@strapi/core 5.56.0 → 5.58.0

package/dist/middlewares/body.js.map

@@ -1 +1 @@
-{"version":3,"file":"body.js","sources":["../../src/middlewares/body.ts"],"sourcesContent":["import fse from 'fs-extra';\nimport { defaultsDeep } from 'lodash/fp';\nimport { koaBody, KoaBodyMiddlewareOptions } from 'koa-body';\nimport mime from 'mime-types';\nimport type Koa from 'koa';\nimport type { Core } from '@strapi/types';\n\nexport type Config = KoaBodyMiddlewareOptions;\n\nconst defaults = {\n  multipart: true,\n  patchKoa: true,\n};\n\nfunction ensureFileMimeType(file: any): void {\n  if (!file.type) {\n    file.type = mime.lookup(file.name) || 'application/octet-stream';\n  }\n}\n\nfunction getFiles(ctx: Koa.Context) {\n  return ctx?.request?.files?.files;\n}\n\nconst bodyMiddleware: Core.MiddlewareFactory<Config> = (config, { strapi }) => {\n  const bodyConfig: Config = defaultsDeep(defaults, config);\n\n  let gqlEndpoint: string | undefined;\n  if (strapi.plugin('graphql')) {\n    const { config: gqlConfig } = strapi.plugin('graphql');\n    gqlEndpoint = gqlConfig('endpoint');\n  }\n\n  return async (ctx, next) => {\n    // TODO: find a better way later\n    if (gqlEndpoint && ctx.url === gqlEndpoint) {\n      await next();\n    } else {\n      try {\n        await koaBody(bodyConfig)(ctx, async () => {});\n\n        const files = getFiles(ctx);\n\n        /**\n         * in case the mime-type wasn't sent, Strapi tries to guess it\n         * from the file extension, to avoid a corrupt database state\n         */\n        if (files) {\n          if (Array.isArray(files)) {\n            files.forEach(ensureFileMimeType);\n          } else {\n            ensureFileMimeType(files);\n          }\n        }\n\n        await next();\n      } catch (error) {\n        if (\n          error instanceof Error &&\n          error.message &&\n          error.message.includes('maxFileSize') &&\n          error.message.includes('exceeded')\n        ) {\n          return ctx.payloadTooLarge('FileTooBig');\n        }\n\n        throw error;\n      }\n    }\n\n    const files = getFiles(ctx);\n\n    // clean any file that was uploaded\n    if (files) {\n      if (Array.isArray(files)) {\n        // not awaiting to not slow the request\n        Promise.all(files.map((file) => fse.remove(file.filepath)));\n      } else if (files && files.filepath) {\n        // not awaiting to not slow the request\n        fse.remove(files.filepath);\n      }\n      delete ctx.request.files;\n    }\n  };\n};\n\nexport { bodyMiddleware as body };\n"],"names":["defaults","multipart","patchKoa","ensureFileMimeType","file","type","mime","lookup","name","getFiles","ctx","request","files","bodyMiddleware","config","strapi","bodyConfig","defaultsDeep","gqlEndpoint","plugin","gqlConfig","next","url","koaBody","Array","isArray","forEach","error","Error","message","includes","payloadTooLarge","Promise","all","map","fse","remove","filepath"],"mappings":";;;;;;;;;;;;AASA,MAAMA,QAAAA,GAAW;IACfC,SAAAA,EAAW,IAAA;IACXC,QAAAA,EAAU;AACZ,CAAA;AAEA,SAASC,mBAAmBC,IAAS,EAAA;IACnC,IAAI,CAACA,IAAAA,CAAKC,IAAI,EAAE;AACdD,QAAAA,IAAAA,CAAKC,IAAI,GAAGC,qBAAAA,CAAKC,MAAM,CAACH,IAAAA,CAAKI,IAAI,CAAA,IAAK,0BAAA;AACxC,IAAA;AACF;AAEA,SAASC,SAASC,GAAgB,EAAA;IAChC,OAAOA,GAAAA,EAAKC,SAASC,KAAAA,EAAOA,KAAAA;AAC9B;AAEA,MAAMC,cAAAA,GAAiD,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GAAA;IACxE,MAAMC,UAAAA,GAAqBC,gBAAajB,QAAAA,EAAUc,MAAAA,CAAAA;IAElD,IAAII,WAAAA;IACJ,IAAIH,MAAAA,CAAOI,MAAM,CAAC,SAAA,CAAA,EAAY;AAC5B,QAAA,MAAM,EAAEL,MAAAA,EAAQM,SAAS,EAAE,GAAGL,MAAAA,CAAOI,MAAM,CAAC,SAAA,CAAA;AAC5CD,QAAAA,WAAAA,GAAcE,SAAAA,CAAU,UAAA,CAAA;AAC1B,IAAA;AAEA,IAAA,OAAO,OAAOV,GAAAA,EAAKW,IAAAA,GAAAA;;AAEjB,QAAA,IAAIH,WAAAA,IAAeR,GAAAA,CAAIY,GAAG,KAAKJ,WAAAA,EAAa;YAC1C,MAAMG,IAAAA,EAAAA;QACR,CAAA,MAAO;YACL,IAAI;gBACF,MAAME,eAAAA,CAAQP,UAAAA,CAAAA,CAAYN,GAAAA,EAAK,UAAA,CAAa,CAAA,CAAA;AAE5C,gBAAA,MAAME,QAAQH,QAAAA,CAASC,GAAAA,CAAAA;AAEvB;;;AAGC,YACD,IAAIE,KAAAA,EAAO;oBACT,IAAIY,KAAAA,CAAMC,OAAO,CAACb,KAAAA,CAAAA,EAAQ;AACxBA,wBAAAA,KAAAA,CAAMc,OAAO,CAACvB,kBAAAA,CAAAA;oBAChB,CAAA,MAAO;wBACLA,kBAAAA,CAAmBS,KAAAA,CAAAA;AACrB,oBAAA;AACF,gBAAA;gBAEA,MAAMS,IAAAA,EAAAA;AACR,YAAA,CAAA,CAAE,OAAOM,KAAAA,EAAO;AACd,gBAAA,IACEA,iBAAiBC,KAAAA,IACjBD,KAAAA,CAAME,OAAO,IACbF,MAAME,OAAO,CAACC,QAAQ,CAAC,kBACvBH,KAAAA,CAAME,OAAO,CAACC,QAAQ,CAAC,UAAA,CAAA,EACvB;oBACA,OAAOpB,GAAAA,CAAIqB,eAAe,CAAC,YAAA,CAAA;AAC7B,gBAAA;gBAEA,MAAMJ,KAAAA;AACR,YAAA;AACF,QAAA;AAEA,QAAA,MAAMf,QAAQH,QAAAA,CAASC,GAAAA,CAAAA;;AAGvB,QAAA,IAAIE,KAAAA,EAAO;YACT,IAAIY,KAAAA,CAAMC,OAAO,CAACb,KAAAA,CAAAA,EAAQ;;gBAExBoB,OAAAA,CAAQC,GAAG,CAACrB,KAAAA,CAAMsB,GAAG,CAAC,CAAC9B,IAAAA,GAAS+B,oBAAAA,CAAIC,MAAM,CAAChC,IAAAA,CAAKiC,QAAQ,CAAA,CAAA,CAAA;AAC1D,YAAA,CAAA,MAAO,IAAIzB,KAAAA,IAASA,KAAAA,CAAMyB,QAAQ,EAAE;;gBAElCF,oBAAAA,CAAIC,MAAM,CAACxB,KAAAA,CAAMyB,QAAQ,CAAA;AAC3B,YAAA;YACA,OAAO3B,GAAAA,CAAIC,OAAO,CAACC,KAAK;AAC1B,QAAA;AACF,IAAA,CAAA;AACF;;;;"}
+{"version":3,"file":"body.js","sources":["../../src/middlewares/body.ts"],"sourcesContent":["import fse from 'fs-extra';\nimport { defaultsDeep } from 'lodash';\nimport { koaBody, KoaBodyMiddlewareOptions } from 'koa-body';\nimport mime from 'mime-types';\nimport type Koa from 'koa';\nimport type { Core } from '@strapi/types';\n\nexport type Config = KoaBodyMiddlewareOptions;\n\nconst defaults = {\n  multipart: true,\n  patchKoa: true,\n};\n\nfunction ensureFileMimeType(file: any): void {\n  if (!file.type) {\n    file.type = mime.lookup(file.name) || 'application/octet-stream';\n  }\n}\n\nfunction getFiles(ctx: Koa.Context) {\n  return ctx?.request?.files?.files;\n}\n\nconst bodyMiddleware: Core.MiddlewareFactory<Config> = (config, { strapi }) => {\n  const bodyConfig: Config = defaultsDeep({}, config, defaults);\n\n  let gqlEndpoint: string | undefined;\n  if (strapi.plugin('graphql')) {\n    const { config: gqlConfig } = strapi.plugin('graphql');\n    gqlEndpoint = gqlConfig('endpoint');\n  }\n\n  return async (ctx, next) => {\n    // TODO: find a better way later\n    if (gqlEndpoint && ctx.url === gqlEndpoint) {\n      await next();\n    } else {\n      try {\n        await koaBody(bodyConfig)(ctx, async () => {});\n\n        const files = getFiles(ctx);\n\n        /**\n         * in case the mime-type wasn't sent, Strapi tries to guess it\n         * from the file extension, to avoid a corrupt database state\n         */\n        if (files) {\n          if (Array.isArray(files)) {\n            files.forEach(ensureFileMimeType);\n          } else {\n            ensureFileMimeType(files);\n          }\n        }\n\n        await next();\n      } catch (error) {\n        if (\n          error instanceof Error &&\n          error.message &&\n          error.message.includes('maxFileSize') &&\n          error.message.includes('exceeded')\n        ) {\n          return ctx.payloadTooLarge('FileTooBig');\n        }\n\n        throw error;\n      }\n    }\n\n    const files = getFiles(ctx);\n\n    // clean any file that was uploaded\n    if (files) {\n      if (Array.isArray(files)) {\n        // not awaiting to not slow the request\n        Promise.all(files.map((file) => fse.remove(file.filepath)));\n      } else if (files && files.filepath) {\n        // not awaiting to not slow the request\n        fse.remove(files.filepath);\n      }\n      delete ctx.request.files;\n    }\n  };\n};\n\nexport { bodyMiddleware as body };\n"],"names":["defaults","multipart","patchKoa","ensureFileMimeType","file","type","mime","lookup","name","getFiles","ctx","request","files","bodyMiddleware","config","strapi","bodyConfig","defaultsDeep","gqlEndpoint","plugin","gqlConfig","next","url","koaBody","Array","isArray","forEach","error","Error","message","includes","payloadTooLarge","Promise","all","map","fse","remove","filepath"],"mappings":";;;;;;;;;;;;AASA,MAAMA,QAAAA,GAAW;IACfC,SAAAA,EAAW,IAAA;IACXC,QAAAA,EAAU;AACZ,CAAA;AAEA,SAASC,mBAAmBC,IAAS,EAAA;IACnC,IAAI,CAACA,IAAAA,CAAKC,IAAI,EAAE;AACdD,QAAAA,IAAAA,CAAKC,IAAI,GAAGC,qBAAAA,CAAKC,MAAM,CAACH,IAAAA,CAAKI,IAAI,CAAA,IAAK,0BAAA;AACxC,IAAA;AACF;AAEA,SAASC,SAASC,GAAgB,EAAA;IAChC,OAAOA,GAAAA,EAAKC,SAASC,KAAAA,EAAOA,KAAAA;AAC9B;AAEA,MAAMC,cAAAA,GAAiD,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GAAA;AACxE,IAAA,MAAMC,UAAAA,GAAqBC,cAAAA,CAAa,EAAC,EAAGH,MAAAA,EAAQd,QAAAA,CAAAA;IAEpD,IAAIkB,WAAAA;IACJ,IAAIH,MAAAA,CAAOI,MAAM,CAAC,SAAA,CAAA,EAAY;AAC5B,QAAA,MAAM,EAAEL,MAAAA,EAAQM,SAAS,EAAE,GAAGL,MAAAA,CAAOI,MAAM,CAAC,SAAA,CAAA;AAC5CD,QAAAA,WAAAA,GAAcE,SAAAA,CAAU,UAAA,CAAA;AAC1B,IAAA;AAEA,IAAA,OAAO,OAAOV,GAAAA,EAAKW,IAAAA,GAAAA;;AAEjB,QAAA,IAAIH,WAAAA,IAAeR,GAAAA,CAAIY,GAAG,KAAKJ,WAAAA,EAAa;YAC1C,MAAMG,IAAAA,EAAAA;QACR,CAAA,MAAO;YACL,IAAI;gBACF,MAAME,eAAAA,CAAQP,UAAAA,CAAAA,CAAYN,GAAAA,EAAK,UAAA,CAAa,CAAA,CAAA;AAE5C,gBAAA,MAAME,QAAQH,QAAAA,CAASC,GAAAA,CAAAA;AAEvB;;;AAGC,YACD,IAAIE,KAAAA,EAAO;oBACT,IAAIY,KAAAA,CAAMC,OAAO,CAACb,KAAAA,CAAAA,EAAQ;AACxBA,wBAAAA,KAAAA,CAAMc,OAAO,CAACvB,kBAAAA,CAAAA;oBAChB,CAAA,MAAO;wBACLA,kBAAAA,CAAmBS,KAAAA,CAAAA;AACrB,oBAAA;AACF,gBAAA;gBAEA,MAAMS,IAAAA,EAAAA;AACR,YAAA,CAAA,CAAE,OAAOM,KAAAA,EAAO;AACd,gBAAA,IACEA,iBAAiBC,KAAAA,IACjBD,KAAAA,CAAME,OAAO,IACbF,MAAME,OAAO,CAACC,QAAQ,CAAC,kBACvBH,KAAAA,CAAME,OAAO,CAACC,QAAQ,CAAC,UAAA,CAAA,EACvB;oBACA,OAAOpB,GAAAA,CAAIqB,eAAe,CAAC,YAAA,CAAA;AAC7B,gBAAA;gBAEA,MAAMJ,KAAAA;AACR,YAAA;AACF,QAAA;AAEA,QAAA,MAAMf,QAAQH,QAAAA,CAASC,GAAAA,CAAAA;;AAGvB,QAAA,IAAIE,KAAAA,EAAO;YACT,IAAIY,KAAAA,CAAMC,OAAO,CAACb,KAAAA,CAAAA,EAAQ;;gBAExBoB,OAAAA,CAAQC,GAAG,CAACrB,KAAAA,CAAMsB,GAAG,CAAC,CAAC9B,IAAAA,GAAS+B,oBAAAA,CAAIC,MAAM,CAAChC,IAAAA,CAAKiC,QAAQ,CAAA,CAAA,CAAA;AAC1D,YAAA,CAAA,MAAO,IAAIzB,KAAAA,IAASA,KAAAA,CAAMyB,QAAQ,EAAE;;gBAElCF,oBAAAA,CAAIC,MAAM,CAACxB,KAAAA,CAAMyB,QAAQ,CAAA;AAC3B,YAAA;YACA,OAAO3B,GAAAA,CAAIC,OAAO,CAACC,KAAK;AAC1B,QAAA;AACF,IAAA,CAAA;AACF;;;;"}

package/dist/middlewares/body.mjs

@@ -1,5 +1,5 @@
 import fse from 'fs-extra';
-import { defaultsDeep } from 'lodash/fp';
+import { defaultsDeep } from 'lodash';
 import { koaBody } from 'koa-body';
 import mime from 'mime-types';
 
@@ -16,7 +16,7 @@ function getFiles(ctx) {
     return ctx?.request?.files?.files;
 }
 const bodyMiddleware = (config, { strapi })=>{
-    const bodyConfig = defaultsDeep(defaults, config);
+    const bodyConfig = defaultsDeep({}, config, defaults);
     let gqlEndpoint;
     if (strapi.plugin('graphql')) {
         const { config: gqlConfig } = strapi.plugin('graphql');

package/dist/middlewares/body.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"body.mjs","sources":["../../src/middlewares/body.ts"],"sourcesContent":["import fse from 'fs-extra';\nimport { defaultsDeep } from 'lodash/fp';\nimport { koaBody, KoaBodyMiddlewareOptions } from 'koa-body';\nimport mime from 'mime-types';\nimport type Koa from 'koa';\nimport type { Core } from '@strapi/types';\n\nexport type Config = KoaBodyMiddlewareOptions;\n\nconst defaults = {\n  multipart: true,\n  patchKoa: true,\n};\n\nfunction ensureFileMimeType(file: any): void {\n  if (!file.type) {\n    file.type = mime.lookup(file.name) || 'application/octet-stream';\n  }\n}\n\nfunction getFiles(ctx: Koa.Context) {\n  return ctx?.request?.files?.files;\n}\n\nconst bodyMiddleware: Core.MiddlewareFactory<Config> = (config, { strapi }) => {\n  const bodyConfig: Config = defaultsDeep(defaults, config);\n\n  let gqlEndpoint: string | undefined;\n  if (strapi.plugin('graphql')) {\n    const { config: gqlConfig } = strapi.plugin('graphql');\n    gqlEndpoint = gqlConfig('endpoint');\n  }\n\n  return async (ctx, next) => {\n    // TODO: find a better way later\n    if (gqlEndpoint && ctx.url === gqlEndpoint) {\n      await next();\n    } else {\n      try {\n        await koaBody(bodyConfig)(ctx, async () => {});\n\n        const files = getFiles(ctx);\n\n        /**\n         * in case the mime-type wasn't sent, Strapi tries to guess it\n         * from the file extension, to avoid a corrupt database state\n         */\n        if (files) {\n          if (Array.isArray(files)) {\n            files.forEach(ensureFileMimeType);\n          } else {\n            ensureFileMimeType(files);\n          }\n        }\n\n        await next();\n      } catch (error) {\n        if (\n          error instanceof Error &&\n          error.message &&\n          error.message.includes('maxFileSize') &&\n          error.message.includes('exceeded')\n        ) {\n          return ctx.payloadTooLarge('FileTooBig');\n        }\n\n        throw error;\n      }\n    }\n\n    const files = getFiles(ctx);\n\n    // clean any file that was uploaded\n    if (files) {\n      if (Array.isArray(files)) {\n        // not awaiting to not slow the request\n        Promise.all(files.map((file) => fse.remove(file.filepath)));\n      } else if (files && files.filepath) {\n        // not awaiting to not slow the request\n        fse.remove(files.filepath);\n      }\n      delete ctx.request.files;\n    }\n  };\n};\n\nexport { bodyMiddleware as body };\n"],"names":["defaults","multipart","patchKoa","ensureFileMimeType","file","type","mime","lookup","name","getFiles","ctx","request","files","bodyMiddleware","config","strapi","bodyConfig","defaultsDeep","gqlEndpoint","plugin","gqlConfig","next","url","koaBody","Array","isArray","forEach","error","Error","message","includes","payloadTooLarge","Promise","all","map","fse","remove","filepath"],"mappings":";;;;;AASA,MAAMA,QAAAA,GAAW;IACfC,SAAAA,EAAW,IAAA;IACXC,QAAAA,EAAU;AACZ,CAAA;AAEA,SAASC,mBAAmBC,IAAS,EAAA;IACnC,IAAI,CAACA,IAAAA,CAAKC,IAAI,EAAE;AACdD,QAAAA,IAAAA,CAAKC,IAAI,GAAGC,IAAAA,CAAKC,MAAM,CAACH,IAAAA,CAAKI,IAAI,CAAA,IAAK,0BAAA;AACxC,IAAA;AACF;AAEA,SAASC,SAASC,GAAgB,EAAA;IAChC,OAAOA,GAAAA,EAAKC,SAASC,KAAAA,EAAOA,KAAAA;AAC9B;AAEA,MAAMC,cAAAA,GAAiD,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GAAA;IACxE,MAAMC,UAAAA,GAAqBC,aAAajB,QAAAA,EAAUc,MAAAA,CAAAA;IAElD,IAAII,WAAAA;IACJ,IAAIH,MAAAA,CAAOI,MAAM,CAAC,SAAA,CAAA,EAAY;AAC5B,QAAA,MAAM,EAAEL,MAAAA,EAAQM,SAAS,EAAE,GAAGL,MAAAA,CAAOI,MAAM,CAAC,SAAA,CAAA;AAC5CD,QAAAA,WAAAA,GAAcE,SAAAA,CAAU,UAAA,CAAA;AAC1B,IAAA;AAEA,IAAA,OAAO,OAAOV,GAAAA,EAAKW,IAAAA,GAAAA;;AAEjB,QAAA,IAAIH,WAAAA,IAAeR,GAAAA,CAAIY,GAAG,KAAKJ,WAAAA,EAAa;YAC1C,MAAMG,IAAAA,EAAAA;QACR,CAAA,MAAO;YACL,IAAI;gBACF,MAAME,OAAAA,CAAQP,UAAAA,CAAAA,CAAYN,GAAAA,EAAK,UAAA,CAAa,CAAA,CAAA;AAE5C,gBAAA,MAAME,QAAQH,QAAAA,CAASC,GAAAA,CAAAA;AAEvB;;;AAGC,YACD,IAAIE,KAAAA,EAAO;oBACT,IAAIY,KAAAA,CAAMC,OAAO,CAACb,KAAAA,CAAAA,EAAQ;AACxBA,wBAAAA,KAAAA,CAAMc,OAAO,CAACvB,kBAAAA,CAAAA;oBAChB,CAAA,MAAO;wBACLA,kBAAAA,CAAmBS,KAAAA,CAAAA;AACrB,oBAAA;AACF,gBAAA;gBAEA,MAAMS,IAAAA,EAAAA;AACR,YAAA,CAAA,CAAE,OAAOM,KAAAA,EAAO;AACd,gBAAA,IACEA,iBAAiBC,KAAAA,IACjBD,KAAAA,CAAME,OAAO,IACbF,MAAME,OAAO,CAACC,QAAQ,CAAC,kBACvBH,KAAAA,CAAME,OAAO,CAACC,QAAQ,CAAC,UAAA,CAAA,EACvB;oBACA,OAAOpB,GAAAA,CAAIqB,eAAe,CAAC,YAAA,CAAA;AAC7B,gBAAA;gBAEA,MAAMJ,KAAAA;AACR,YAAA;AACF,QAAA;AAEA,QAAA,MAAMf,QAAQH,QAAAA,CAASC,GAAAA,CAAAA;;AAGvB,QAAA,IAAIE,KAAAA,EAAO;YACT,IAAIY,KAAAA,CAAMC,OAAO,CAACb,KAAAA,CAAAA,EAAQ;;gBAExBoB,OAAAA,CAAQC,GAAG,CAACrB,KAAAA,CAAMsB,GAAG,CAAC,CAAC9B,IAAAA,GAAS+B,GAAAA,CAAIC,MAAM,CAAChC,IAAAA,CAAKiC,QAAQ,CAAA,CAAA,CAAA;AAC1D,YAAA,CAAA,MAAO,IAAIzB,KAAAA,IAASA,KAAAA,CAAMyB,QAAQ,EAAE;;gBAElCF,GAAAA,CAAIC,MAAM,CAACxB,KAAAA,CAAMyB,QAAQ,CAAA;AAC3B,YAAA;YACA,OAAO3B,GAAAA,CAAIC,OAAO,CAACC,KAAK;AAC1B,QAAA;AACF,IAAA,CAAA;AACF;;;;"}
+{"version":3,"file":"body.mjs","sources":["../../src/middlewares/body.ts"],"sourcesContent":["import fse from 'fs-extra';\nimport { defaultsDeep } from 'lodash';\nimport { koaBody, KoaBodyMiddlewareOptions } from 'koa-body';\nimport mime from 'mime-types';\nimport type Koa from 'koa';\nimport type { Core } from '@strapi/types';\n\nexport type Config = KoaBodyMiddlewareOptions;\n\nconst defaults = {\n  multipart: true,\n  patchKoa: true,\n};\n\nfunction ensureFileMimeType(file: any): void {\n  if (!file.type) {\n    file.type = mime.lookup(file.name) || 'application/octet-stream';\n  }\n}\n\nfunction getFiles(ctx: Koa.Context) {\n  return ctx?.request?.files?.files;\n}\n\nconst bodyMiddleware: Core.MiddlewareFactory<Config> = (config, { strapi }) => {\n  const bodyConfig: Config = defaultsDeep({}, config, defaults);\n\n  let gqlEndpoint: string | undefined;\n  if (strapi.plugin('graphql')) {\n    const { config: gqlConfig } = strapi.plugin('graphql');\n    gqlEndpoint = gqlConfig('endpoint');\n  }\n\n  return async (ctx, next) => {\n    // TODO: find a better way later\n    if (gqlEndpoint && ctx.url === gqlEndpoint) {\n      await next();\n    } else {\n      try {\n        await koaBody(bodyConfig)(ctx, async () => {});\n\n        const files = getFiles(ctx);\n\n        /**\n         * in case the mime-type wasn't sent, Strapi tries to guess it\n         * from the file extension, to avoid a corrupt database state\n         */\n        if (files) {\n          if (Array.isArray(files)) {\n            files.forEach(ensureFileMimeType);\n          } else {\n            ensureFileMimeType(files);\n          }\n        }\n\n        await next();\n      } catch (error) {\n        if (\n          error instanceof Error &&\n          error.message &&\n          error.message.includes('maxFileSize') &&\n          error.message.includes('exceeded')\n        ) {\n          return ctx.payloadTooLarge('FileTooBig');\n        }\n\n        throw error;\n      }\n    }\n\n    const files = getFiles(ctx);\n\n    // clean any file that was uploaded\n    if (files) {\n      if (Array.isArray(files)) {\n        // not awaiting to not slow the request\n        Promise.all(files.map((file) => fse.remove(file.filepath)));\n      } else if (files && files.filepath) {\n        // not awaiting to not slow the request\n        fse.remove(files.filepath);\n      }\n      delete ctx.request.files;\n    }\n  };\n};\n\nexport { bodyMiddleware as body };\n"],"names":["defaults","multipart","patchKoa","ensureFileMimeType","file","type","mime","lookup","name","getFiles","ctx","request","files","bodyMiddleware","config","strapi","bodyConfig","defaultsDeep","gqlEndpoint","plugin","gqlConfig","next","url","koaBody","Array","isArray","forEach","error","Error","message","includes","payloadTooLarge","Promise","all","map","fse","remove","filepath"],"mappings":";;;;;AASA,MAAMA,QAAAA,GAAW;IACfC,SAAAA,EAAW,IAAA;IACXC,QAAAA,EAAU;AACZ,CAAA;AAEA,SAASC,mBAAmBC,IAAS,EAAA;IACnC,IAAI,CAACA,IAAAA,CAAKC,IAAI,EAAE;AACdD,QAAAA,IAAAA,CAAKC,IAAI,GAAGC,IAAAA,CAAKC,MAAM,CAACH,IAAAA,CAAKI,IAAI,CAAA,IAAK,0BAAA;AACxC,IAAA;AACF;AAEA,SAASC,SAASC,GAAgB,EAAA;IAChC,OAAOA,GAAAA,EAAKC,SAASC,KAAAA,EAAOA,KAAAA;AAC9B;AAEA,MAAMC,cAAAA,GAAiD,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GAAA;AACxE,IAAA,MAAMC,UAAAA,GAAqBC,YAAAA,CAAa,EAAC,EAAGH,MAAAA,EAAQd,QAAAA,CAAAA;IAEpD,IAAIkB,WAAAA;IACJ,IAAIH,MAAAA,CAAOI,MAAM,CAAC,SAAA,CAAA,EAAY;AAC5B,QAAA,MAAM,EAAEL,MAAAA,EAAQM,SAAS,EAAE,GAAGL,MAAAA,CAAOI,MAAM,CAAC,SAAA,CAAA;AAC5CD,QAAAA,WAAAA,GAAcE,SAAAA,CAAU,UAAA,CAAA;AAC1B,IAAA;AAEA,IAAA,OAAO,OAAOV,GAAAA,EAAKW,IAAAA,GAAAA;;AAEjB,QAAA,IAAIH,WAAAA,IAAeR,GAAAA,CAAIY,GAAG,KAAKJ,WAAAA,EAAa;YAC1C,MAAMG,IAAAA,EAAAA;QACR,CAAA,MAAO;YACL,IAAI;gBACF,MAAME,OAAAA,CAAQP,UAAAA,CAAAA,CAAYN,GAAAA,EAAK,UAAA,CAAa,CAAA,CAAA;AAE5C,gBAAA,MAAME,QAAQH,QAAAA,CAASC,GAAAA,CAAAA;AAEvB;;;AAGC,YACD,IAAIE,KAAAA,EAAO;oBACT,IAAIY,KAAAA,CAAMC,OAAO,CAACb,KAAAA,CAAAA,EAAQ;AACxBA,wBAAAA,KAAAA,CAAMc,OAAO,CAACvB,kBAAAA,CAAAA;oBAChB,CAAA,MAAO;wBACLA,kBAAAA,CAAmBS,KAAAA,CAAAA;AACrB,oBAAA;AACF,gBAAA;gBAEA,MAAMS,IAAAA,EAAAA;AACR,YAAA,CAAA,CAAE,OAAOM,KAAAA,EAAO;AACd,gBAAA,IACEA,iBAAiBC,KAAAA,IACjBD,KAAAA,CAAME,OAAO,IACbF,MAAME,OAAO,CAACC,QAAQ,CAAC,kBACvBH,KAAAA,CAAME,OAAO,CAACC,QAAQ,CAAC,UAAA,CAAA,EACvB;oBACA,OAAOpB,GAAAA,CAAIqB,eAAe,CAAC,YAAA,CAAA;AAC7B,gBAAA;gBAEA,MAAMJ,KAAAA;AACR,YAAA;AACF,QAAA;AAEA,QAAA,MAAMf,QAAQH,QAAAA,CAASC,GAAAA,CAAAA;;AAGvB,QAAA,IAAIE,KAAAA,EAAO;YACT,IAAIY,KAAAA,CAAMC,OAAO,CAACb,KAAAA,CAAAA,EAAQ;;gBAExBoB,OAAAA,CAAQC,GAAG,CAACrB,KAAAA,CAAMsB,GAAG,CAAC,CAAC9B,IAAAA,GAAS+B,GAAAA,CAAIC,MAAM,CAAChC,IAAAA,CAAKiC,QAAQ,CAAA,CAAA,CAAA;AAC1D,YAAA,CAAA,MAAO,IAAIzB,KAAAA,IAASA,KAAAA,CAAMyB,QAAQ,EAAE;;gBAElCF,GAAAA,CAAIC,MAAM,CAACxB,KAAAA,CAAMyB,QAAQ,CAAA;AAC3B,YAAA;YACA,OAAO3B,GAAAA,CAAIC,OAAO,CAACC,KAAK;AAC1B,QAAA;AACF,IAAA,CAAA;AACF;;;;"}

package/dist/middlewares/public.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var fp = require('lodash/fp');
+var _ = require('lodash');
 var koaStatic = require('koa-static');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -11,7 +11,7 @@ const defaults = {
     maxAge: 60000
 };
 const publicStatic = (config, { strapi })=>{
-    const { maxAge } = fp.defaultsDeep(defaults, config);
+    const { maxAge } = _.defaultsDeep({}, config, defaults);
     strapi.server.routes([
         {
             method: 'GET',

package/dist/middlewares/public.js.map

@@ -1 +1 @@
-{"version":3,"file":"public.js","sources":["../../src/middlewares/public.ts"],"sourcesContent":["import { defaultsDeep } from 'lodash/fp';\nimport koaStatic from 'koa-static';\nimport type { Core } from '@strapi/types';\n\ntype Config = koaStatic.Options;\n\nconst defaults = {\n  maxAge: 60000,\n};\n\nexport const publicStatic: Core.MiddlewareFactory = (\n  config: Config,\n  { strapi }: { strapi: Core.Strapi }\n) => {\n  const { maxAge } = defaultsDeep(defaults, config);\n\n  strapi.server.routes([\n    {\n      method: 'GET',\n      path: '/',\n      handler(ctx) {\n        ctx.redirect(strapi.config.get('admin.url', '/admin'));\n      },\n      config: { auth: false },\n    },\n    // All other public GET-routes except /uploads/(.*) which is handled in upload middleware\n    {\n      method: 'GET',\n      path: '/((?!uploads/).+)',\n      handler: koaStatic(strapi.dirs.static.public, {\n        maxage: maxAge,\n        defer: true,\n      }),\n      config: { auth: false },\n    },\n  ]);\n};\n"],"names":["defaults","maxAge","publicStatic","config","strapi","defaultsDeep","server","routes","method","path","handler","ctx","redirect","get","auth","koaStatic","dirs","static","public","maxage","defer"],"mappings":";;;;;;;;;AAMA,MAAMA,QAAAA,GAAW;IACfC,MAAAA,EAAQ;AACV,CAAA;MAEaC,YAAAA,GAAuC,CAClDC,MAAAA,EACA,EAAEC,MAAM,EAA2B,GAAA;AAEnC,IAAA,MAAM,EAAEH,MAAM,EAAE,GAAGI,gBAAaL,QAAAA,EAAUG,MAAAA,CAAAA;IAE1CC,MAAAA,CAAOE,MAAM,CAACC,MAAM,CAAC;AACnB,QAAA;YACEC,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,GAAA;AACNC,YAAAA,OAAAA,CAAAA,CAAQC,GAAG,EAAA;AACTA,gBAAAA,GAAAA,CAAIC,QAAQ,CAACR,MAAAA,CAAOD,MAAM,CAACU,GAAG,CAAC,WAAA,EAAa,QAAA,CAAA,CAAA;AAC9C,YAAA,CAAA;YACAV,MAAAA,EAAQ;gBAAEW,IAAAA,EAAM;AAAM;AACxB,SAAA;;AAEA,QAAA;YACEN,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,mBAAA;AACNC,YAAAA,OAAAA,EAASK,2BAAUX,MAAAA,CAAOY,IAAI,CAACC,MAAM,CAACC,MAAM,EAAE;gBAC5CC,MAAAA,EAAQlB,MAAAA;gBACRmB,KAAAA,EAAO;AACT,aAAA,CAAA;YACAjB,MAAAA,EAAQ;gBAAEW,IAAAA,EAAM;AAAM;AACxB;AACD,KAAA,CAAA;AACH;;;;"}
+{"version":3,"file":"public.js","sources":["../../src/middlewares/public.ts"],"sourcesContent":["import { defaultsDeep } from 'lodash';\nimport koaStatic from 'koa-static';\nimport type { Core } from '@strapi/types';\n\ntype Config = koaStatic.Options;\n\nconst defaults = {\n  maxAge: 60000,\n};\n\nexport const publicStatic: Core.MiddlewareFactory = (\n  config: Config,\n  { strapi }: { strapi: Core.Strapi }\n) => {\n  const { maxAge } = defaultsDeep({}, config, defaults);\n\n  strapi.server.routes([\n    {\n      method: 'GET',\n      path: '/',\n      handler(ctx) {\n        ctx.redirect(strapi.config.get('admin.url', '/admin'));\n      },\n      config: { auth: false },\n    },\n    // All other public GET-routes except /uploads/(.*) which is handled in upload middleware\n    {\n      method: 'GET',\n      path: '/((?!uploads/).+)',\n      handler: koaStatic(strapi.dirs.static.public, {\n        maxage: maxAge,\n        defer: true,\n      }),\n      config: { auth: false },\n    },\n  ]);\n};\n"],"names":["defaults","maxAge","publicStatic","config","strapi","defaultsDeep","server","routes","method","path","handler","ctx","redirect","get","auth","koaStatic","dirs","static","public","maxage","defer"],"mappings":";;;;;;;;;AAMA,MAAMA,QAAAA,GAAW;IACfC,MAAAA,EAAQ;AACV,CAAA;MAEaC,YAAAA,GAAuC,CAClDC,MAAAA,EACA,EAAEC,MAAM,EAA2B,GAAA;AAEnC,IAAA,MAAM,EAAEH,MAAM,EAAE,GAAGI,cAAAA,CAAa,IAAIF,MAAAA,EAAQH,QAAAA,CAAAA;IAE5CI,MAAAA,CAAOE,MAAM,CAACC,MAAM,CAAC;AACnB,QAAA;YACEC,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,GAAA;AACNC,YAAAA,OAAAA,CAAAA,CAAQC,GAAG,EAAA;AACTA,gBAAAA,GAAAA,CAAIC,QAAQ,CAACR,MAAAA,CAAOD,MAAM,CAACU,GAAG,CAAC,WAAA,EAAa,QAAA,CAAA,CAAA;AAC9C,YAAA,CAAA;YACAV,MAAAA,EAAQ;gBAAEW,IAAAA,EAAM;AAAM;AACxB,SAAA;;AAEA,QAAA;YACEN,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,mBAAA;AACNC,YAAAA,OAAAA,EAASK,2BAAUX,MAAAA,CAAOY,IAAI,CAACC,MAAM,CAACC,MAAM,EAAE;gBAC5CC,MAAAA,EAAQlB,MAAAA;gBACRmB,KAAAA,EAAO;AACT,aAAA,CAAA;YACAjB,MAAAA,EAAQ;gBAAEW,IAAAA,EAAM;AAAM;AACxB;AACD,KAAA,CAAA;AACH;;;;"}

package/dist/middlewares/public.mjs

@@ -1,11 +1,11 @@
-import { defaultsDeep } from 'lodash/fp';
+import { defaultsDeep } from 'lodash';
 import koaStatic from 'koa-static';
 
 const defaults = {
     maxAge: 60000
 };
 const publicStatic = (config, { strapi })=>{
-    const { maxAge } = defaultsDeep(defaults, config);
+    const { maxAge } = defaultsDeep({}, config, defaults);
     strapi.server.routes([
         {
             method: 'GET',

package/dist/middlewares/public.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"public.mjs","sources":["../../src/middlewares/public.ts"],"sourcesContent":["import { defaultsDeep } from 'lodash/fp';\nimport koaStatic from 'koa-static';\nimport type { Core } from '@strapi/types';\n\ntype Config = koaStatic.Options;\n\nconst defaults = {\n  maxAge: 60000,\n};\n\nexport const publicStatic: Core.MiddlewareFactory = (\n  config: Config,\n  { strapi }: { strapi: Core.Strapi }\n) => {\n  const { maxAge } = defaultsDeep(defaults, config);\n\n  strapi.server.routes([\n    {\n      method: 'GET',\n      path: '/',\n      handler(ctx) {\n        ctx.redirect(strapi.config.get('admin.url', '/admin'));\n      },\n      config: { auth: false },\n    },\n    // All other public GET-routes except /uploads/(.*) which is handled in upload middleware\n    {\n      method: 'GET',\n      path: '/((?!uploads/).+)',\n      handler: koaStatic(strapi.dirs.static.public, {\n        maxage: maxAge,\n        defer: true,\n      }),\n      config: { auth: false },\n    },\n  ]);\n};\n"],"names":["defaults","maxAge","publicStatic","config","strapi","defaultsDeep","server","routes","method","path","handler","ctx","redirect","get","auth","koaStatic","dirs","static","public","maxage","defer"],"mappings":";;;AAMA,MAAMA,QAAAA,GAAW;IACfC,MAAAA,EAAQ;AACV,CAAA;MAEaC,YAAAA,GAAuC,CAClDC,MAAAA,EACA,EAAEC,MAAM,EAA2B,GAAA;AAEnC,IAAA,MAAM,EAAEH,MAAM,EAAE,GAAGI,aAAaL,QAAAA,EAAUG,MAAAA,CAAAA;IAE1CC,MAAAA,CAAOE,MAAM,CAACC,MAAM,CAAC;AACnB,QAAA;YACEC,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,GAAA;AACNC,YAAAA,OAAAA,CAAAA,CAAQC,GAAG,EAAA;AACTA,gBAAAA,GAAAA,CAAIC,QAAQ,CAACR,MAAAA,CAAOD,MAAM,CAACU,GAAG,CAAC,WAAA,EAAa,QAAA,CAAA,CAAA;AAC9C,YAAA,CAAA;YACAV,MAAAA,EAAQ;gBAAEW,IAAAA,EAAM;AAAM;AACxB,SAAA;;AAEA,QAAA;YACEN,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,mBAAA;AACNC,YAAAA,OAAAA,EAASK,UAAUX,MAAAA,CAAOY,IAAI,CAACC,MAAM,CAACC,MAAM,EAAE;gBAC5CC,MAAAA,EAAQlB,MAAAA;gBACRmB,KAAAA,EAAO;AACT,aAAA,CAAA;YACAjB,MAAAA,EAAQ;gBAAEW,IAAAA,EAAM;AAAM;AACxB;AACD,KAAA,CAAA;AACH;;;;"}
+{"version":3,"file":"public.mjs","sources":["../../src/middlewares/public.ts"],"sourcesContent":["import { defaultsDeep } from 'lodash';\nimport koaStatic from 'koa-static';\nimport type { Core } from '@strapi/types';\n\ntype Config = koaStatic.Options;\n\nconst defaults = {\n  maxAge: 60000,\n};\n\nexport const publicStatic: Core.MiddlewareFactory = (\n  config: Config,\n  { strapi }: { strapi: Core.Strapi }\n) => {\n  const { maxAge } = defaultsDeep({}, config, defaults);\n\n  strapi.server.routes([\n    {\n      method: 'GET',\n      path: '/',\n      handler(ctx) {\n        ctx.redirect(strapi.config.get('admin.url', '/admin'));\n      },\n      config: { auth: false },\n    },\n    // All other public GET-routes except /uploads/(.*) which is handled in upload middleware\n    {\n      method: 'GET',\n      path: '/((?!uploads/).+)',\n      handler: koaStatic(strapi.dirs.static.public, {\n        maxage: maxAge,\n        defer: true,\n      }),\n      config: { auth: false },\n    },\n  ]);\n};\n"],"names":["defaults","maxAge","publicStatic","config","strapi","defaultsDeep","server","routes","method","path","handler","ctx","redirect","get","auth","koaStatic","dirs","static","public","maxage","defer"],"mappings":";;;AAMA,MAAMA,QAAAA,GAAW;IACfC,MAAAA,EAAQ;AACV,CAAA;MAEaC,YAAAA,GAAuC,CAClDC,MAAAA,EACA,EAAEC,MAAM,EAA2B,GAAA;AAEnC,IAAA,MAAM,EAAEH,MAAM,EAAE,GAAGI,YAAAA,CAAa,IAAIF,MAAAA,EAAQH,QAAAA,CAAAA;IAE5CI,MAAAA,CAAOE,MAAM,CAACC,MAAM,CAAC;AACnB,QAAA;YACEC,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,GAAA;AACNC,YAAAA,OAAAA,CAAAA,CAAQC,GAAG,EAAA;AACTA,gBAAAA,GAAAA,CAAIC,QAAQ,CAACR,MAAAA,CAAOD,MAAM,CAACU,GAAG,CAAC,WAAA,EAAa,QAAA,CAAA,CAAA;AAC9C,YAAA,CAAA;YACAV,MAAAA,EAAQ;gBAAEW,IAAAA,EAAM;AAAM;AACxB,SAAA;;AAEA,QAAA;YACEN,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,mBAAA;AACNC,YAAAA,OAAAA,EAASK,UAAUX,MAAAA,CAAOY,IAAI,CAACC,MAAM,CAACC,MAAM,EAAE;gBAC5CC,MAAAA,EAAQlB,MAAAA;gBACRmB,KAAAA,EAAO;AACT,aAAA,CAAA;YACAjB,MAAAA,EAAQ;gBAAEW,IAAAA,EAAM;AAAM;AACxB;AACD,KAAA,CAAA;AACH;;;;"}

package/dist/middlewares/responses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../src/middlewares/responses.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;CACnD;AAED,eAAO,MAAM,SAAS,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAWpD,CAAC"}
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../src/middlewares/responses.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;CACnD;AAED,eAAO,MAAM,SAAS,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAWpD,CAAC"}

package/dist/middlewares/responses.js

@@ -1,13 +1,11 @@
 'use strict';
 
-var fp = require('lodash/fp');
-
 const responses = (config = {})=>{
     return async (ctx, next)=>{
         await next();
         const { status } = ctx;
         const handler = config?.handlers?.[status];
-        if (fp.isFunction(handler)) {
+        if (typeof handler === 'function') {
             await handler(ctx, next);
         }
     };

package/dist/middlewares/responses.js.map

@@ -1 +1 @@
-{"version":3,"file":"responses.js","sources":["../../src/middlewares/responses.ts"],"sourcesContent":["import { isFunction } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\n\nexport interface Config {\n  handlers?: Record<number, Core.MiddlewareHandler>;\n}\n\nexport const responses: Core.MiddlewareFactory<Config> = (config = {}) => {\n  return async (ctx, next) => {\n    await next();\n\n    const { status } = ctx;\n    const handler = config?.handlers?.[status];\n\n    if (isFunction(handler)) {\n      await handler(ctx, next);\n    }\n  };\n};\n"],"names":["responses","config","ctx","next","status","handler","handlers","isFunction"],"mappings":";;;;AAOO,MAAMA,SAAAA,GAA4C,CAACC,MAAAA,GAAS,EAAE,GAAA;AACnE,IAAA,OAAO,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;QACjB,MAAMA,IAAAA,EAAAA;QAEN,MAAM,EAAEC,MAAM,EAAE,GAAGF,GAAAA;AACnB,QAAA,MAAMG,OAAAA,GAAUJ,MAAAA,EAAQK,QAAAA,GAAWF,MAAAA,CAAO;AAE1C,QAAA,IAAIG,cAAWF,OAAAA,CAAAA,EAAU;AACvB,YAAA,MAAMA,QAAQH,GAAAA,EAAKC,IAAAA,CAAAA;AACrB,QAAA;AACF,IAAA,CAAA;AACF;;;;"}
+{"version":3,"file":"responses.js","sources":["../../src/middlewares/responses.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\n\nexport interface Config {\n  handlers?: Record<number, Core.MiddlewareHandler>;\n}\n\nexport const responses: Core.MiddlewareFactory<Config> = (config = {}) => {\n  return async (ctx, next) => {\n    await next();\n\n    const { status } = ctx;\n    const handler = config?.handlers?.[status];\n\n    if (typeof handler === 'function') {\n      await handler(ctx, next);\n    }\n  };\n};\n"],"names":["responses","config","ctx","next","status","handler","handlers"],"mappings":";;AAMO,MAAMA,SAAAA,GAA4C,CAACC,MAAAA,GAAS,EAAE,GAAA;AACnE,IAAA,OAAO,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;QACjB,MAAMA,IAAAA,EAAAA;QAEN,MAAM,EAAEC,MAAM,EAAE,GAAGF,GAAAA;AACnB,QAAA,MAAMG,OAAAA,GAAUJ,MAAAA,EAAQK,QAAAA,GAAWF,MAAAA,CAAO;QAE1C,IAAI,OAAOC,YAAY,UAAA,EAAY;AACjC,YAAA,MAAMA,QAAQH,GAAAA,EAAKC,IAAAA,CAAAA;AACrB,QAAA;AACF,IAAA,CAAA;AACF;;;;"}

package/dist/middlewares/responses.mjs

@@ -1,11 +1,9 @@
-import { isFunction } from 'lodash/fp';
-
 const responses = (config = {})=>{
     return async (ctx, next)=>{
         await next();
         const { status } = ctx;
         const handler = config?.handlers?.[status];
-        if (isFunction(handler)) {
+        if (typeof handler === 'function') {
             await handler(ctx, next);
         }
     };

package/dist/middlewares/responses.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"responses.mjs","sources":["../../src/middlewares/responses.ts"],"sourcesContent":["import { isFunction } from 'lodash/fp';\nimport type { Core } from '@strapi/types';\n\nexport interface Config {\n  handlers?: Record<number, Core.MiddlewareHandler>;\n}\n\nexport const responses: Core.MiddlewareFactory<Config> = (config = {}) => {\n  return async (ctx, next) => {\n    await next();\n\n    const { status } = ctx;\n    const handler = config?.handlers?.[status];\n\n    if (isFunction(handler)) {\n      await handler(ctx, next);\n    }\n  };\n};\n"],"names":["responses","config","ctx","next","status","handler","handlers","isFunction"],"mappings":";;AAOO,MAAMA,SAAAA,GAA4C,CAACC,MAAAA,GAAS,EAAE,GAAA;AACnE,IAAA,OAAO,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;QACjB,MAAMA,IAAAA,EAAAA;QAEN,MAAM,EAAEC,MAAM,EAAE,GAAGF,GAAAA;AACnB,QAAA,MAAMG,OAAAA,GAAUJ,MAAAA,EAAQK,QAAAA,GAAWF,MAAAA,CAAO;AAE1C,QAAA,IAAIG,WAAWF,OAAAA,CAAAA,EAAU;AACvB,YAAA,MAAMA,QAAQH,GAAAA,EAAKC,IAAAA,CAAAA;AACrB,QAAA;AACF,IAAA,CAAA;AACF;;;;"}
+{"version":3,"file":"responses.mjs","sources":["../../src/middlewares/responses.ts"],"sourcesContent":["import type { Core } from '@strapi/types';\n\nexport interface Config {\n  handlers?: Record<number, Core.MiddlewareHandler>;\n}\n\nexport const responses: Core.MiddlewareFactory<Config> = (config = {}) => {\n  return async (ctx, next) => {\n    await next();\n\n    const { status } = ctx;\n    const handler = config?.handlers?.[status];\n\n    if (typeof handler === 'function') {\n      await handler(ctx, next);\n    }\n  };\n};\n"],"names":["responses","config","ctx","next","status","handler","handlers"],"mappings":"AAMO,MAAMA,SAAAA,GAA4C,CAACC,MAAAA,GAAS,EAAE,GAAA;AACnE,IAAA,OAAO,OAAOC,GAAAA,EAAKC,IAAAA,GAAAA;QACjB,MAAMA,IAAAA,EAAAA;QAEN,MAAM,EAAEC,MAAM,EAAE,GAAGF,GAAAA;AACnB,QAAA,MAAMG,OAAAA,GAAUJ,MAAAA,EAAQK,QAAAA,GAAWF,MAAAA,CAAO;QAE1C,IAAI,OAAOC,YAAY,UAAA,EAAY;AACjC,YAAA,MAAMA,QAAQH,GAAAA,EAAKC,IAAAA,CAAAA;AACrB,QAAA;AACF,IAAA,CAAA;AACF;;;;"}

package/dist/middlewares/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/middlewares/security.ts"],"names":[],"mappings":"AACA,OAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAgC3D,eAAO,MAAM,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAkEjD,CAAC"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/middlewares/security.ts"],"names":[],"mappings":"AACA,OAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AA8B3D,eAAO,MAAM,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAkEjD,CAAC"}

package/dist/middlewares/security.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var fp = require('lodash/fp');
+var _ = require('lodash');
 var helmet = require('koa-helmet');
 var strapiUtils = require('@strapi/utils');
 
@@ -30,10 +30,10 @@ const defaults = {
     }
 };
 const mergeConfig = (existingConfig, newConfig)=>{
-    return fp.mergeWith((obj, src)=>Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined, existingConfig, newConfig);
+    return _.mergeWith({}, existingConfig, newConfig, (obj, src)=>Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined);
 };
 const security = (config, { strapi })=>(ctx, next)=>{
-        let helmetConfig = fp.defaultsDeep(defaults, config);
+        let helmetConfig = _.defaultsDeep({}, config, defaults);
         const specialPaths = [
             '/documentation'
         ];

package/dist/middlewares/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sources":["../../src/middlewares/security.ts"],"sourcesContent":["import { defaultsDeep, mergeWith } from 'lodash/fp';\nimport helmet, { KoaHelmet } from 'koa-helmet';\nimport { CSP_DEFAULTS } from '@strapi/utils';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = NonNullable<Parameters<KoaHelmet>[0]>;\n\nconst defaults: Config = {\n  crossOriginEmbedderPolicy: false,\n  crossOriginOpenerPolicy: false,\n  crossOriginResourcePolicy: false,\n  originAgentCluster: false,\n  contentSecurityPolicy: {\n    useDefaults: true,\n    directives: {\n      ...CSP_DEFAULTS,\n      upgradeInsecureRequests: null,\n    },\n  },\n  xssFilter: false,\n  hsts: {\n    maxAge: 31536000,\n    includeSubDomains: true,\n  },\n  frameguard: {\n    action: 'sameorigin',\n  },\n};\n\nconst mergeConfig = (existingConfig: Config, newConfig: Config) => {\n  return mergeWith(\n    (obj, src) => (Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined),\n    existingConfig,\n    newConfig\n  );\n};\n\nexport const security: Core.MiddlewareFactory<Config> =\n  (config, { strapi }) =>\n  (ctx, next) => {\n    let helmetConfig: Config = defaultsDeep(defaults, config);\n    const specialPaths = ['/documentation'];\n\n    const directives: {\n      'script-src': string[];\n      'img-src': string[];\n      'manifest-src': string[];\n      'frame-src': string[];\n    } = {\n      'script-src': [\"'self'\", \"'unsafe-inline'\", 'cdn.jsdelivr.net'],\n      'img-src': [\"'self'\", 'data:', 'cdn.jsdelivr.net', 'strapi.io'],\n      'manifest-src': [],\n      'frame-src': [],\n    };\n\n    // if apollo graphql playground is enabled, add exceptions for it\n    if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {\n      const { config: gqlConfig } = strapi.plugin('graphql');\n      specialPaths.push(gqlConfig('endpoint'));\n\n      directives['script-src'].push(`https: 'unsafe-inline'`);\n      directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);\n      directives['manifest-src'].push(`'self'`);\n      directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');\n      directives['frame-src'].push(`'self'`);\n      directives['frame-src'].push('sandbox.embed.apollographql.com');\n    }\n\n    // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that\n    if (ctx.method === 'GET' && specialPaths.some((str) => ctx.path.startsWith(str))) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        crossOriginEmbedderPolicy: false, // TODO: only use this for graphql playground\n        contentSecurityPolicy: {\n          directives,\n        },\n      });\n    }\n\n    /**\n     * These are for vite's watch mode so it can accurately\n     * connect to the HMR websocket & reconnect on failure\n     * or when the server restarts.\n     *\n     * It only applies in development, and only on GET requests\n     * that are part of the admin route.\n     */\n\n    if (\n      ['development', 'test'].includes(process.env.NODE_ENV ?? '') &&\n      ctx.method === 'GET' &&\n      ctx.path.startsWith(strapi.config.get('admin.path'))\n    ) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        contentSecurityPolicy: {\n          directives: {\n            'script-src': [\"'self'\", \"'unsafe-inline'\"],\n            'connect-src': [\"'self'\", 'http:', 'https:', 'ws:'],\n          },\n        },\n      });\n    }\n\n    return helmet(helmetConfig)(ctx, next);\n  };\n"],"names":["defaults","crossOriginEmbedderPolicy","crossOriginOpenerPolicy","crossOriginResourcePolicy","originAgentCluster","contentSecurityPolicy","useDefaults","directives","CSP_DEFAULTS","upgradeInsecureRequests","xssFilter","hsts","maxAge","includeSubDomains","frameguard","action","mergeConfig","existingConfig","newConfig","mergeWith","obj","src","Array","isArray","concat","undefined","security","config","strapi","ctx","next","helmetConfig","defaultsDeep","specialPaths","plugin","service","playground","isEnabled","gqlConfig","push","method","some","str","path","startsWith","includes","process","env","NODE_ENV","get","helmet"],"mappings":";;;;;;;;;;AAQA,MAAMA,QAAAA,GAAmB;IACvBC,yBAAAA,EAA2B,KAAA;IAC3BC,uBAAAA,EAAyB,KAAA;IACzBC,yBAAAA,EAA2B,KAAA;IAC3BC,kBAAAA,EAAoB,KAAA;IACpBC,qBAAAA,EAAuB;QACrBC,WAAAA,EAAa,IAAA;QACbC,UAAAA,EAAY;AACV,YAAA,GAAGC,wBAAY;YACfC,uBAAAA,EAAyB;AAC3B;AACF,KAAA;IACAC,SAAAA,EAAW,KAAA;IACXC,IAAAA,EAAM;QACJC,MAAAA,EAAQ,QAAA;QACRC,iBAAAA,EAAmB;AACrB,KAAA;IACAC,UAAAA,EAAY;QACVC,MAAAA,EAAQ;AACV;AACF,CAAA;AAEA,MAAMC,WAAAA,GAAc,CAACC,cAAAA,EAAwBC,SAAAA,GAAAA;AAC3C,IAAA,OAAOC,aACL,CAACC,GAAAA,EAAKC,GAAAA,GAASC,KAAAA,CAAMC,OAAO,CAACH,GAAAA,CAAAA,IAAQE,KAAAA,CAAMC,OAAO,CAACF,GAAAA,CAAAA,GAAOD,GAAAA,CAAII,MAAM,CAACH,GAAAA,CAAAA,GAAOI,WAC5ER,cAAAA,EACAC,SAAAA,CAAAA;AAEJ,CAAA;AAEO,MAAMQ,WACX,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,CAACC,GAAAA,EAAKC,IAAAA,GAAAA;QACJ,IAAIC,YAAAA,GAAuBC,gBAAahC,QAAAA,EAAU2B,MAAAA,CAAAA;AAClD,QAAA,MAAMM,YAAAA,GAAe;AAAC,YAAA;AAAiB,SAAA;AAEvC,QAAA,MAAM1B,UAAAA,GAKF;YACF,YAAA,EAAc;AAAC,gBAAA,QAAA;AAAU,gBAAA,iBAAA;AAAmB,gBAAA;AAAmB,aAAA;YAC/D,SAAA,EAAW;AAAC,gBAAA,QAAA;AAAU,gBAAA,OAAA;AAAS,gBAAA,kBAAA;AAAoB,gBAAA;AAAY,aAAA;AAC/D,YAAA,cAAA,EAAgB,EAAE;AAClB,YAAA,WAAA,EAAa;AACf,SAAA;;AAGA,QAAA,IAAIqB,OAAOM,MAAM,CAAC,YAAYC,OAAAA,CAAQ,OAAA,CAAA,CAASC,WAAWC,SAAAA,EAAAA,EAAa;AACrE,YAAA,MAAM,EAAEV,MAAAA,EAAQW,SAAS,EAAE,GAAGV,MAAAA,CAAOM,MAAM,CAAC,SAAA,CAAA;YAC5CD,YAAAA,CAAaM,IAAI,CAACD,SAAAA,CAAU,UAAA,CAAA,CAAA;AAE5B/B,YAAAA,UAAU,CAAC,YAAA,CAAa,CAACgC,IAAI,CAAC,CAAC,sBAAsB,CAAC,CAAA;AACtDhC,YAAAA,UAAU,CAAC,SAAA,CAAU,CAACgC,IAAI,CAAC,CAAC,kDAAkD,CAAC,CAAA;AAC/EhC,YAAAA,UAAU,CAAC,cAAA,CAAe,CAACgC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACxChC,YAAAA,UAAU,CAAC,cAAA,CAAe,CAACgC,IAAI,CAAC,kDAAA,CAAA;AAChChC,YAAAA,UAAU,CAAC,WAAA,CAAY,CAACgC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACrChC,YAAAA,UAAU,CAAC,WAAA,CAAY,CAACgC,IAAI,CAAC,iCAAA,CAAA;AAC/B,QAAA;;AAGA,QAAA,IAAIV,GAAAA,CAAIW,MAAM,KAAK,KAAA,IAASP,aAAaQ,IAAI,CAAC,CAACC,GAAAA,GAAQb,GAAAA,CAAIc,IAAI,CAACC,UAAU,CAACF,GAAAA,CAAAA,CAAAA,EAAO;AAChFX,YAAAA,YAAAA,GAAef,YAAYe,YAAAA,EAAc;gBACvC9B,yBAAAA,EAA2B,KAAA;gBAC3BI,qBAAAA,EAAuB;AACrBE,oBAAAA;AACF;AACF,aAAA,CAAA;AACF,QAAA;AAEA;;;;;;;AAOC,QAED,IACE;AAAC,YAAA,aAAA;AAAe,YAAA;SAAO,CAACsC,QAAQ,CAACC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,IAAI,EAAA,CAAA,IACzDnB,GAAAA,CAAIW,MAAM,KAAK,SACfX,GAAAA,CAAIc,IAAI,CAACC,UAAU,CAAChB,OAAOD,MAAM,CAACsB,GAAG,CAAC,YAAA,CAAA,CAAA,EACtC;AACAlB,YAAAA,YAAAA,GAAef,YAAYe,YAAAA,EAAc;gBACvC1B,qBAAAA,EAAuB;oBACrBE,UAAAA,EAAY;wBACV,YAAA,EAAc;AAAC,4BAAA,QAAA;AAAU,4BAAA;AAAkB,yBAAA;wBAC3C,aAAA,EAAe;AAAC,4BAAA,QAAA;AAAU,4BAAA,OAAA;AAAS,4BAAA,QAAA;AAAU,4BAAA;AAAM;AACrD;AACF;AACF,aAAA,CAAA;AACF,QAAA;QAEA,OAAO2C,uBAAAA,CAAOnB,cAAcF,GAAAA,EAAKC,IAAAA,CAAAA;IACnC;;;;"}
+{"version":3,"file":"security.js","sources":["../../src/middlewares/security.ts"],"sourcesContent":["import { defaultsDeep, mergeWith } from 'lodash';\nimport helmet, { KoaHelmet } from 'koa-helmet';\nimport { CSP_DEFAULTS } from '@strapi/utils';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = NonNullable<Parameters<KoaHelmet>[0]>;\n\nconst defaults: Config = {\n  crossOriginEmbedderPolicy: false,\n  crossOriginOpenerPolicy: false,\n  crossOriginResourcePolicy: false,\n  originAgentCluster: false,\n  contentSecurityPolicy: {\n    useDefaults: true,\n    directives: {\n      ...CSP_DEFAULTS,\n      upgradeInsecureRequests: null,\n    },\n  },\n  xssFilter: false,\n  hsts: {\n    maxAge: 31536000,\n    includeSubDomains: true,\n  },\n  frameguard: {\n    action: 'sameorigin',\n  },\n};\n\nconst mergeConfig = (existingConfig: Config, newConfig: Config) => {\n  return mergeWith({}, existingConfig, newConfig, (obj, src) =>\n    Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined\n  );\n};\n\nexport const security: Core.MiddlewareFactory<Config> =\n  (config, { strapi }) =>\n  (ctx, next) => {\n    let helmetConfig: Config = defaultsDeep({}, config, defaults);\n    const specialPaths = ['/documentation'];\n\n    const directives: {\n      'script-src': string[];\n      'img-src': string[];\n      'manifest-src': string[];\n      'frame-src': string[];\n    } = {\n      'script-src': [\"'self'\", \"'unsafe-inline'\", 'cdn.jsdelivr.net'],\n      'img-src': [\"'self'\", 'data:', 'cdn.jsdelivr.net', 'strapi.io'],\n      'manifest-src': [],\n      'frame-src': [],\n    };\n\n    // if apollo graphql playground is enabled, add exceptions for it\n    if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {\n      const { config: gqlConfig } = strapi.plugin('graphql');\n      specialPaths.push(gqlConfig('endpoint'));\n\n      directives['script-src'].push(`https: 'unsafe-inline'`);\n      directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);\n      directives['manifest-src'].push(`'self'`);\n      directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');\n      directives['frame-src'].push(`'self'`);\n      directives['frame-src'].push('sandbox.embed.apollographql.com');\n    }\n\n    // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that\n    if (ctx.method === 'GET' && specialPaths.some((str) => ctx.path.startsWith(str))) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        crossOriginEmbedderPolicy: false, // TODO: only use this for graphql playground\n        contentSecurityPolicy: {\n          directives,\n        },\n      });\n    }\n\n    /**\n     * These are for vite's watch mode so it can accurately\n     * connect to the HMR websocket & reconnect on failure\n     * or when the server restarts.\n     *\n     * It only applies in development, and only on GET requests\n     * that are part of the admin route.\n     */\n\n    if (\n      ['development', 'test'].includes(process.env.NODE_ENV ?? '') &&\n      ctx.method === 'GET' &&\n      ctx.path.startsWith(strapi.config.get('admin.path'))\n    ) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        contentSecurityPolicy: {\n          directives: {\n            'script-src': [\"'self'\", \"'unsafe-inline'\"],\n            'connect-src': [\"'self'\", 'http:', 'https:', 'ws:'],\n          },\n        },\n      });\n    }\n\n    return helmet(helmetConfig)(ctx, next);\n  };\n"],"names":["defaults","crossOriginEmbedderPolicy","crossOriginOpenerPolicy","crossOriginResourcePolicy","originAgentCluster","contentSecurityPolicy","useDefaults","directives","CSP_DEFAULTS","upgradeInsecureRequests","xssFilter","hsts","maxAge","includeSubDomains","frameguard","action","mergeConfig","existingConfig","newConfig","mergeWith","obj","src","Array","isArray","concat","undefined","security","config","strapi","ctx","next","helmetConfig","defaultsDeep","specialPaths","plugin","service","playground","isEnabled","gqlConfig","push","method","some","str","path","startsWith","includes","process","env","NODE_ENV","get","helmet"],"mappings":";;;;;;;;;;AAQA,MAAMA,QAAAA,GAAmB;IACvBC,yBAAAA,EAA2B,KAAA;IAC3BC,uBAAAA,EAAyB,KAAA;IACzBC,yBAAAA,EAA2B,KAAA;IAC3BC,kBAAAA,EAAoB,KAAA;IACpBC,qBAAAA,EAAuB;QACrBC,WAAAA,EAAa,IAAA;QACbC,UAAAA,EAAY;AACV,YAAA,GAAGC,wBAAY;YACfC,uBAAAA,EAAyB;AAC3B;AACF,KAAA;IACAC,SAAAA,EAAW,KAAA;IACXC,IAAAA,EAAM;QACJC,MAAAA,EAAQ,QAAA;QACRC,iBAAAA,EAAmB;AACrB,KAAA;IACAC,UAAAA,EAAY;QACVC,MAAAA,EAAQ;AACV;AACF,CAAA;AAEA,MAAMC,WAAAA,GAAc,CAACC,cAAAA,EAAwBC,SAAAA,GAAAA;AAC3C,IAAA,OAAOC,YAAU,EAAC,EAAGF,gBAAgBC,SAAAA,EAAW,CAACE,KAAKC,GAAAA,GACpDC,KAAAA,CAAMC,OAAO,CAACH,GAAAA,CAAAA,IAAQE,MAAMC,OAAO,CAACF,OAAOD,GAAAA,CAAII,MAAM,CAACH,GAAAA,CAAAA,GAAOI,SAAAA,CAAAA;AAEjE,CAAA;AAEO,MAAMC,WACX,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,CAACC,GAAAA,EAAKC,IAAAA,GAAAA;AACJ,QAAA,IAAIC,YAAAA,GAAuBC,cAAAA,CAAa,EAAC,EAAGL,MAAAA,EAAQ3B,QAAAA,CAAAA;AACpD,QAAA,MAAMiC,YAAAA,GAAe;AAAC,YAAA;AAAiB,SAAA;AAEvC,QAAA,MAAM1B,UAAAA,GAKF;YACF,YAAA,EAAc;AAAC,gBAAA,QAAA;AAAU,gBAAA,iBAAA;AAAmB,gBAAA;AAAmB,aAAA;YAC/D,SAAA,EAAW;AAAC,gBAAA,QAAA;AAAU,gBAAA,OAAA;AAAS,gBAAA,kBAAA;AAAoB,gBAAA;AAAY,aAAA;AAC/D,YAAA,cAAA,EAAgB,EAAE;AAClB,YAAA,WAAA,EAAa;AACf,SAAA;;AAGA,QAAA,IAAIqB,OAAOM,MAAM,CAAC,YAAYC,OAAAA,CAAQ,OAAA,CAAA,CAASC,WAAWC,SAAAA,EAAAA,EAAa;AACrE,YAAA,MAAM,EAAEV,MAAAA,EAAQW,SAAS,EAAE,GAAGV,MAAAA,CAAOM,MAAM,CAAC,SAAA,CAAA;YAC5CD,YAAAA,CAAaM,IAAI,CAACD,SAAAA,CAAU,UAAA,CAAA,CAAA;AAE5B/B,YAAAA,UAAU,CAAC,YAAA,CAAa,CAACgC,IAAI,CAAC,CAAC,sBAAsB,CAAC,CAAA;AACtDhC,YAAAA,UAAU,CAAC,SAAA,CAAU,CAACgC,IAAI,CAAC,CAAC,kDAAkD,CAAC,CAAA;AAC/EhC,YAAAA,UAAU,CAAC,cAAA,CAAe,CAACgC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACxChC,YAAAA,UAAU,CAAC,cAAA,CAAe,CAACgC,IAAI,CAAC,kDAAA,CAAA;AAChChC,YAAAA,UAAU,CAAC,WAAA,CAAY,CAACgC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACrChC,YAAAA,UAAU,CAAC,WAAA,CAAY,CAACgC,IAAI,CAAC,iCAAA,CAAA;AAC/B,QAAA;;AAGA,QAAA,IAAIV,GAAAA,CAAIW,MAAM,KAAK,KAAA,IAASP,aAAaQ,IAAI,CAAC,CAACC,GAAAA,GAAQb,GAAAA,CAAIc,IAAI,CAACC,UAAU,CAACF,GAAAA,CAAAA,CAAAA,EAAO;AAChFX,YAAAA,YAAAA,GAAef,YAAYe,YAAAA,EAAc;gBACvC9B,yBAAAA,EAA2B,KAAA;gBAC3BI,qBAAAA,EAAuB;AACrBE,oBAAAA;AACF;AACF,aAAA,CAAA;AACF,QAAA;AAEA;;;;;;;AAOC,QAED,IACE;AAAC,YAAA,aAAA;AAAe,YAAA;SAAO,CAACsC,QAAQ,CAACC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,IAAI,EAAA,CAAA,IACzDnB,GAAAA,CAAIW,MAAM,KAAK,SACfX,GAAAA,CAAIc,IAAI,CAACC,UAAU,CAAChB,OAAOD,MAAM,CAACsB,GAAG,CAAC,YAAA,CAAA,CAAA,EACtC;AACAlB,YAAAA,YAAAA,GAAef,YAAYe,YAAAA,EAAc;gBACvC1B,qBAAAA,EAAuB;oBACrBE,UAAAA,EAAY;wBACV,YAAA,EAAc;AAAC,4BAAA,QAAA;AAAU,4BAAA;AAAkB,yBAAA;wBAC3C,aAAA,EAAe;AAAC,4BAAA,QAAA;AAAU,4BAAA,OAAA;AAAS,4BAAA,QAAA;AAAU,4BAAA;AAAM;AACrD;AACF;AACF,aAAA,CAAA;AACF,QAAA;QAEA,OAAO2C,uBAAAA,CAAOnB,cAAcF,GAAAA,EAAKC,IAAAA,CAAAA;IACnC;;;;"}

package/dist/middlewares/security.mjs

@@ -1,4 +1,4 @@
-import { defaultsDeep, mergeWith } from 'lodash/fp';
+import { defaultsDeep, mergeWith } from 'lodash';
 import helmet from 'koa-helmet';
 import { CSP_DEFAULTS } from '@strapi/utils';
 
@@ -24,10 +24,10 @@ const defaults = {
     }
 };
 const mergeConfig = (existingConfig, newConfig)=>{
-    return mergeWith((obj, src)=>Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined, existingConfig, newConfig);
+    return mergeWith({}, existingConfig, newConfig, (obj, src)=>Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined);
 };
 const security = (config, { strapi })=>(ctx, next)=>{
-        let helmetConfig = defaultsDeep(defaults, config);
+        let helmetConfig = defaultsDeep({}, config, defaults);
         const specialPaths = [
             '/documentation'
         ];

package/dist/middlewares/security.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"security.mjs","sources":["../../src/middlewares/security.ts"],"sourcesContent":["import { defaultsDeep, mergeWith } from 'lodash/fp';\nimport helmet, { KoaHelmet } from 'koa-helmet';\nimport { CSP_DEFAULTS } from '@strapi/utils';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = NonNullable<Parameters<KoaHelmet>[0]>;\n\nconst defaults: Config = {\n  crossOriginEmbedderPolicy: false,\n  crossOriginOpenerPolicy: false,\n  crossOriginResourcePolicy: false,\n  originAgentCluster: false,\n  contentSecurityPolicy: {\n    useDefaults: true,\n    directives: {\n      ...CSP_DEFAULTS,\n      upgradeInsecureRequests: null,\n    },\n  },\n  xssFilter: false,\n  hsts: {\n    maxAge: 31536000,\n    includeSubDomains: true,\n  },\n  frameguard: {\n    action: 'sameorigin',\n  },\n};\n\nconst mergeConfig = (existingConfig: Config, newConfig: Config) => {\n  return mergeWith(\n    (obj, src) => (Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined),\n    existingConfig,\n    newConfig\n  );\n};\n\nexport const security: Core.MiddlewareFactory<Config> =\n  (config, { strapi }) =>\n  (ctx, next) => {\n    let helmetConfig: Config = defaultsDeep(defaults, config);\n    const specialPaths = ['/documentation'];\n\n    const directives: {\n      'script-src': string[];\n      'img-src': string[];\n      'manifest-src': string[];\n      'frame-src': string[];\n    } = {\n      'script-src': [\"'self'\", \"'unsafe-inline'\", 'cdn.jsdelivr.net'],\n      'img-src': [\"'self'\", 'data:', 'cdn.jsdelivr.net', 'strapi.io'],\n      'manifest-src': [],\n      'frame-src': [],\n    };\n\n    // if apollo graphql playground is enabled, add exceptions for it\n    if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {\n      const { config: gqlConfig } = strapi.plugin('graphql');\n      specialPaths.push(gqlConfig('endpoint'));\n\n      directives['script-src'].push(`https: 'unsafe-inline'`);\n      directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);\n      directives['manifest-src'].push(`'self'`);\n      directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');\n      directives['frame-src'].push(`'self'`);\n      directives['frame-src'].push('sandbox.embed.apollographql.com');\n    }\n\n    // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that\n    if (ctx.method === 'GET' && specialPaths.some((str) => ctx.path.startsWith(str))) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        crossOriginEmbedderPolicy: false, // TODO: only use this for graphql playground\n        contentSecurityPolicy: {\n          directives,\n        },\n      });\n    }\n\n    /**\n     * These are for vite's watch mode so it can accurately\n     * connect to the HMR websocket & reconnect on failure\n     * or when the server restarts.\n     *\n     * It only applies in development, and only on GET requests\n     * that are part of the admin route.\n     */\n\n    if (\n      ['development', 'test'].includes(process.env.NODE_ENV ?? '') &&\n      ctx.method === 'GET' &&\n      ctx.path.startsWith(strapi.config.get('admin.path'))\n    ) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        contentSecurityPolicy: {\n          directives: {\n            'script-src': [\"'self'\", \"'unsafe-inline'\"],\n            'connect-src': [\"'self'\", 'http:', 'https:', 'ws:'],\n          },\n        },\n      });\n    }\n\n    return helmet(helmetConfig)(ctx, next);\n  };\n"],"names":["defaults","crossOriginEmbedderPolicy","crossOriginOpenerPolicy","crossOriginResourcePolicy","originAgentCluster","contentSecurityPolicy","useDefaults","directives","CSP_DEFAULTS","upgradeInsecureRequests","xssFilter","hsts","maxAge","includeSubDomains","frameguard","action","mergeConfig","existingConfig","newConfig","mergeWith","obj","src","Array","isArray","concat","undefined","security","config","strapi","ctx","next","helmetConfig","defaultsDeep","specialPaths","plugin","service","playground","isEnabled","gqlConfig","push","method","some","str","path","startsWith","includes","process","env","NODE_ENV","get","helmet"],"mappings":";;;;AAQA,MAAMA,QAAAA,GAAmB;IACvBC,yBAAAA,EAA2B,KAAA;IAC3BC,uBAAAA,EAAyB,KAAA;IACzBC,yBAAAA,EAA2B,KAAA;IAC3BC,kBAAAA,EAAoB,KAAA;IACpBC,qBAAAA,EAAuB;QACrBC,WAAAA,EAAa,IAAA;QACbC,UAAAA,EAAY;AACV,YAAA,GAAGC,YAAY;YACfC,uBAAAA,EAAyB;AAC3B;AACF,KAAA;IACAC,SAAAA,EAAW,KAAA;IACXC,IAAAA,EAAM;QACJC,MAAAA,EAAQ,QAAA;QACRC,iBAAAA,EAAmB;AACrB,KAAA;IACAC,UAAAA,EAAY;QACVC,MAAAA,EAAQ;AACV;AACF,CAAA;AAEA,MAAMC,WAAAA,GAAc,CAACC,cAAAA,EAAwBC,SAAAA,GAAAA;AAC3C,IAAA,OAAOC,UACL,CAACC,GAAAA,EAAKC,GAAAA,GAASC,KAAAA,CAAMC,OAAO,CAACH,GAAAA,CAAAA,IAAQE,KAAAA,CAAMC,OAAO,CAACF,GAAAA,CAAAA,GAAOD,GAAAA,CAAII,MAAM,CAACH,GAAAA,CAAAA,GAAOI,WAC5ER,cAAAA,EACAC,SAAAA,CAAAA;AAEJ,CAAA;AAEO,MAAMQ,WACX,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,CAACC,GAAAA,EAAKC,IAAAA,GAAAA;QACJ,IAAIC,YAAAA,GAAuBC,aAAahC,QAAAA,EAAU2B,MAAAA,CAAAA;AAClD,QAAA,MAAMM,YAAAA,GAAe;AAAC,YAAA;AAAiB,SAAA;AAEvC,QAAA,MAAM1B,UAAAA,GAKF;YACF,YAAA,EAAc;AAAC,gBAAA,QAAA;AAAU,gBAAA,iBAAA;AAAmB,gBAAA;AAAmB,aAAA;YAC/D,SAAA,EAAW;AAAC,gBAAA,QAAA;AAAU,gBAAA,OAAA;AAAS,gBAAA,kBAAA;AAAoB,gBAAA;AAAY,aAAA;AAC/D,YAAA,cAAA,EAAgB,EAAE;AAClB,YAAA,WAAA,EAAa;AACf,SAAA;;AAGA,QAAA,IAAIqB,OAAOM,MAAM,CAAC,YAAYC,OAAAA,CAAQ,OAAA,CAAA,CAASC,WAAWC,SAAAA,EAAAA,EAAa;AACrE,YAAA,MAAM,EAAEV,MAAAA,EAAQW,SAAS,EAAE,GAAGV,MAAAA,CAAOM,MAAM,CAAC,SAAA,CAAA;YAC5CD,YAAAA,CAAaM,IAAI,CAACD,SAAAA,CAAU,UAAA,CAAA,CAAA;AAE5B/B,YAAAA,UAAU,CAAC,YAAA,CAAa,CAACgC,IAAI,CAAC,CAAC,sBAAsB,CAAC,CAAA;AACtDhC,YAAAA,UAAU,CAAC,SAAA,CAAU,CAACgC,IAAI,CAAC,CAAC,kDAAkD,CAAC,CAAA;AAC/EhC,YAAAA,UAAU,CAAC,cAAA,CAAe,CAACgC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACxChC,YAAAA,UAAU,CAAC,cAAA,CAAe,CAACgC,IAAI,CAAC,kDAAA,CAAA;AAChChC,YAAAA,UAAU,CAAC,WAAA,CAAY,CAACgC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACrChC,YAAAA,UAAU,CAAC,WAAA,CAAY,CAACgC,IAAI,CAAC,iCAAA,CAAA;AAC/B,QAAA;;AAGA,QAAA,IAAIV,GAAAA,CAAIW,MAAM,KAAK,KAAA,IAASP,aAAaQ,IAAI,CAAC,CAACC,GAAAA,GAAQb,GAAAA,CAAIc,IAAI,CAACC,UAAU,CAACF,GAAAA,CAAAA,CAAAA,EAAO;AAChFX,YAAAA,YAAAA,GAAef,YAAYe,YAAAA,EAAc;gBACvC9B,yBAAAA,EAA2B,KAAA;gBAC3BI,qBAAAA,EAAuB;AACrBE,oBAAAA;AACF;AACF,aAAA,CAAA;AACF,QAAA;AAEA;;;;;;;AAOC,QAED,IACE;AAAC,YAAA,aAAA;AAAe,YAAA;SAAO,CAACsC,QAAQ,CAACC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,IAAI,EAAA,CAAA,IACzDnB,GAAAA,CAAIW,MAAM,KAAK,SACfX,GAAAA,CAAIc,IAAI,CAACC,UAAU,CAAChB,OAAOD,MAAM,CAACsB,GAAG,CAAC,YAAA,CAAA,CAAA,EACtC;AACAlB,YAAAA,YAAAA,GAAef,YAAYe,YAAAA,EAAc;gBACvC1B,qBAAAA,EAAuB;oBACrBE,UAAAA,EAAY;wBACV,YAAA,EAAc;AAAC,4BAAA,QAAA;AAAU,4BAAA;AAAkB,yBAAA;wBAC3C,aAAA,EAAe;AAAC,4BAAA,QAAA;AAAU,4BAAA,OAAA;AAAS,4BAAA,QAAA;AAAU,4BAAA;AAAM;AACrD;AACF;AACF,aAAA,CAAA;AACF,QAAA;QAEA,OAAO2C,MAAAA,CAAOnB,cAAcF,GAAAA,EAAKC,IAAAA,CAAAA;IACnC;;;;"}
+{"version":3,"file":"security.mjs","sources":["../../src/middlewares/security.ts"],"sourcesContent":["import { defaultsDeep, mergeWith } from 'lodash';\nimport helmet, { KoaHelmet } from 'koa-helmet';\nimport { CSP_DEFAULTS } from '@strapi/utils';\n\nimport type { Core } from '@strapi/types';\n\nexport type Config = NonNullable<Parameters<KoaHelmet>[0]>;\n\nconst defaults: Config = {\n  crossOriginEmbedderPolicy: false,\n  crossOriginOpenerPolicy: false,\n  crossOriginResourcePolicy: false,\n  originAgentCluster: false,\n  contentSecurityPolicy: {\n    useDefaults: true,\n    directives: {\n      ...CSP_DEFAULTS,\n      upgradeInsecureRequests: null,\n    },\n  },\n  xssFilter: false,\n  hsts: {\n    maxAge: 31536000,\n    includeSubDomains: true,\n  },\n  frameguard: {\n    action: 'sameorigin',\n  },\n};\n\nconst mergeConfig = (existingConfig: Config, newConfig: Config) => {\n  return mergeWith({}, existingConfig, newConfig, (obj, src) =>\n    Array.isArray(obj) && Array.isArray(src) ? obj.concat(src) : undefined\n  );\n};\n\nexport const security: Core.MiddlewareFactory<Config> =\n  (config, { strapi }) =>\n  (ctx, next) => {\n    let helmetConfig: Config = defaultsDeep({}, config, defaults);\n    const specialPaths = ['/documentation'];\n\n    const directives: {\n      'script-src': string[];\n      'img-src': string[];\n      'manifest-src': string[];\n      'frame-src': string[];\n    } = {\n      'script-src': [\"'self'\", \"'unsafe-inline'\", 'cdn.jsdelivr.net'],\n      'img-src': [\"'self'\", 'data:', 'cdn.jsdelivr.net', 'strapi.io'],\n      'manifest-src': [],\n      'frame-src': [],\n    };\n\n    // if apollo graphql playground is enabled, add exceptions for it\n    if (strapi.plugin('graphql')?.service('utils').playground.isEnabled()) {\n      const { config: gqlConfig } = strapi.plugin('graphql');\n      specialPaths.push(gqlConfig('endpoint'));\n\n      directives['script-src'].push(`https: 'unsafe-inline'`);\n      directives['img-src'].push(`'apollo-server-landing-page.cdn.apollographql.com'`);\n      directives['manifest-src'].push(`'self'`);\n      directives['manifest-src'].push('apollo-server-landing-page.cdn.apollographql.com');\n      directives['frame-src'].push(`'self'`);\n      directives['frame-src'].push('sandbox.embed.apollographql.com');\n    }\n\n    // TODO: we shouldn't combine playground exceptions with documentation for all routes, we should first check the path and then return exceptions specific to that\n    if (ctx.method === 'GET' && specialPaths.some((str) => ctx.path.startsWith(str))) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        crossOriginEmbedderPolicy: false, // TODO: only use this for graphql playground\n        contentSecurityPolicy: {\n          directives,\n        },\n      });\n    }\n\n    /**\n     * These are for vite's watch mode so it can accurately\n     * connect to the HMR websocket & reconnect on failure\n     * or when the server restarts.\n     *\n     * It only applies in development, and only on GET requests\n     * that are part of the admin route.\n     */\n\n    if (\n      ['development', 'test'].includes(process.env.NODE_ENV ?? '') &&\n      ctx.method === 'GET' &&\n      ctx.path.startsWith(strapi.config.get('admin.path'))\n    ) {\n      helmetConfig = mergeConfig(helmetConfig, {\n        contentSecurityPolicy: {\n          directives: {\n            'script-src': [\"'self'\", \"'unsafe-inline'\"],\n            'connect-src': [\"'self'\", 'http:', 'https:', 'ws:'],\n          },\n        },\n      });\n    }\n\n    return helmet(helmetConfig)(ctx, next);\n  };\n"],"names":["defaults","crossOriginEmbedderPolicy","crossOriginOpenerPolicy","crossOriginResourcePolicy","originAgentCluster","contentSecurityPolicy","useDefaults","directives","CSP_DEFAULTS","upgradeInsecureRequests","xssFilter","hsts","maxAge","includeSubDomains","frameguard","action","mergeConfig","existingConfig","newConfig","mergeWith","obj","src","Array","isArray","concat","undefined","security","config","strapi","ctx","next","helmetConfig","defaultsDeep","specialPaths","plugin","service","playground","isEnabled","gqlConfig","push","method","some","str","path","startsWith","includes","process","env","NODE_ENV","get","helmet"],"mappings":";;;;AAQA,MAAMA,QAAAA,GAAmB;IACvBC,yBAAAA,EAA2B,KAAA;IAC3BC,uBAAAA,EAAyB,KAAA;IACzBC,yBAAAA,EAA2B,KAAA;IAC3BC,kBAAAA,EAAoB,KAAA;IACpBC,qBAAAA,EAAuB;QACrBC,WAAAA,EAAa,IAAA;QACbC,UAAAA,EAAY;AACV,YAAA,GAAGC,YAAY;YACfC,uBAAAA,EAAyB;AAC3B;AACF,KAAA;IACAC,SAAAA,EAAW,KAAA;IACXC,IAAAA,EAAM;QACJC,MAAAA,EAAQ,QAAA;QACRC,iBAAAA,EAAmB;AACrB,KAAA;IACAC,UAAAA,EAAY;QACVC,MAAAA,EAAQ;AACV;AACF,CAAA;AAEA,MAAMC,WAAAA,GAAc,CAACC,cAAAA,EAAwBC,SAAAA,GAAAA;AAC3C,IAAA,OAAOC,UAAU,EAAC,EAAGF,gBAAgBC,SAAAA,EAAW,CAACE,KAAKC,GAAAA,GACpDC,KAAAA,CAAMC,OAAO,CAACH,GAAAA,CAAAA,IAAQE,MAAMC,OAAO,CAACF,OAAOD,GAAAA,CAAII,MAAM,CAACH,GAAAA,CAAAA,GAAOI,SAAAA,CAAAA;AAEjE,CAAA;AAEO,MAAMC,WACX,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,CAACC,GAAAA,EAAKC,IAAAA,GAAAA;AACJ,QAAA,IAAIC,YAAAA,GAAuBC,YAAAA,CAAa,EAAC,EAAGL,MAAAA,EAAQ3B,QAAAA,CAAAA;AACpD,QAAA,MAAMiC,YAAAA,GAAe;AAAC,YAAA;AAAiB,SAAA;AAEvC,QAAA,MAAM1B,UAAAA,GAKF;YACF,YAAA,EAAc;AAAC,gBAAA,QAAA;AAAU,gBAAA,iBAAA;AAAmB,gBAAA;AAAmB,aAAA;YAC/D,SAAA,EAAW;AAAC,gBAAA,QAAA;AAAU,gBAAA,OAAA;AAAS,gBAAA,kBAAA;AAAoB,gBAAA;AAAY,aAAA;AAC/D,YAAA,cAAA,EAAgB,EAAE;AAClB,YAAA,WAAA,EAAa;AACf,SAAA;;AAGA,QAAA,IAAIqB,OAAOM,MAAM,CAAC,YAAYC,OAAAA,CAAQ,OAAA,CAAA,CAASC,WAAWC,SAAAA,EAAAA,EAAa;AACrE,YAAA,MAAM,EAAEV,MAAAA,EAAQW,SAAS,EAAE,GAAGV,MAAAA,CAAOM,MAAM,CAAC,SAAA,CAAA;YAC5CD,YAAAA,CAAaM,IAAI,CAACD,SAAAA,CAAU,UAAA,CAAA,CAAA;AAE5B/B,YAAAA,UAAU,CAAC,YAAA,CAAa,CAACgC,IAAI,CAAC,CAAC,sBAAsB,CAAC,CAAA;AACtDhC,YAAAA,UAAU,CAAC,SAAA,CAAU,CAACgC,IAAI,CAAC,CAAC,kDAAkD,CAAC,CAAA;AAC/EhC,YAAAA,UAAU,CAAC,cAAA,CAAe,CAACgC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACxChC,YAAAA,UAAU,CAAC,cAAA,CAAe,CAACgC,IAAI,CAAC,kDAAA,CAAA;AAChChC,YAAAA,UAAU,CAAC,WAAA,CAAY,CAACgC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;AACrChC,YAAAA,UAAU,CAAC,WAAA,CAAY,CAACgC,IAAI,CAAC,iCAAA,CAAA;AAC/B,QAAA;;AAGA,QAAA,IAAIV,GAAAA,CAAIW,MAAM,KAAK,KAAA,IAASP,aAAaQ,IAAI,CAAC,CAACC,GAAAA,GAAQb,GAAAA,CAAIc,IAAI,CAACC,UAAU,CAACF,GAAAA,CAAAA,CAAAA,EAAO;AAChFX,YAAAA,YAAAA,GAAef,YAAYe,YAAAA,EAAc;gBACvC9B,yBAAAA,EAA2B,KAAA;gBAC3BI,qBAAAA,EAAuB;AACrBE,oBAAAA;AACF;AACF,aAAA,CAAA;AACF,QAAA;AAEA;;;;;;;AAOC,QAED,IACE;AAAC,YAAA,aAAA;AAAe,YAAA;SAAO,CAACsC,QAAQ,CAACC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,IAAI,EAAA,CAAA,IACzDnB,GAAAA,CAAIW,MAAM,KAAK,SACfX,GAAAA,CAAIc,IAAI,CAACC,UAAU,CAAChB,OAAOD,MAAM,CAACsB,GAAG,CAAC,YAAA,CAAA,CAAA,EACtC;AACAlB,YAAAA,YAAAA,GAAef,YAAYe,YAAAA,EAAc;gBACvC1B,qBAAAA,EAAuB;oBACrBE,UAAAA,EAAY;wBACV,YAAA,EAAc;AAAC,4BAAA,QAAA;AAAU,4BAAA;AAAkB,yBAAA;wBAC3C,aAAA,EAAe;AAAC,4BAAA,QAAA;AAAU,4BAAA,OAAA;AAAS,4BAAA,QAAA;AAAU,4BAAA;AAAM;AACrD;AACF;AACF,aAAA,CAAA;AACF,QAAA;QAEA,OAAO2C,MAAAA,CAAOnB,cAAcF,GAAAA,EAAKC,IAAAA,CAAAA;IACnC;;;;"}

package/dist/middlewares/session.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var fp = require('lodash/fp');
+var _ = require('lodash');
 var koaSession = require('koa-session');
 
 const defaultConfig = {
@@ -17,7 +17,7 @@ const defaultConfig = {
 };
 const session = (userConfig, { strapi })=>{
     const { keys } = strapi.server.app;
-    if (!fp.isArray(keys) || fp.isEmpty(keys) || keys.some(fp.isEmpty)) {
+    if (!Array.isArray(keys) || keys.length === 0 || keys.some((key)=>_.isEmpty(key))) {
         throw new Error(`App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`);
     }
     const config = {

package/dist/middlewares/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sources":["../../src/middlewares/session.ts"],"sourcesContent":["import { isEmpty, isArray } from 'lodash/fp';\nimport { type SessionOptions, createSession } from 'koa-session';\nimport type { Core } from '@strapi/types';\n\nconst defaultConfig = {\n  key: 'koa.sess',\n  maxAge: 86400000,\n  autoCommit: true,\n  overwrite: true,\n  httpOnly: true,\n  signed: true,\n  rolling: false,\n  renew: false,\n  secure: process.env.NODE_ENV === 'production',\n  sameSite: undefined,\n};\n\nexport const session: Core.MiddlewareFactory<Partial<SessionOptions>> = (\n  userConfig,\n  { strapi }\n) => {\n  const { keys } = strapi.server.app;\n  if (!isArray(keys) || isEmpty(keys) || keys.some(isEmpty)) {\n    throw new Error(\n      `App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`\n    );\n  }\n\n  const config: Partial<SessionOptions> = { ...defaultConfig, ...userConfig };\n\n  strapi.server.use(createSession(config, strapi.server.app));\n};\n"],"names":["defaultConfig","key","maxAge","autoCommit","overwrite","httpOnly","signed","rolling","renew","secure","process","env","NODE_ENV","sameSite","undefined","session","userConfig","strapi","keys","server","app","isArray","isEmpty","some","Error","config","use","createSession"],"mappings":";;;;;AAIA,MAAMA,aAAAA,GAAgB;IACpBC,GAAAA,EAAK,UAAA;IACLC,MAAAA,EAAQ,QAAA;IACRC,UAAAA,EAAY,IAAA;IACZC,SAAAA,EAAW,IAAA;IACXC,QAAAA,EAAU,IAAA;IACVC,MAAAA,EAAQ,IAAA;IACRC,OAAAA,EAAS,KAAA;IACTC,KAAAA,EAAO,KAAA;AACPC,IAAAA,MAAAA,EAAQC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;IACjCC,QAAAA,EAAUC;AACZ,CAAA;MAEaC,OAAAA,GAA2D,CACtEC,UAAAA,EACA,EAAEC,MAAM,EAAE,GAAA;AAEV,IAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAACC,GAAG;IAClC,IAAI,CAACC,WAAQH,IAAAA,CAAAA,IAASI,UAAAA,CAAQJ,SAASA,IAAAA,CAAKK,IAAI,CAACD,UAAAA,CAAAA,EAAU;AACzD,QAAA,MAAM,IAAIE,KAAAA,CACR,CAAC,+FAA+F,CAAC,CAAA;AAErG,IAAA;AAEA,IAAA,MAAMC,MAAAA,GAAkC;AAAE,QAAA,GAAGzB,aAAa;AAAE,QAAA,GAAGgB;AAAW,KAAA;IAE1EC,MAAAA,CAAOE,MAAM,CAACO,GAAG,CAACC,yBAAcF,MAAAA,EAAQR,MAAAA,CAAOE,MAAM,CAACC,GAAG,CAAA,CAAA;AAC3D;;;;"}
+{"version":3,"file":"session.js","sources":["../../src/middlewares/session.ts"],"sourcesContent":["import { isEmpty } from 'lodash';\nimport { type SessionOptions, createSession } from 'koa-session';\nimport type { Core } from '@strapi/types';\n\nconst defaultConfig = {\n  key: 'koa.sess',\n  maxAge: 86400000,\n  autoCommit: true,\n  overwrite: true,\n  httpOnly: true,\n  signed: true,\n  rolling: false,\n  renew: false,\n  secure: process.env.NODE_ENV === 'production',\n  sameSite: undefined,\n};\n\nexport const session: Core.MiddlewareFactory<Partial<SessionOptions>> = (\n  userConfig,\n  { strapi }\n) => {\n  const { keys } = strapi.server.app;\n  if (!Array.isArray(keys) || keys.length === 0 || keys.some((key) => isEmpty(key))) {\n    throw new Error(\n      `App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`\n    );\n  }\n\n  const config: Partial<SessionOptions> = { ...defaultConfig, ...userConfig };\n\n  strapi.server.use(createSession(config, strapi.server.app));\n};\n"],"names":["defaultConfig","key","maxAge","autoCommit","overwrite","httpOnly","signed","rolling","renew","secure","process","env","NODE_ENV","sameSite","undefined","session","userConfig","strapi","keys","server","app","Array","isArray","length","some","isEmpty","Error","config","use","createSession"],"mappings":";;;;;AAIA,MAAMA,aAAAA,GAAgB;IACpBC,GAAAA,EAAK,UAAA;IACLC,MAAAA,EAAQ,QAAA;IACRC,UAAAA,EAAY,IAAA;IACZC,SAAAA,EAAW,IAAA;IACXC,QAAAA,EAAU,IAAA;IACVC,MAAAA,EAAQ,IAAA;IACRC,OAAAA,EAAS,KAAA;IACTC,KAAAA,EAAO,KAAA;AACPC,IAAAA,MAAAA,EAAQC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;IACjCC,QAAAA,EAAUC;AACZ,CAAA;MAEaC,OAAAA,GAA2D,CACtEC,UAAAA,EACA,EAAEC,MAAM,EAAE,GAAA;AAEV,IAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAACC,GAAG;AAClC,IAAA,IAAI,CAACC,KAAAA,CAAMC,OAAO,CAACJ,SAASA,IAAAA,CAAKK,MAAM,KAAK,CAAA,IAAKL,KAAKM,IAAI,CAAC,CAACvB,GAAAA,GAAQwB,UAAQxB,GAAAA,CAAAA,CAAAA,EAAO;AACjF,QAAA,MAAM,IAAIyB,KAAAA,CACR,CAAC,+FAA+F,CAAC,CAAA;AAErG,IAAA;AAEA,IAAA,MAAMC,MAAAA,GAAkC;AAAE,QAAA,GAAG3B,aAAa;AAAE,QAAA,GAAGgB;AAAW,KAAA;IAE1EC,MAAAA,CAAOE,MAAM,CAACS,GAAG,CAACC,yBAAcF,MAAAA,EAAQV,MAAAA,CAAOE,MAAM,CAACC,GAAG,CAAA,CAAA;AAC3D;;;;"}

package/dist/middlewares/session.mjs

@@ -1,4 +1,4 @@
-import { isArray, isEmpty } from 'lodash/fp';
+import { isEmpty } from 'lodash';
 import { createSession } from 'koa-session';
 
 const defaultConfig = {
@@ -15,7 +15,7 @@ const defaultConfig = {
 };
 const session = (userConfig, { strapi })=>{
     const { keys } = strapi.server.app;
-    if (!isArray(keys) || isEmpty(keys) || keys.some(isEmpty)) {
+    if (!Array.isArray(keys) || keys.length === 0 || keys.some((key)=>isEmpty(key))) {
         throw new Error(`App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`);
     }
     const config = {

package/dist/middlewares/session.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.mjs","sources":["../../src/middlewares/session.ts"],"sourcesContent":["import { isEmpty, isArray } from 'lodash/fp';\nimport { type SessionOptions, createSession } from 'koa-session';\nimport type { Core } from '@strapi/types';\n\nconst defaultConfig = {\n  key: 'koa.sess',\n  maxAge: 86400000,\n  autoCommit: true,\n  overwrite: true,\n  httpOnly: true,\n  signed: true,\n  rolling: false,\n  renew: false,\n  secure: process.env.NODE_ENV === 'production',\n  sameSite: undefined,\n};\n\nexport const session: Core.MiddlewareFactory<Partial<SessionOptions>> = (\n  userConfig,\n  { strapi }\n) => {\n  const { keys } = strapi.server.app;\n  if (!isArray(keys) || isEmpty(keys) || keys.some(isEmpty)) {\n    throw new Error(\n      `App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`\n    );\n  }\n\n  const config: Partial<SessionOptions> = { ...defaultConfig, ...userConfig };\n\n  strapi.server.use(createSession(config, strapi.server.app));\n};\n"],"names":["defaultConfig","key","maxAge","autoCommit","overwrite","httpOnly","signed","rolling","renew","secure","process","env","NODE_ENV","sameSite","undefined","session","userConfig","strapi","keys","server","app","isArray","isEmpty","some","Error","config","use","createSession"],"mappings":";;;AAIA,MAAMA,aAAAA,GAAgB;IACpBC,GAAAA,EAAK,UAAA;IACLC,MAAAA,EAAQ,QAAA;IACRC,UAAAA,EAAY,IAAA;IACZC,SAAAA,EAAW,IAAA;IACXC,QAAAA,EAAU,IAAA;IACVC,MAAAA,EAAQ,IAAA;IACRC,OAAAA,EAAS,KAAA;IACTC,KAAAA,EAAO,KAAA;AACPC,IAAAA,MAAAA,EAAQC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;IACjCC,QAAAA,EAAUC;AACZ,CAAA;MAEaC,OAAAA,GAA2D,CACtEC,UAAAA,EACA,EAAEC,MAAM,EAAE,GAAA;AAEV,IAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAACC,GAAG;IAClC,IAAI,CAACC,QAAQH,IAAAA,CAAAA,IAASI,OAAAA,CAAQJ,SAASA,IAAAA,CAAKK,IAAI,CAACD,OAAAA,CAAAA,EAAU;AACzD,QAAA,MAAM,IAAIE,KAAAA,CACR,CAAC,+FAA+F,CAAC,CAAA;AAErG,IAAA;AAEA,IAAA,MAAMC,MAAAA,GAAkC;AAAE,QAAA,GAAGzB,aAAa;AAAE,QAAA,GAAGgB;AAAW,KAAA;IAE1EC,MAAAA,CAAOE,MAAM,CAACO,GAAG,CAACC,cAAcF,MAAAA,EAAQR,MAAAA,CAAOE,MAAM,CAACC,GAAG,CAAA,CAAA;AAC3D;;;;"}
+{"version":3,"file":"session.mjs","sources":["../../src/middlewares/session.ts"],"sourcesContent":["import { isEmpty } from 'lodash';\nimport { type SessionOptions, createSession } from 'koa-session';\nimport type { Core } from '@strapi/types';\n\nconst defaultConfig = {\n  key: 'koa.sess',\n  maxAge: 86400000,\n  autoCommit: true,\n  overwrite: true,\n  httpOnly: true,\n  signed: true,\n  rolling: false,\n  renew: false,\n  secure: process.env.NODE_ENV === 'production',\n  sameSite: undefined,\n};\n\nexport const session: Core.MiddlewareFactory<Partial<SessionOptions>> = (\n  userConfig,\n  { strapi }\n) => {\n  const { keys } = strapi.server.app;\n  if (!Array.isArray(keys) || keys.length === 0 || keys.some((key) => isEmpty(key))) {\n    throw new Error(\n      `App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`\n    );\n  }\n\n  const config: Partial<SessionOptions> = { ...defaultConfig, ...userConfig };\n\n  strapi.server.use(createSession(config, strapi.server.app));\n};\n"],"names":["defaultConfig","key","maxAge","autoCommit","overwrite","httpOnly","signed","rolling","renew","secure","process","env","NODE_ENV","sameSite","undefined","session","userConfig","strapi","keys","server","app","Array","isArray","length","some","isEmpty","Error","config","use","createSession"],"mappings":";;;AAIA,MAAMA,aAAAA,GAAgB;IACpBC,GAAAA,EAAK,UAAA;IACLC,MAAAA,EAAQ,QAAA;IACRC,UAAAA,EAAY,IAAA;IACZC,SAAAA,EAAW,IAAA;IACXC,QAAAA,EAAU,IAAA;IACVC,MAAAA,EAAQ,IAAA;IACRC,OAAAA,EAAS,KAAA;IACTC,KAAAA,EAAO,KAAA;AACPC,IAAAA,MAAAA,EAAQC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;IACjCC,QAAAA,EAAUC;AACZ,CAAA;MAEaC,OAAAA,GAA2D,CACtEC,UAAAA,EACA,EAAEC,MAAM,EAAE,GAAA;AAEV,IAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,MAAAA,CAAOE,MAAM,CAACC,GAAG;AAClC,IAAA,IAAI,CAACC,KAAAA,CAAMC,OAAO,CAACJ,SAASA,IAAAA,CAAKK,MAAM,KAAK,CAAA,IAAKL,KAAKM,IAAI,CAAC,CAACvB,GAAAA,GAAQwB,QAAQxB,GAAAA,CAAAA,CAAAA,EAAO;AACjF,QAAA,MAAM,IAAIyB,KAAAA,CACR,CAAC,+FAA+F,CAAC,CAAA;AAErG,IAAA;AAEA,IAAA,MAAMC,MAAAA,GAAkC;AAAE,QAAA,GAAG3B,aAAa;AAAE,QAAA,GAAGgB;AAAW,KAAA;IAE1EC,MAAAA,CAAOE,MAAM,CAACS,GAAG,CAACC,cAAcF,MAAAA,EAAQV,MAAAA,CAAOE,MAAM,CAACC,GAAG,CAAA,CAAA;AAC3D;;;;"}

package/dist/migrations/database/5.0.0-discard-drafts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"5.0.0-discard-drafts.d.ts","sourceRoot":"","sources":["../../../src/migrations/database/5.0.0-discard-drafts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAa5D,KAAK,eAAe,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9D,KAAK,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AA++G3C;;;;;GAKG;AACH,wBAAuB,iBAAiB,CAAC,EACvC,EAAE,EACF,GAAG,EACH,GAAG,EACH,gBAAuB,GACxB,EAAE;IACD,EAAE,EAAE,QAAQ,CAAC;IACb,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,oDAwBA;AAED,eAAO,MAAM,qBAAqB,EAAE,SAQnC,CAAC"}
+{"version":3,"file":"5.0.0-discard-drafts.d.ts","sourceRoot":"","sources":["../../../src/migrations/database/5.0.0-discard-drafts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAa5D,KAAK,eAAe,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9D,KAAK,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AA8+G3C;;;;;GAKG;AACH,wBAAuB,iBAAiB,CAAC,EACvC,EAAE,EACF,GAAG,EACH,GAAG,EACH,gBAAuB,GACxB,EAAE;IACD,EAAE,EAAE,QAAQ,CAAC;IACb,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,oDAwBA;AAED,eAAO,MAAM,qBAAqB,EAAE,SAQnC,CAAC"}

package/dist/migrations/database/5.0.0-discard-drafts.js

@@ -1405,9 +1405,8 @@ const debug = createDebug__default.default('strapi::migration::discard-drafts');
     if (publishedEntries.length === 0 || draftEntries.length === 0) {
         return null;
     }
-    const i18nService = strapi.plugin('i18n')?.service('content-types');
     const contentType = strapi.contentTypes[uid];
-    const isLocalized = i18nService?.isLocalizedContentType(contentType) ?? false;
+    const isLocalized = strapi.localization.isLocalizedContentType(contentType);
     const draftByDocumentId = new Map();
     for (const draft of draftEntries){
         if (!draft.document_id) {