAI0B,qCAACA,CAAgDL,QAAQ,CAAC9B,KAAAA,CAAAA,EAAQ;AACpE,YAAA,MAAM,IAAIG,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,6CAA6C,CAAC,CAAA;AAE7F,QAAA;QACA,IAAI0B,gBAAAA,CAAiBK,IAAI,CAAC,CAACC,IAAMA,CAAAA,CAAEhC,KAAK,KAAKA,KAAAA,CAAAA,EAAQ;AACnD,YAAA,MAAM,IAAIG,KAAAA,CAAM,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,wBAAwB,CAAC,CAAA;AACtF,QAAA;AACA0B,QAAAA,gBAAAA,CAAiBO,IAAI,CAAC;AAAEjC,YAAAA,KAAAA;AAAOD,YAAAA,MAAAA;AAAQa,YAAAA;AAAW,SAAA,CAAA;;AAEpD,IAAA,CAAA;AAEA;;;MAIA,MAAMwB,iBAAiB,CAACR,OAAAA,GAAAA;QACtBS,MAAAA,CAAOC,OAAO,CAACV,OAAAA,CAAAA,CAASW,OAAO,CAAC,CAAC,CAACvC,KAAAA,EAAOwC,IAAAA,CAAK,GAAKb,aAAAA,CAAc;AAAE3B,gBAAAA,KAAAA;AAAO,gBAAA,GAAGwC;AAAK,aAAA,CAAA,CAAA;AACpF,IAAA,CAAA;AAEA;;;MAIA,MAAMC,iBAAiB,CAACb,OAAAA,GAAAA;QACtBS,MAAAA,CAAOC,OAAO,CAACV,OAAAA,CAAAA,CAASW,OAAO,CAAC,CAAC,CAACvC,KAAAA,EAAOwC,IAAAA,CAAK,GAAKN,aAAAA,CAAc;AAAElC,gBAAAA,KAAAA;AAAO,gBAAA,GAAGwC;AAAK,aAAA,CAAA,CAAA;AACpF,IAAA,CAAA;2JAGA,MAAME,wBAAAA,GAA2B,CAACC,MAAAA,GAAAA;QAChCA,MAAAA,CAAOJ,OAAO,CAAC,CAACnD,KAAAA,GAAAA;YACd,KAAK,MAAM,EAAEY,KAAK,EAAED,MAAM,EAAEa,UAAU,EAAE,IAAIa,gBAAAA,CAAkB;gBAC5Dd,2BAAAA,CAA4BvB,KAAAA,EAAOY,OAAOD,MAAAA,EAAQa,UAAAA,CAAAA;AACpD,YAAA;YACA,KAAK,MAAM,EAAEZ,KAAK,EAAED,MAAM,EAAEa,UAAU,EAAE,IAAIc,gBAAAA,CAAkB;gBAC5DV,2BAAAA,CAA4B5B,KAAAA,EAAOY,OAAOD,MAAAA,EAAQa,UAAAA,CAAAA;AACpD,YAAA;AACF,QAAA,CAAA,CAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMgC,YAAAA,GAAe,UAAA;AACnB,QAAA,MAAMC,YAA0C,EAAC;AAEjDC,QAAAA,kBAAAA,CAAEP,OAAO,CAACf,MAAAA,CAAOuB,IAAI,EAAE,CAACC,GAAAA,EAAKC,OAAAA,GAAAA;AAC3B,YAAA,MAAMN,SAASG,kBAAAA,CAAEI,OAAO,CAACF,GAAAA,CAAIL,MAAM,EAAE,CAACvD,KAAAA,GAAAA;AACpC,gBAAA,IAAI,YAAYA,KAAAA,EAAO;AACrB,oBAAA,OAAOA,MAAMuD,MAAM;AACrB,gBAAA;gBAEA,OAAOvD,KAAAA;AACT,YAAA,CAAA,CAAA,CAAG+D,MAAM,CAAC1D,gBAAAA,CAAAA;YAEV,IAAIkD,MAAAA,CAAOS,MAAM,KAAK,CAAA,EAAG;AACvB,gBAAA;AACF,YAAA;AAEA,YAAA,MAAMC,SAAAA,GAAY7B,MAAAA,CAAOlC,MAAM,CAACgE,GAAG,CAAC,iBAAA,CAAA;AACpCT,YAAAA,SAAS,CAAC,CAAC,KAAK,EAAEI,OAAAA,CAAAA,CAAS,CAAC,GAAGN,MAAAA,CAAOY,GAAG,CAAC,CAACnE,KAAAA,IAAW;AACpD,oBAAA,GAAGA,KAAK;AACRG,oBAAAA,IAAAA,EAAM,CAAA,EAAG8D,SAAAA,CAAAA,EAAYjE,KAAAA,CAAMG,IAAI,CAAA;iBACjC,CAAA,CAAA;AACF,QAAA,CAAA,CAAA;AAEAuD,QAAAA,kBAAAA,CAAEP,OAAO,CAACf,MAAAA,CAAOgC,OAAO,EAAE,CAACC,MAAAA,EAAQtE,UAAAA,GAAAA;AACjC,YAAA,MAAMuE,kBAAkBxE,uBAAAA,CAAwBC,UAAAA,CAAAA;AAEhD,YAAA,IAAIwE,KAAAA,CAAMC,OAAO,CAACH,MAAAA,CAAOd,MAAM,CAAA,EAAG;AAChC,gBAAA,OAAOc,OAAOd,MAAM,CAACY,GAAG,CAACG,eAAAA,CAAAA,CAAiBP,MAAM,CAAC1D,gBAAAA,CAAAA;AACnD,YAAA;AAEA,YAAA,MAAMkD,SAASG,kBAAAA,CAAEI,OAAO,CAACO,MAAAA,CAAOd,MAAM,EAAE,CAACvD,KAAAA,GAAUA,KAAAA,CAAMuD,MAAM,CAACY,GAAG,CAACG,eAAAA,CAAAA,CAAAA,CAAkBP,MAAM,CAC1F1D,gBAAAA,CAAAA;YAGF,IAAIkD,MAAAA,CAAOS,MAAM,KAAK,CAAA,EAAG;AACvB,gBAAA;AACF,YAAA;AAEA,YAAA,MAAMC,SAAAA,GAAY7B,MAAAA,CAAOlC,MAAM,CAACgE,GAAG,CAAC,iBAAA,CAAA;AACpCT,YAAAA,SAAS,CAAC,CAAC,QAAQ,EAAE1D,UAAAA,CAAAA,CAAY,CAAC,GAAGwD,MAAAA,CAAOY,GAAG,CAAC,CAACnE,KAAAA,IAAW;AAC1D,oBAAA,GAAGA,KAAK;AACRG,oBAAAA,IAAAA,EAAM,CAAA,EAAG8D,SAAAA,CAAAA,EAAYjE,KAAAA,CAAMG,IAAI,CAAA;iBACjC,CAAA,CAAA;AACF,QAAA,CAAA,CAAA;AAEA,QAAA,OAAOsE,6CAAAA,CAAkChB,SAAAA,CAAAA;AAC3C,IAAA,CAAA;IAEA,MAAMiB,SAAAA,GAAYC,oBAAAA,CAASC,mBAAmB,CAAC;AAC7CC,QAAAA,QAAAA,CAAAA,CAASC,GAAW,EAAA;YAClB,OAAO1C,MAAAA,CAAOyC,QAAQ,CAACC,GAAAA,CAAAA;AACzB,QAAA,CAAA;AACA,QAAA,IAAIC,UAAAA,CAAAA,GAAa;YACf,OAAO;AACLC,gBAAAA,KAAAA,EAAO5C,MAAAA,CAAO2C,UAAU,CAACb,GAAG,CAAC,mBAAA,CAAA;AAC7Be,gBAAAA,MAAAA,EAAQ7C,MAAAA,CAAO2C,UAAU,CAACb,GAAG,CAAC,oBAAA;AAChC,aAAA;AACF,QAAA;AACF,KAAA,CAAA;IAEA,MAAMgB,SAAAA,GAAYC,oBAAAA,CAASC,mBAAmB,CAAC;AAC7CP,QAAAA,QAAAA,CAAAA,CAASC,GAAW,EAAA;YAClB,OAAO1C,MAAAA,CAAOyC,QAAQ,CAACC,GAAAA,CAAAA;AACzB,QAAA,CAAA;AACA,QAAA,IAAIO,UAAAA,CAAAA,GAAa;YACf,OAAO;AACLL,gBAAAA,KAAAA,EAAO5C,MAAAA,CAAOiD,UAAU,CAACnB,GAAG,CAAC,mBAAA;AAC/B,aAAA;AACF,QAAA;AACF,KAAA,CAAA;IAEA,OAAO;AACLoB,QAAAA,WAAAA,EAAaC,KAAAA,CAAgCnD,MAAAA,CAAAA;AAC7CoB,QAAAA,YAAAA;QACAmB,QAAAA,EAAUD,SAAAA;QACVS,QAAAA,EAAUD,SAAAA;AACVlC,QAAAA,cAAAA;AACAK,QAAAA,cAAAA;AACAC,QAAAA;AACF,KAAA;AACF;;;;"}

package/dist/services/content-api/permissions/engine.js

@@ -2,7 +2,11 @@
 
 var permissions = require('@strapi/permissions');
 
-var createPermissionEngine = (({ providers })=>permissions.engine.new({
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var permissions__default = /*#__PURE__*/_interopDefault(permissions);
+
+var createPermissionEngine = (({ providers })=>permissions__default.default.engine.new({
         providers
     }));
 

package/dist/services/content-api/permissions/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sources":["../../../../src/services/content-api/permissions/engine.ts"],"sourcesContent":["import permissions from '@strapi/permissions';\n\ntype Options = Parameters<typeof permissions.engine.new>[0];\n\nexport default ({ providers }: Options) => permissions.engine.new({ providers });\n"],"names":["providers","permissions","engine","new"],"mappings":";;;;AAIA,6BAAe,CAAA,CAAC,EAAEA,SAAS,EAAW,GAAKC,WAAAA,CAAYC,MAAM,CAACC,GAAG,CAAC;AAAEH,QAAAA;AAAU,KAAA,CAAC;;;;"}
+{"version":3,"file":"engine.js","sources":["../../../../src/services/content-api/permissions/engine.ts"],"sourcesContent":["import permissions from '@strapi/permissions';\n\ntype Options = Parameters<typeof permissions.engine.new>[0];\n\nexport default ({ providers }: Options) => permissions.engine.new({ providers });\n"],"names":["providers","permissions","engine","new"],"mappings":";;;;;;;;AAIA,6BAAe,CAAA,CAAC,EAAEA,SAAS,EAAW,GAAKC,4BAAAA,CAAYC,MAAM,CAACC,GAAG,CAAC;AAAEH,QAAAA;AAAU,KAAA,CAAC;;;;"}

package/dist/services/content-api/permissions/index.js

@@ -5,6 +5,10 @@ var action = require('./providers/action.js');
 var condition = require('./providers/condition.js');
 var engine = require('./engine.js');
 
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var ___default = /*#__PURE__*/_interopDefault(_);
+
 const typeSymbol = Symbol.for('__type__');
 /**
  * Creates a handler that checks if the permission's action exists in the action registry
@@ -38,7 +42,7 @@ const typeSymbol = Symbol.for('__type__');
      * Check if a controller's action is bound to the
      * content-api by looking at a potential __type__ symbol
      */ const isContentApi = (action)=>{
-            if (!_.has(action, typeSymbol)) {
+            if (!___default.default.has(action, typeSymbol)) {
                 return false;
             }
             return action[typeSymbol].includes('content-api');
@@ -46,16 +50,16 @@ const typeSymbol = Symbol.for('__type__');
         /**
      * Register actions from a specific API source into the result tree
      */ const registerAPIsActions = (apis, source)=>{
-            _.forEach(apis, (api, apiName)=>{
-                const controllers = _.reduce(api.controllers, (acc, controller, controllerName)=>{
-                    const contentApiActions = _.pickBy(controller, isContentApi);
-                    if (_.isEmpty(contentApiActions)) {
+            ___default.default.forEach(apis, (api, apiName)=>{
+                const controllers = ___default.default.reduce(api.controllers, (acc, controller, controllerName)=>{
+                    const contentApiActions = ___default.default.pickBy(controller, isContentApi);
+                    if (___default.default.isEmpty(contentApiActions)) {
                         return acc;
                     }
                     acc[controllerName] = Object.keys(contentApiActions);
                     return acc;
                 }, {});
-                if (!_.isEmpty(controllers)) {
+                if (!___default.default.isEmpty(controllers)) {
                     actionMap[`${source}::${apiName}`] = {
                         controllers
                     };