@strapi/plugin-users-permissions 0.0.0-experimental.62ce06180fe9a772eaeb3d43d238b26644f39f7c → 0.0.0-experimental.6340da17068c3bed7fb006e7bcc554c71129e282

package/dist/server/middlewares/index.mjs

@@ -0,0 +1,16 @@
+import { __require as requireRateLimit } from './rateLimit.mjs';
+
+var middlewares;
+var hasRequiredMiddlewares;
+function requireMiddlewares() {
+    if (hasRequiredMiddlewares) return middlewares;
+    hasRequiredMiddlewares = 1;
+    const rateLimit = requireRateLimit();
+    middlewares = {
+        rateLimit
+    };
+    return middlewares;
+}
+
+export { requireMiddlewares as __require };
+//# sourceMappingURL=index.mjs.map

package/dist/server/middlewares/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sources":["../../../server/middlewares/index.js"],"sourcesContent":["'use strict';\n\nconst rateLimit = require('./rateLimit');\n\nmodule.exports = {\n  rateLimit,\n};\n"],"names":["rateLimit","require$$0","middlewares"],"mappings":";;;;;;;AAEA,IAAA,MAAMA,SAAAA,GAAYC,gBAAAA,EAAAA;IAElBC,WAAAA,GAAiB;AACfF,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/middlewares/rateLimit.js

@@ -0,0 +1,127 @@
+'use strict';
+
+var rateLimit = require('../_virtual/rateLimit.js');
+var require$$1$1 = require('path');
+var require$$1 = require('@strapi/utils');
+var require$$0 = require('lodash/fp');
+var require$$3 = require('koa2-ratelimit');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var require$$1__default$1 = /*#__PURE__*/_interopDefault(require$$1$1);
+var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
+var require$$0__default = /*#__PURE__*/_interopDefault(require$$0);
+var require$$3__default = /*#__PURE__*/_interopDefault(require$$3);
+
+var hasRequiredRateLimit;
+function requireRateLimit() {
+    if (hasRequiredRateLimit) return rateLimit.__module.exports;
+    hasRequiredRateLimit = 1;
+    const path = require$$1__default$1.default;
+    const utils = require$$1__default.default;
+    const { isString, has, toLower } = require$$0__default.default;
+    const { RateLimitError } = utils.errors;
+    /**
+	 * Routes where the rate-limit key MUST NOT include a user identifier
+	 * derived from `ctx.request.body.email`.
+	 *
+	 * On these routes the request body either has no `email` field
+	 * (e.g. /auth/local uses `identifier`, /auth/reset-password uses
+	 * `code`, /auth/change-password uses `currentPassword`) or the
+	 * field is not part of the route contract. Including the
+	 * attacker-controlled `body.email` in the rate-limit key on these
+	 * routes lets a caller obtain a fresh key on every request by
+	 * varying that field, effectively bypassing per-IP throttling.
+	 *
+	 * Comparison uses endsWith so the check is stable under any router
+	 * mount prefix (e.g. `/api/auth/local`).
+	 *
+	 * @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw
+	 *
+	 * When adding a new `rateLimit`-protected auth route whose body does not
+	 * use `email` as the real identifier, add its path suffix here (or an
+	 * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split
+	 * with arbitrary `body.email` values.
+	 */ const ROUTES_WITHOUT_IDENTIFIER = [
+        '/auth/local',
+        '/auth/reset-password',
+        '/auth/change-password'
+    ];
+    const isOAuthCallbackPath = (requestPath)=>requestPath.includes('/connect/');
+    const routeUsesEmailIdentifier = (requestPath)=>{
+        if (isOAuthCallbackPath(requestPath)) {
+            return false;
+        }
+        return !ROUTES_WITHOUT_IDENTIFIER.some((route)=>requestPath.endsWith(route));
+    };
+    /**
+	 * Paths suitable for route matching and prefix keys: POSIX-normalized,
+	 * lower-cased, trailing slashes removed so `/api/auth/local` and
+	 * `/api/auth/local/` share one bucket.
+	 */ const normalizeRequestPathForRateLimit = (requestPath)=>{
+        const normalized = path.normalize(requestPath);
+        const lower = toLower(normalized);
+        return lower.replace(/\/+$/, '') || '/';
+    };
+    const getEmailIdentifierForKey = (body)=>{
+        if (!body || !isString(body.email) || body.email === '') {
+            return 'unknownIdentifier';
+        }
+        return toLower(body.email);
+    };
+    const buildPrefixKey = (ctx)=>{
+        let requestPath;
+        if (!isString(ctx.request.path)) {
+            requestPath = 'invalidPath';
+        } else {
+            requestPath = normalizeRequestPathForRateLimit(ctx.request.path);
+            if (requestPath === '.' || requestPath === '..') {
+                requestPath = 'invalidPath';
+            }
+        }
+        if (!routeUsesEmailIdentifier(requestPath)) {
+            return `noIdentifier:${requestPath}:${ctx.request.ip}`;
+        }
+        const userIdentifier = getEmailIdentifierForKey(ctx.request.body);
+        return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;
+    };
+    const buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig)=>{
+        return {
+            interval: {
+                min: 5
+            },
+            max: 5,
+            ...rateLimitConfig,
+            ...routeMiddlewareConfig,
+            handler () {
+                throw new RateLimitError();
+            },
+            prefixKey: buildPrefixKey(ctx)
+        };
+    };
+    rateLimit.__module.exports = (config, { strapi })=>async (ctx, next)=>{
+            let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');
+            if (!rateLimitConfig) {
+                rateLimitConfig = {
+                    enabled: true
+                };
+            }
+            if (!has('enabled', rateLimitConfig)) {
+                rateLimitConfig.enabled = true;
+            }
+            if (rateLimitConfig.enabled === true) {
+                const rateLimit = require$$3__default.default.RateLimit;
+                const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);
+                return rateLimit.middleware(loadConfig)(ctx, next);
+            }
+            return next();
+        };
+    rateLimit.__module.exports.buildPrefixKey = buildPrefixKey;
+    rateLimit.__module.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;
+    rateLimit.__module.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;
+    rateLimit.__module.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;
+    return rateLimit.__module.exports;
+}
+
+exports.__require = requireRateLimit;
+//# sourceMappingURL=rateLimit.js.map

package/dist/server/middlewares/rateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.js","sources":["../../../server/middlewares/rateLimit.js"],"sourcesContent":["'use strict';\n\nconst path = require('path');\nconst utils = require('@strapi/utils');\nconst { isString, has, toLower } = require('lodash/fp');\n\nconst { RateLimitError } = utils.errors;\n\n/**\n * Routes where the rate-limit key MUST NOT include a user identifier\n * derived from `ctx.request.body.email`.\n *\n * On these routes the request body either has no `email` field\n * (e.g. /auth/local uses `identifier`, /auth/reset-password uses\n * `code`, /auth/change-password uses `currentPassword`) or the\n * field is not part of the route contract. Including the\n * attacker-controlled `body.email` in the rate-limit key on these\n * routes lets a caller obtain a fresh key on every request by\n * varying that field, effectively bypassing per-IP throttling.\n *\n * Comparison uses endsWith so the check is stable under any router\n * mount prefix (e.g. `/api/auth/local`).\n *\n * @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw\n *\n * When adding a new `rateLimit`-protected auth route whose body does not\n * use `email` as the real identifier, add its path suffix here (or an\n * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split\n * with arbitrary `body.email` values.\n */\nconst ROUTES_WITHOUT_IDENTIFIER = ['/auth/local', '/auth/reset-password', '/auth/change-password'];\n\nconst isOAuthCallbackPath = (requestPath) => requestPath.includes('/connect/');\n\nconst routeUsesEmailIdentifier = (requestPath) => {\n  if (isOAuthCallbackPath(requestPath)) {\n    return false;\n  }\n\n  return !ROUTES_WITHOUT_IDENTIFIER.some((route) => requestPath.endsWith(route));\n};\n\n/**\n * Paths suitable for route matching and prefix keys: POSIX-normalized,\n * lower-cased, trailing slashes removed so `/api/auth/local` and\n * `/api/auth/local/` share one bucket.\n */\nconst normalizeRequestPathForRateLimit = (requestPath) => {\n  const normalized = path.normalize(requestPath);\n  const lower = toLower(normalized);\n  return lower.replace(/\\/+$/, '') || '/';\n};\n\nconst getEmailIdentifierForKey = (body) => {\n  if (!body || !isString(body.email) || body.email === '') {\n    return 'unknownIdentifier';\n  }\n\n  return toLower(body.email);\n};\n\nconst buildPrefixKey = (ctx) => {\n  let requestPath;\n  if (!isString(ctx.request.path)) {\n    requestPath = 'invalidPath';\n  } else {\n    requestPath = normalizeRequestPathForRateLimit(ctx.request.path);\n    if (requestPath === '.' || requestPath === '..') {\n      requestPath = 'invalidPath';\n    }\n  }\n\n  if (!routeUsesEmailIdentifier(requestPath)) {\n    return `noIdentifier:${requestPath}:${ctx.request.ip}`;\n  }\n\n  const userIdentifier = getEmailIdentifierForKey(ctx.request.body);\n  return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;\n};\n\nconst buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig) => {\n  return {\n    interval: { min: 5 },\n    max: 5,\n    ...rateLimitConfig,\n    ...routeMiddlewareConfig,\n    handler() {\n      throw new RateLimitError();\n    },\n    prefixKey: buildPrefixKey(ctx),\n  };\n};\n\nmodule.exports =\n  (config, { strapi }) =>\n  async (ctx, next) => {\n    let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');\n\n    if (!rateLimitConfig) {\n      rateLimitConfig = {\n        enabled: true,\n      };\n    }\n\n    if (!has('enabled', rateLimitConfig)) {\n      rateLimitConfig.enabled = true;\n    }\n\n    if (rateLimitConfig.enabled === true) {\n      const rateLimit = require('koa2-ratelimit').RateLimit;\n\n      const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);\n\n      return rateLimit.middleware(loadConfig)(ctx, next);\n    }\n\n    return next();\n  };\n\nmodule.exports.buildPrefixKey = buildPrefixKey;\nmodule.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;\nmodule.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;\nmodule.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;\n"],"names":["path","require$$0","utils","require$$1","isString","has","toLower","require$$2","RateLimitError","errors","ROUTES_WITHOUT_IDENTIFIER","isOAuthCallbackPath","requestPath","includes","routeUsesEmailIdentifier","some","route","endsWith","normalizeRequestPathForRateLimit","normalized","normalize","lower","replace","getEmailIdentifierForKey","body","email","buildPrefixKey","ctx","request","ip","userIdentifier","buildRateLimitLoadConfig","rateLimitConfig","routeMiddlewareConfig","interval","min","max","handler","prefixKey","rateLimitModule","exports","config","strapi","next","get","enabled","rateLimit","require$$3","RateLimit","loadConfig","middleware"],"mappings":";;;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAMA,IAAAA,GAAOC,6BAAAA;AACb,IAAA,MAAMC,KAAAA,GAAQC,2BAAAA;AACd,IAAA,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,OAAO,EAAE,GAAGC,2BAAAA;AAEnC,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGN,MAAMO,MAAM;AAEvC;;;;;;;;;;;;;;;;;;;;;AAqBA,KACA,MAAMC,yBAAAA,GAA4B;AAAC,QAAA,aAAA;AAAe,QAAA,sBAAA;AAAwB,QAAA;AAAwB,KAAA;AAElG,IAAA,MAAMC,mBAAAA,GAAsB,CAACC,WAAAA,GAAgBA,WAAAA,CAAYC,QAAQ,CAAC,WAAA,CAAA;AAElE,IAAA,MAAMC,2BAA2B,CAACF,WAAAA,GAAAA;AAChC,QAAA,IAAID,oBAAoBC,WAAAA,CAAAA,EAAc;YACpC,OAAO,KAAA;AACX,QAAA;QAEE,OAAO,CAACF,0BAA0BK,IAAI,CAAC,CAACC,KAAAA,GAAUJ,WAAAA,CAAYK,QAAQ,CAACD,KAAAA,CAAAA,CAAAA;AACzE,IAAA,CAAA;AAEA;;;;KAKA,MAAME,mCAAmC,CAACN,WAAAA,GAAAA;QACxC,MAAMO,UAAAA,GAAanB,IAAAA,CAAKoB,SAAS,CAACR,WAAAA,CAAAA;AAClC,QAAA,MAAMS,QAAQf,OAAAA,CAAQa,UAAAA,CAAAA;AACtB,QAAA,OAAOE,KAAAA,CAAMC,OAAO,CAAC,MAAA,EAAQ,EAAA,CAAA,IAAO,GAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMC,2BAA2B,CAACC,IAAAA,GAAAA;QAChC,IAAI,CAACA,IAAAA,IAAQ,CAACpB,QAAAA,CAASoB,IAAAA,CAAKC,KAAK,CAAA,IAAKD,IAAAA,CAAKC,KAAK,KAAK,EAAA,EAAI;YACvD,OAAO,mBAAA;AACX,QAAA;QAEE,OAAOnB,OAAAA,CAAQkB,KAAKC,KAAK,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;QACtB,IAAIf,WAAAA;AACJ,QAAA,IAAI,CAACR,QAAAA,CAASuB,GAAAA,CAAIC,OAAO,CAAC5B,IAAI,CAAA,EAAG;YAC/BY,WAAAA,GAAc,aAAA;QAClB,CAAA,MAAS;AACLA,YAAAA,WAAAA,GAAcM,gCAAAA,CAAiCS,GAAAA,CAAIC,OAAO,CAAC5B,IAAI,CAAA;YAC/D,IAAIY,WAAAA,KAAgB,GAAA,IAAOA,WAAAA,KAAgB,IAAA,EAAM;gBAC/CA,WAAAA,GAAc,aAAA;AACpB,YAAA;AACA,QAAA;QAEE,IAAI,CAACE,yBAAyBF,WAAAA,CAAAA,EAAc;YAC1C,OAAO,CAAC,aAAa,EAAEA,WAAAA,CAAY,CAAC,EAAEe,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC1D,QAAA;AAEE,QAAA,MAAMC,cAAAA,GAAiBP,wBAAAA,CAAyBI,GAAAA,CAAIC,OAAO,CAACJ,IAAI,CAAA;QAChE,OAAO,CAAA,EAAGM,cAAAA,CAAe,CAAC,EAAElB,WAAAA,CAAY,CAAC,EAAEe,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC7D,IAAA,CAAA;IAEA,MAAME,wBAAAA,GAA2B,CAACJ,GAAAA,EAAKK,eAAAA,EAAiBC,qBAAAA,GAAAA;QACtD,OAAO;YACLC,QAAAA,EAAU;gBAAEC,GAAAA,EAAK;AAAC,aAAA;YAClBC,GAAAA,EAAK,CAAA;AACL,YAAA,GAAGJ,eAAe;AAClB,YAAA,GAAGC,qBAAqB;AACxBI,YAAAA,OAAAA,CAAAA,GAAAA;AACE,gBAAA,MAAM,IAAI7B,cAAAA,EAAAA;AAChB,YAAA,CAAA;AACI8B,YAAAA,SAAAA,EAAWZ,cAAAA,CAAeC,GAAAA;AAC9B,SAAA;AACA,IAAA,CAAA;IAEAY,kBAAAA,CAAAC,OAAc,GACZ,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,OAAOf,GAAAA,EAAKgB,IAAAA,GAAAA;AACV,YAAA,IAAIX,eAAAA,GAAkBU,MAAAA,CAAOD,MAAM,CAACG,GAAG,CAAC,qCAAA,CAAA;AAExC,YAAA,IAAI,CAACZ,eAAAA,EAAiB;gBACpBA,eAAAA,GAAkB;oBAChBa,OAAAA,EAAS;AACjB,iBAAA;AACA,YAAA;YAEI,IAAI,CAACxC,GAAAA,CAAI,SAAA,EAAW2B,eAAAA,CAAAA,EAAkB;AACpCA,gBAAAA,eAAAA,CAAgBa,OAAO,GAAG,IAAA;AAChC,YAAA;YAEI,IAAIb,eAAAA,CAAgBa,OAAO,KAAK,IAAA,EAAM;gBACpC,MAAMC,SAAAA,GAAYC,4BAA0BC,SAAS;gBAErD,MAAMC,UAAAA,GAAalB,wBAAAA,CAAyBJ,GAAAA,EAAKK,eAAAA,EAAiBS,MAAAA,CAAAA;AAElE,gBAAA,OAAOK,SAAAA,CAAUI,UAAU,CAACD,UAAAA,CAAAA,CAAYtB,GAAAA,EAAKgB,IAAAA,CAAAA;AACnD,YAAA;YAEI,OAAOA,IAAAA,EAAAA;AACX,QAAA,CAAA;IAEAJ,kBAAAA,CAAAC,OAAA,CAAAd,cAA6B,GAAGA,cAAAA;IAChCa,kBAAAA,CAAAC,OAAA,CAAA9B,yBAAwC,GAAGA,yBAAAA;IAC3C6B,kBAAAA,CAAAC,OAAA,CAAAtB,gCAA+C,GAAGA,gCAAAA;IAClDqB,kBAAAA,CAAAC,OAAA,CAAAT,wBAAuC,GAAGA,wBAAAA;;;;;;"}

package/dist/server/middlewares/rateLimit.mjs

@@ -0,0 +1,118 @@
+import { __module as rateLimit } from '../_virtual/rateLimit.mjs';
+import require$$1$1 from 'path';
+import require$$1 from '@strapi/utils';
+import require$$0 from 'lodash/fp';
+import require$$3 from 'koa2-ratelimit';
+
+var hasRequiredRateLimit;
+function requireRateLimit() {
+    if (hasRequiredRateLimit) return rateLimit.exports;
+    hasRequiredRateLimit = 1;
+    const path = require$$1$1;
+    const utils = require$$1;
+    const { isString, has, toLower } = require$$0;
+    const { RateLimitError } = utils.errors;
+    /**
+	 * Routes where the rate-limit key MUST NOT include a user identifier
+	 * derived from `ctx.request.body.email`.
+	 *
+	 * On these routes the request body either has no `email` field
+	 * (e.g. /auth/local uses `identifier`, /auth/reset-password uses
+	 * `code`, /auth/change-password uses `currentPassword`) or the
+	 * field is not part of the route contract. Including the
+	 * attacker-controlled `body.email` in the rate-limit key on these
+	 * routes lets a caller obtain a fresh key on every request by
+	 * varying that field, effectively bypassing per-IP throttling.
+	 *
+	 * Comparison uses endsWith so the check is stable under any router
+	 * mount prefix (e.g. `/api/auth/local`).
+	 *
+	 * @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw
+	 *
+	 * When adding a new `rateLimit`-protected auth route whose body does not
+	 * use `email` as the real identifier, add its path suffix here (or an
+	 * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split
+	 * with arbitrary `body.email` values.
+	 */ const ROUTES_WITHOUT_IDENTIFIER = [
+        '/auth/local',
+        '/auth/reset-password',
+        '/auth/change-password'
+    ];
+    const isOAuthCallbackPath = (requestPath)=>requestPath.includes('/connect/');
+    const routeUsesEmailIdentifier = (requestPath)=>{
+        if (isOAuthCallbackPath(requestPath)) {
+            return false;
+        }
+        return !ROUTES_WITHOUT_IDENTIFIER.some((route)=>requestPath.endsWith(route));
+    };
+    /**
+	 * Paths suitable for route matching and prefix keys: POSIX-normalized,
+	 * lower-cased, trailing slashes removed so `/api/auth/local` and
+	 * `/api/auth/local/` share one bucket.
+	 */ const normalizeRequestPathForRateLimit = (requestPath)=>{
+        const normalized = path.normalize(requestPath);
+        const lower = toLower(normalized);
+        return lower.replace(/\/+$/, '') || '/';
+    };
+    const getEmailIdentifierForKey = (body)=>{
+        if (!body || !isString(body.email) || body.email === '') {
+            return 'unknownIdentifier';
+        }
+        return toLower(body.email);
+    };
+    const buildPrefixKey = (ctx)=>{
+        let requestPath;
+        if (!isString(ctx.request.path)) {
+            requestPath = 'invalidPath';
+        } else {
+            requestPath = normalizeRequestPathForRateLimit(ctx.request.path);
+            if (requestPath === '.' || requestPath === '..') {
+                requestPath = 'invalidPath';
+            }
+        }
+        if (!routeUsesEmailIdentifier(requestPath)) {
+            return `noIdentifier:${requestPath}:${ctx.request.ip}`;
+        }
+        const userIdentifier = getEmailIdentifierForKey(ctx.request.body);
+        return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;
+    };
+    const buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig)=>{
+        return {
+            interval: {
+                min: 5
+            },
+            max: 5,
+            ...rateLimitConfig,
+            ...routeMiddlewareConfig,
+            handler () {
+                throw new RateLimitError();
+            },
+            prefixKey: buildPrefixKey(ctx)
+        };
+    };
+    rateLimit.exports = (config, { strapi })=>async (ctx, next)=>{
+            let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');
+            if (!rateLimitConfig) {
+                rateLimitConfig = {
+                    enabled: true
+                };
+            }
+            if (!has('enabled', rateLimitConfig)) {
+                rateLimitConfig.enabled = true;
+            }
+            if (rateLimitConfig.enabled === true) {
+                const rateLimit = require$$3.RateLimit;
+                const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);
+                return rateLimit.middleware(loadConfig)(ctx, next);
+            }
+            return next();
+        };
+    rateLimit.exports.buildPrefixKey = buildPrefixKey;
+    rateLimit.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;
+    rateLimit.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;
+    rateLimit.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;
+    return rateLimit.exports;
+}
+
+export { requireRateLimit as __require };
+//# sourceMappingURL=rateLimit.mjs.map

package/dist/server/middlewares/rateLimit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.mjs","sources":["../../../server/middlewares/rateLimit.js"],"sourcesContent":["'use strict';\n\nconst path = require('path');\nconst utils = require('@strapi/utils');\nconst { isString, has, toLower } = require('lodash/fp');\n\nconst { RateLimitError } = utils.errors;\n\n/**\n * Routes where the rate-limit key MUST NOT include a user identifier\n * derived from `ctx.request.body.email`.\n *\n * On these routes the request body either has no `email` field\n * (e.g. /auth/local uses `identifier`, /auth/reset-password uses\n * `code`, /auth/change-password uses `currentPassword`) or the\n * field is not part of the route contract. Including the\n * attacker-controlled `body.email` in the rate-limit key on these\n * routes lets a caller obtain a fresh key on every request by\n * varying that field, effectively bypassing per-IP throttling.\n *\n * Comparison uses endsWith so the check is stable under any router\n * mount prefix (e.g. `/api/auth/local`).\n *\n * @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw\n *\n * When adding a new `rateLimit`-protected auth route whose body does not\n * use `email` as the real identifier, add its path suffix here (or an\n * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split\n * with arbitrary `body.email` values.\n */\nconst ROUTES_WITHOUT_IDENTIFIER = ['/auth/local', '/auth/reset-password', '/auth/change-password'];\n\nconst isOAuthCallbackPath = (requestPath) => requestPath.includes('/connect/');\n\nconst routeUsesEmailIdentifier = (requestPath) => {\n  if (isOAuthCallbackPath(requestPath)) {\n    return false;\n  }\n\n  return !ROUTES_WITHOUT_IDENTIFIER.some((route) => requestPath.endsWith(route));\n};\n\n/**\n * Paths suitable for route matching and prefix keys: POSIX-normalized,\n * lower-cased, trailing slashes removed so `/api/auth/local` and\n * `/api/auth/local/` share one bucket.\n */\nconst normalizeRequestPathForRateLimit = (requestPath) => {\n  const normalized = path.normalize(requestPath);\n  const lower = toLower(normalized);\n  return lower.replace(/\\/+$/, '') || '/';\n};\n\nconst getEmailIdentifierForKey = (body) => {\n  if (!body || !isString(body.email) || body.email === '') {\n    return 'unknownIdentifier';\n  }\n\n  return toLower(body.email);\n};\n\nconst buildPrefixKey = (ctx) => {\n  let requestPath;\n  if (!isString(ctx.request.path)) {\n    requestPath = 'invalidPath';\n  } else {\n    requestPath = normalizeRequestPathForRateLimit(ctx.request.path);\n    if (requestPath === '.' || requestPath === '..') {\n      requestPath = 'invalidPath';\n    }\n  }\n\n  if (!routeUsesEmailIdentifier(requestPath)) {\n    return `noIdentifier:${requestPath}:${ctx.request.ip}`;\n  }\n\n  const userIdentifier = getEmailIdentifierForKey(ctx.request.body);\n  return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;\n};\n\nconst buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig) => {\n  return {\n    interval: { min: 5 },\n    max: 5,\n    ...rateLimitConfig,\n    ...routeMiddlewareConfig,\n    handler() {\n      throw new RateLimitError();\n    },\n    prefixKey: buildPrefixKey(ctx),\n  };\n};\n\nmodule.exports =\n  (config, { strapi }) =>\n  async (ctx, next) => {\n    let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');\n\n    if (!rateLimitConfig) {\n      rateLimitConfig = {\n        enabled: true,\n      };\n    }\n\n    if (!has('enabled', rateLimitConfig)) {\n      rateLimitConfig.enabled = true;\n    }\n\n    if (rateLimitConfig.enabled === true) {\n      const rateLimit = require('koa2-ratelimit').RateLimit;\n\n      const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);\n\n      return rateLimit.middleware(loadConfig)(ctx, next);\n    }\n\n    return next();\n  };\n\nmodule.exports.buildPrefixKey = buildPrefixKey;\nmodule.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;\nmodule.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;\nmodule.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;\n"],"names":["path","require$$0","utils","require$$1","isString","has","toLower","require$$2","RateLimitError","errors","ROUTES_WITHOUT_IDENTIFIER","isOAuthCallbackPath","requestPath","includes","routeUsesEmailIdentifier","some","route","endsWith","normalizeRequestPathForRateLimit","normalized","normalize","lower","replace","getEmailIdentifierForKey","body","email","buildPrefixKey","ctx","request","ip","userIdentifier","buildRateLimitLoadConfig","rateLimitConfig","routeMiddlewareConfig","interval","min","max","handler","prefixKey","rateLimitModule","exports","config","strapi","next","get","enabled","rateLimit","require$$3","RateLimit","loadConfig","middleware"],"mappings":";;;;;;;;;;AAEA,IAAA,MAAMA,IAAAA,GAAOC,YAAAA;AACb,IAAA,MAAMC,KAAAA,GAAQC,UAAAA;AACd,IAAA,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,OAAO,EAAE,GAAGC,UAAAA;AAEnC,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGN,MAAMO,MAAM;AAEvC;;;;;;;;;;;;;;;;;;;;;AAqBA,KACA,MAAMC,yBAAAA,GAA4B;AAAC,QAAA,aAAA;AAAe,QAAA,sBAAA;AAAwB,QAAA;AAAwB,KAAA;AAElG,IAAA,MAAMC,mBAAAA,GAAsB,CAACC,WAAAA,GAAgBA,WAAAA,CAAYC,QAAQ,CAAC,WAAA,CAAA;AAElE,IAAA,MAAMC,2BAA2B,CAACF,WAAAA,GAAAA;AAChC,QAAA,IAAID,oBAAoBC,WAAAA,CAAAA,EAAc;YACpC,OAAO,KAAA;AACX,QAAA;QAEE,OAAO,CAACF,0BAA0BK,IAAI,CAAC,CAACC,KAAAA,GAAUJ,WAAAA,CAAYK,QAAQ,CAACD,KAAAA,CAAAA,CAAAA;AACzE,IAAA,CAAA;AAEA;;;;KAKA,MAAME,mCAAmC,CAACN,WAAAA,GAAAA;QACxC,MAAMO,UAAAA,GAAanB,IAAAA,CAAKoB,SAAS,CAACR,WAAAA,CAAAA;AAClC,QAAA,MAAMS,QAAQf,OAAAA,CAAQa,UAAAA,CAAAA;AACtB,QAAA,OAAOE,KAAAA,CAAMC,OAAO,CAAC,MAAA,EAAQ,EAAA,CAAA,IAAO,GAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMC,2BAA2B,CAACC,IAAAA,GAAAA;QAChC,IAAI,CAACA,IAAAA,IAAQ,CAACpB,QAAAA,CAASoB,IAAAA,CAAKC,KAAK,CAAA,IAAKD,IAAAA,CAAKC,KAAK,KAAK,EAAA,EAAI;YACvD,OAAO,mBAAA;AACX,QAAA;QAEE,OAAOnB,OAAAA,CAAQkB,KAAKC,KAAK,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;QACtB,IAAIf,WAAAA;AACJ,QAAA,IAAI,CAACR,QAAAA,CAASuB,GAAAA,CAAIC,OAAO,CAAC5B,IAAI,CAAA,EAAG;YAC/BY,WAAAA,GAAc,aAAA;QAClB,CAAA,MAAS;AACLA,YAAAA,WAAAA,GAAcM,gCAAAA,CAAiCS,GAAAA,CAAIC,OAAO,CAAC5B,IAAI,CAAA;YAC/D,IAAIY,WAAAA,KAAgB,GAAA,IAAOA,WAAAA,KAAgB,IAAA,EAAM;gBAC/CA,WAAAA,GAAc,aAAA;AACpB,YAAA;AACA,QAAA;QAEE,IAAI,CAACE,yBAAyBF,WAAAA,CAAAA,EAAc;YAC1C,OAAO,CAAC,aAAa,EAAEA,WAAAA,CAAY,CAAC,EAAEe,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC1D,QAAA;AAEE,QAAA,MAAMC,cAAAA,GAAiBP,wBAAAA,CAAyBI,GAAAA,CAAIC,OAAO,CAACJ,IAAI,CAAA;QAChE,OAAO,CAAA,EAAGM,cAAAA,CAAe,CAAC,EAAElB,WAAAA,CAAY,CAAC,EAAEe,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC7D,IAAA,CAAA;IAEA,MAAME,wBAAAA,GAA2B,CAACJ,GAAAA,EAAKK,eAAAA,EAAiBC,qBAAAA,GAAAA;QACtD,OAAO;YACLC,QAAAA,EAAU;gBAAEC,GAAAA,EAAK;AAAC,aAAA;YAClBC,GAAAA,EAAK,CAAA;AACL,YAAA,GAAGJ,eAAe;AAClB,YAAA,GAAGC,qBAAqB;AACxBI,YAAAA,OAAAA,CAAAA,GAAAA;AACE,gBAAA,MAAM,IAAI7B,cAAAA,EAAAA;AAChB,YAAA,CAAA;AACI8B,YAAAA,SAAAA,EAAWZ,cAAAA,CAAeC,GAAAA;AAC9B,SAAA;AACA,IAAA,CAAA;IAEAY,SAAAA,CAAAC,OAAc,GACZ,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,OAAOf,GAAAA,EAAKgB,IAAAA,GAAAA;AACV,YAAA,IAAIX,eAAAA,GAAkBU,MAAAA,CAAOD,MAAM,CAACG,GAAG,CAAC,qCAAA,CAAA;AAExC,YAAA,IAAI,CAACZ,eAAAA,EAAiB;gBACpBA,eAAAA,GAAkB;oBAChBa,OAAAA,EAAS;AACjB,iBAAA;AACA,YAAA;YAEI,IAAI,CAACxC,GAAAA,CAAI,SAAA,EAAW2B,eAAAA,CAAAA,EAAkB;AACpCA,gBAAAA,eAAAA,CAAgBa,OAAO,GAAG,IAAA;AAChC,YAAA;YAEI,IAAIb,eAAAA,CAAgBa,OAAO,KAAK,IAAA,EAAM;gBACpC,MAAMC,SAAAA,GAAYC,WAA0BC,SAAS;gBAErD,MAAMC,UAAAA,GAAalB,wBAAAA,CAAyBJ,GAAAA,EAAKK,eAAAA,EAAiBS,MAAAA,CAAAA;AAElE,gBAAA,OAAOK,SAAAA,CAAUI,UAAU,CAACD,UAAAA,CAAAA,CAAYtB,GAAAA,EAAKgB,IAAAA,CAAAA;AACnD,YAAA;YAEI,OAAOA,IAAAA,EAAAA;AACX,QAAA,CAAA;IAEAJ,SAAAA,CAAAC,OAAA,CAAAd,cAA6B,GAAGA,cAAAA;IAChCa,SAAAA,CAAAC,OAAA,CAAA9B,yBAAwC,GAAGA,yBAAAA;IAC3C6B,SAAAA,CAAAC,OAAA,CAAAtB,gCAA+C,GAAGA,gCAAAA;IAClDqB,SAAAA,CAAAC,OAAA,CAAAT,wBAAuC,GAAGA,wBAAAA;;;;;;"}

package/dist/server/register.js

@@ -0,0 +1,46 @@
+'use strict';
+
+var require$$0 = require('fs');
+var require$$1 = require('path');
+var usersPermissions = require('./strategies/users-permissions.js');
+var sanitizers = require('./utils/sanitize/sanitizers.js');
+var index = require('./graphql/index.js');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var require$$0__default = /*#__PURE__*/_interopDefault(require$$0);
+var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
+
+var register;
+var hasRequiredRegister;
+function requireRegister() {
+    if (hasRequiredRegister) return register;
+    hasRequiredRegister = 1;
+    const fs = require$$0__default.default;
+    const path = require$$1__default.default;
+    const authStrategy = usersPermissions.__require();
+    const sanitizers$1 = sanitizers.__require();
+    register = ({ strapi })=>{
+        strapi.get('auth').register('content-api', authStrategy);
+        strapi.sanitizers.add('content-api.output', sanitizers$1.defaultSanitizeOutput);
+        if (strapi.plugin('graphql')) {
+            index.__require()({
+                strapi
+            });
+        }
+        if (strapi.plugin('documentation')) {
+            const specPath = path.join(__dirname, '../../documentation/content-api.yaml');
+            const spec = fs.readFileSync(specPath, 'utf8');
+            strapi.plugin('documentation').service('override').registerOverride(spec, {
+                pluginOrigin: 'users-permissions',
+                excludeFromGeneration: [
+                    'users-permissions'
+                ]
+            });
+        }
+    };
+    return register;
+}
+
+exports.__require = requireRegister;
+//# sourceMappingURL=register.js.map

package/dist/server/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sources":["../../server/register.js"],"sourcesContent":["'use strict';\n\nconst fs = require('fs');\nconst path = require('path');\n\nconst authStrategy = require('./strategies/users-permissions');\nconst sanitizers = require('./utils/sanitize/sanitizers');\n\nmodule.exports = ({ strapi }) => {\n  strapi.get('auth').register('content-api', authStrategy);\n  strapi.sanitizers.add('content-api.output', sanitizers.defaultSanitizeOutput);\n\n  if (strapi.plugin('graphql')) {\n    require('./graphql')({ strapi });\n  }\n\n  if (strapi.plugin('documentation')) {\n    const specPath = path.join(__dirname, '../../documentation/content-api.yaml');\n    const spec = fs.readFileSync(specPath, 'utf8');\n\n    strapi\n      .plugin('documentation')\n      .service('override')\n      .registerOverride(spec, {\n        pluginOrigin: 'users-permissions',\n        excludeFromGeneration: ['users-permissions'],\n      });\n  }\n};\n"],"names":["fs","require$$0","path","require$$1","authStrategy","require$$2","sanitizers","require$$3","register","strapi","get","add","defaultSanitizeOutput","plugin","require$$4","specPath","join","__dirname","spec","readFileSync","service","registerOverride","pluginOrigin","excludeFromGeneration"],"mappings":";;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAMA,EAAAA,GAAKC,2BAAAA;AACX,IAAA,MAAMC,IAAAA,GAAOC,2BAAAA;AAEb,IAAA,MAAMC,YAAAA,GAAeC,0BAAAA,EAAAA;AACrB,IAAA,MAAMC,YAAAA,GAAaC,oBAAAA,EAAAA;IAEnBC,QAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,GAAA;AAC1BA,QAAAA,MAAAA,CAAOC,GAAG,CAAC,MAAA,CAAA,CAAQF,QAAQ,CAAC,aAAA,EAAeJ,YAAAA,CAAAA;AAC3CK,QAAAA,MAAAA,CAAOH,UAAU,CAACK,GAAG,CAAC,oBAAA,EAAsBL,aAAWM,qBAAqB,CAAA;QAE5E,IAAIH,MAAAA,CAAOI,MAAM,CAAC,SAAA,CAAA,EAAY;YAC5BC,eAAAA,EAAAA,CAAqB;AAAEL,gBAAAA;AAAM,aAAA,CAAA;AACjC,QAAA;QAEE,IAAIA,MAAAA,CAAOI,MAAM,CAAC,eAAA,CAAA,EAAkB;AAClC,YAAA,MAAME,QAAAA,GAAWb,IAAAA,CAAKc,IAAI,CAACC,SAAAA,EAAW,sCAAA,CAAA;AACtC,YAAA,MAAMC,IAAAA,GAAOlB,EAAAA,CAAGmB,YAAY,CAACJ,QAAAA,EAAU,MAAA,CAAA;YAEvCN,MAAAA,CACGI,MAAM,CAAC,eAAA,CAAA,CACPO,OAAO,CAAC,UAAA,CAAA,CACRC,gBAAgB,CAACH,IAAAA,EAAM;gBACtBI,YAAAA,EAAc,mBAAA;gBACdC,qBAAAA,EAAuB;AAAC,oBAAA;AAAoB;AACpD,aAAA,CAAA;AACA,QAAA;AACA,IAAA,CAAA;;;;;;"}

package/dist/server/register.mjs

@@ -0,0 +1,39 @@
+import require$$0 from 'fs';
+import require$$1 from 'path';
+import { __require as requireUsersPermissions } from './strategies/users-permissions.mjs';
+import { __require as requireSanitizers } from './utils/sanitize/sanitizers.mjs';
+import { __require as requireGraphql } from './graphql/index.mjs';
+
+var register;
+var hasRequiredRegister;
+function requireRegister() {
+    if (hasRequiredRegister) return register;
+    hasRequiredRegister = 1;
+    const fs = require$$0;
+    const path = require$$1;
+    const authStrategy = requireUsersPermissions();
+    const sanitizers = requireSanitizers();
+    register = ({ strapi })=>{
+        strapi.get('auth').register('content-api', authStrategy);
+        strapi.sanitizers.add('content-api.output', sanitizers.defaultSanitizeOutput);
+        if (strapi.plugin('graphql')) {
+            requireGraphql()({
+                strapi
+            });
+        }
+        if (strapi.plugin('documentation')) {
+            const specPath = path.join(__dirname, '../../documentation/content-api.yaml');
+            const spec = fs.readFileSync(specPath, 'utf8');
+            strapi.plugin('documentation').service('override').registerOverride(spec, {
+                pluginOrigin: 'users-permissions',
+                excludeFromGeneration: [
+                    'users-permissions'
+                ]
+            });
+        }
+    };
+    return register;
+}
+
+export { requireRegister as __require };
+//# sourceMappingURL=register.mjs.map

package/dist/server/register.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.mjs","sources":["../../server/register.js"],"sourcesContent":["'use strict';\n\nconst fs = require('fs');\nconst path = require('path');\n\nconst authStrategy = require('./strategies/users-permissions');\nconst sanitizers = require('./utils/sanitize/sanitizers');\n\nmodule.exports = ({ strapi }) => {\n  strapi.get('auth').register('content-api', authStrategy);\n  strapi.sanitizers.add('content-api.output', sanitizers.defaultSanitizeOutput);\n\n  if (strapi.plugin('graphql')) {\n    require('./graphql')({ strapi });\n  }\n\n  if (strapi.plugin('documentation')) {\n    const specPath = path.join(__dirname, '../../documentation/content-api.yaml');\n    const spec = fs.readFileSync(specPath, 'utf8');\n\n    strapi\n      .plugin('documentation')\n      .service('override')\n      .registerOverride(spec, {\n        pluginOrigin: 'users-permissions',\n        excludeFromGeneration: ['users-permissions'],\n      });\n  }\n};\n"],"names":["fs","require$$0","path","require$$1","authStrategy","require$$2","sanitizers","require$$3","register","strapi","get","add","defaultSanitizeOutput","plugin","require$$4","specPath","join","__dirname","spec","readFileSync","service","registerOverride","pluginOrigin","excludeFromGeneration"],"mappings":";;;;;;;;;;;AAEA,IAAA,MAAMA,EAAAA,GAAKC,UAAAA;AACX,IAAA,MAAMC,IAAAA,GAAOC,UAAAA;AAEb,IAAA,MAAMC,YAAAA,GAAeC,uBAAAA,EAAAA;AACrB,IAAA,MAAMC,UAAAA,GAAaC,iBAAAA,EAAAA;IAEnBC,QAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,GAAA;AAC1BA,QAAAA,MAAAA,CAAOC,GAAG,CAAC,MAAA,CAAA,CAAQF,QAAQ,CAAC,aAAA,EAAeJ,YAAAA,CAAAA;AAC3CK,QAAAA,MAAAA,CAAOH,UAAU,CAACK,GAAG,CAAC,oBAAA,EAAsBL,WAAWM,qBAAqB,CAAA;QAE5E,IAAIH,MAAAA,CAAOI,MAAM,CAAC,SAAA,CAAA,EAAY;YAC5BC,cAAAA,EAAAA,CAAqB;AAAEL,gBAAAA;AAAM,aAAA,CAAA;AACjC,QAAA;QAEE,IAAIA,MAAAA,CAAOI,MAAM,CAAC,eAAA,CAAA,EAAkB;AAClC,YAAA,MAAME,QAAAA,GAAWb,IAAAA,CAAKc,IAAI,CAACC,SAAAA,EAAW,sCAAA,CAAA;AACtC,YAAA,MAAMC,IAAAA,GAAOlB,EAAAA,CAAGmB,YAAY,CAACJ,QAAAA,EAAU,MAAA,CAAA;YAEvCN,MAAAA,CACGI,MAAM,CAAC,eAAA,CAAA,CACPO,OAAO,CAAC,UAAA,CAAA,CACRC,gBAAgB,CAACH,IAAAA,EAAM;gBACtBI,YAAAA,EAAc,mBAAA;gBACdC,qBAAAA,EAAuB;AAAC,oBAAA;AAAoB;AACpD,aAAA,CAAA;AACA,QAAA;AACA,IAAA,CAAA;;;;;;"}

package/dist/server/routes/admin/index.js

@@ -0,0 +1,27 @@
+'use strict';
+
+var permissions = require('./permissions.js');
+var settings = require('./settings.js');
+var role = require('./role.js');
+
+var admin;
+var hasRequiredAdmin;
+function requireAdmin() {
+    if (hasRequiredAdmin) return admin;
+    hasRequiredAdmin = 1;
+    const permissionsRoutes = permissions.__require();
+    const settingsRoutes = settings.__require();
+    const roleRoutes = role.__require();
+    admin = {
+        type: 'admin',
+        routes: [
+            ...roleRoutes,
+            ...settingsRoutes,
+            ...permissionsRoutes
+        ]
+    };
+    return admin;
+}
+
+exports.__require = requireAdmin;
+//# sourceMappingURL=index.js.map

package/dist/server/routes/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../../server/routes/admin/index.js"],"sourcesContent":["'use strict';\n\nconst permissionsRoutes = require('./permissions');\nconst settingsRoutes = require('./settings');\nconst roleRoutes = require('./role');\n\nmodule.exports = {\n  type: 'admin',\n  routes: [...roleRoutes, ...settingsRoutes, ...permissionsRoutes],\n};\n"],"names":["permissionsRoutes","require$$0","settingsRoutes","require$$1","roleRoutes","require$$2","admin","type","routes"],"mappings":";;;;;;;;;;;AAEA,IAAA,MAAMA,iBAAAA,GAAoBC,qBAAAA,EAAAA;AAC1B,IAAA,MAAMC,cAAAA,GAAiBC,kBAAAA,EAAAA;AACvB,IAAA,MAAMC,UAAAA,GAAaC,cAAAA,EAAAA;IAEnBC,KAAAA,GAAiB;QACfC,IAAAA,EAAM,OAAA;QACNC,MAAAA,EAAQ;AAAIJ,YAAAA,GAAAA,UAAAA;AAAeF,YAAAA,GAAAA,cAAAA;AAAmBF,YAAAA,GAAAA;AAAkB;AAClE,KAAA;;;;;;"}

package/dist/server/routes/admin/index.mjs

@@ -0,0 +1,25 @@
+import { __require as requirePermissions } from './permissions.mjs';
+import { __require as requireSettings } from './settings.mjs';
+import { __require as requireRole } from './role.mjs';
+
+var admin;
+var hasRequiredAdmin;
+function requireAdmin() {
+    if (hasRequiredAdmin) return admin;
+    hasRequiredAdmin = 1;
+    const permissionsRoutes = requirePermissions();
+    const settingsRoutes = requireSettings();
+    const roleRoutes = requireRole();
+    admin = {
+        type: 'admin',
+        routes: [
+            ...roleRoutes,
+            ...settingsRoutes,
+            ...permissionsRoutes
+        ]
+    };
+    return admin;
+}
+
+export { requireAdmin as __require };
+//# sourceMappingURL=index.mjs.map

package/dist/server/routes/admin/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sources":["../../../../server/routes/admin/index.js"],"sourcesContent":["'use strict';\n\nconst permissionsRoutes = require('./permissions');\nconst settingsRoutes = require('./settings');\nconst roleRoutes = require('./role');\n\nmodule.exports = {\n  type: 'admin',\n  routes: [...roleRoutes, ...settingsRoutes, ...permissionsRoutes],\n};\n"],"names":["permissionsRoutes","require$$0","settingsRoutes","require$$1","roleRoutes","require$$2","admin","type","routes"],"mappings":";;;;;;;;;AAEA,IAAA,MAAMA,iBAAAA,GAAoBC,kBAAAA,EAAAA;AAC1B,IAAA,MAAMC,cAAAA,GAAiBC,eAAAA,EAAAA;AACvB,IAAA,MAAMC,UAAAA,GAAaC,WAAAA,EAAAA;IAEnBC,KAAAA,GAAiB;QACfC,IAAAA,EAAM,OAAA;QACNC,MAAAA,EAAQ;AAAIJ,YAAAA,GAAAA,UAAAA;AAAeF,YAAAA,GAAAA,cAAAA;AAAmBF,YAAAA,GAAAA;AAAkB;AAClE,KAAA;;;;;;"}

package/dist/server/routes/admin/permissions.js

@@ -0,0 +1,29 @@
+'use strict';
+
+var permissions;
+var hasRequiredPermissions;
+function requirePermissions() {
+    if (hasRequiredPermissions) return permissions;
+    hasRequiredPermissions = 1;
+    permissions = [
+        {
+            method: 'GET',
+            path: '/permissions',
+            handler: 'permissions.getPermissions'
+        },
+        {
+            method: 'GET',
+            path: '/policies',
+            handler: 'permissions.getPolicies'
+        },
+        {
+            method: 'GET',
+            path: '/routes',
+            handler: 'permissions.getRoutes'
+        }
+    ];
+    return permissions;
+}
+
+exports.__require = requirePermissions;
+//# sourceMappingURL=permissions.js.map

package/dist/server/routes/admin/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sources":["../../../../server/routes/admin/permissions.js"],"sourcesContent":["'use strict';\n\nmodule.exports = [\n  {\n    method: 'GET',\n    path: '/permissions',\n    handler: 'permissions.getPermissions',\n  },\n  {\n    method: 'GET',\n    path: '/policies',\n    handler: 'permissions.getPolicies',\n  },\n\n  {\n    method: 'GET',\n    path: '/routes',\n    handler: 'permissions.getRoutes',\n  },\n];\n"],"names":["permissions","method","path","handler"],"mappings":";;;;;;;IAEAA,WAAAA,GAAiB;AACf,QAAA;YACEC,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,cAAA;YACNC,OAAAA,EAAS;AACb,SAAA;AACE,QAAA;YACEF,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,WAAA;YACNC,OAAAA,EAAS;AACb,SAAA;AAEE,QAAA;YACEF,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,SAAA;YACNC,OAAAA,EAAS;AACb;AACC,KAAA;;;;;;"}

package/dist/server/routes/admin/permissions.mjs

@@ -0,0 +1,27 @@
+var permissions;
+var hasRequiredPermissions;
+function requirePermissions() {
+    if (hasRequiredPermissions) return permissions;
+    hasRequiredPermissions = 1;
+    permissions = [
+        {
+            method: 'GET',
+            path: '/permissions',
+            handler: 'permissions.getPermissions'
+        },
+        {
+            method: 'GET',
+            path: '/policies',
+            handler: 'permissions.getPolicies'
+        },
+        {
+            method: 'GET',
+            path: '/routes',
+            handler: 'permissions.getRoutes'
+        }
+    ];
+    return permissions;
+}
+
+export { requirePermissions as __require };
+//# sourceMappingURL=permissions.mjs.map

package/dist/server/routes/admin/permissions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.mjs","sources":["../../../../server/routes/admin/permissions.js"],"sourcesContent":["'use strict';\n\nmodule.exports = [\n  {\n    method: 'GET',\n    path: '/permissions',\n    handler: 'permissions.getPermissions',\n  },\n  {\n    method: 'GET',\n    path: '/policies',\n    handler: 'permissions.getPolicies',\n  },\n\n  {\n    method: 'GET',\n    path: '/routes',\n    handler: 'permissions.getRoutes',\n  },\n];\n"],"names":["permissions","method","path","handler"],"mappings":";;;;;IAEAA,WAAAA,GAAiB;AACf,QAAA;YACEC,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,cAAA;YACNC,OAAAA,EAAS;AACb,SAAA;AACE,QAAA;YACEF,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,WAAA;YACNC,OAAAA,EAAS;AACb,SAAA;AAEE,QAAA;YACEF,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,SAAA;YACNC,OAAAA,EAAS;AACb;AACC,KAAA;;;;;;"}

package/dist/server/routes/admin/role.js

@@ -0,0 +1,99 @@
+'use strict';
+
+var role;
+var hasRequiredRole;
+function requireRole() {
+    if (hasRequiredRole) return role;
+    hasRequiredRole = 1;
+    role = [
+        {
+            method: 'GET',
+            path: '/roles/:id',
+            handler: 'role.findOne',
+            config: {
+                policies: [
+                    {
+                        name: 'admin::hasPermissions',
+                        config: {
+                            actions: [
+                                'plugin::users-permissions.roles.read'
+                            ]
+                        }
+                    }
+                ]
+            }
+        },
+        {
+            method: 'GET',
+            path: '/roles',
+            handler: 'role.find',
+            config: {
+                policies: [
+                    {
+                        name: 'admin::hasPermissions',
+                        config: {
+                            actions: [
+                                'plugin::users-permissions.roles.read'
+                            ]
+                        }
+                    }
+                ]
+            }
+        },
+        {
+            method: 'POST',
+            path: '/roles',
+            handler: 'role.createRole',
+            config: {
+                policies: [
+                    {
+                        name: 'admin::hasPermissions',
+                        config: {
+                            actions: [
+                                'plugin::users-permissions.roles.create'
+                            ]
+                        }
+                    }
+                ]
+            }
+        },
+        {
+            method: 'PUT',
+            path: '/roles/:role',
+            handler: 'role.updateRole',
+            config: {
+                policies: [
+                    {
+                        name: 'admin::hasPermissions',
+                        config: {
+                            actions: [
+                                'plugin::users-permissions.roles.update'
+                            ]
+                        }
+                    }
+                ]
+            }
+        },
+        {
+            method: 'DELETE',
+            path: '/roles/:role',
+            handler: 'role.deleteRole',
+            config: {
+                policies: [
+                    {
+                        name: 'admin::hasPermissions',
+                        config: {
+                            actions: [
+                                'plugin::users-permissions.roles.delete'
+                            ]
+                        }
+                    }
+                ]
+            }
+        }
+    ];
+    return role;
+}
+
+exports.__require = requireRole;
+//# sourceMappingURL=role.js.map

package/dist/server/routes/admin/role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.js","sources":["../../../../server/routes/admin/role.js"],"sourcesContent":["'use strict';\n\nmodule.exports = [\n  {\n    method: 'GET',\n    path: '/roles/:id',\n    handler: 'role.findOne',\n    config: {\n      policies: [\n        {\n          name: 'admin::hasPermissions',\n          config: {\n            actions: ['plugin::users-permissions.roles.read'],\n          },\n        },\n      ],\n    },\n  },\n  {\n    method: 'GET',\n    path: '/roles',\n    handler: 'role.find',\n    config: {\n      policies: [\n        {\n          name: 'admin::hasPermissions',\n          config: {\n            actions: ['plugin::users-permissions.roles.read'],\n          },\n        },\n      ],\n    },\n  },\n  {\n    method: 'POST',\n    path: '/roles',\n    handler: 'role.createRole',\n    config: {\n      policies: [\n        {\n          name: 'admin::hasPermissions',\n          config: {\n            actions: ['plugin::users-permissions.roles.create'],\n          },\n        },\n      ],\n    },\n  },\n  {\n    method: 'PUT',\n    path: '/roles/:role',\n    handler: 'role.updateRole',\n    config: {\n      policies: [\n        {\n          name: 'admin::hasPermissions',\n          config: {\n            actions: ['plugin::users-permissions.roles.update'],\n          },\n        },\n      ],\n    },\n  },\n  {\n    method: 'DELETE',\n    path: '/roles/:role',\n    handler: 'role.deleteRole',\n    config: {\n      policies: [\n        {\n          name: 'admin::hasPermissions',\n          config: {\n            actions: ['plugin::users-permissions.roles.delete'],\n          },\n        },\n      ],\n    },\n  },\n];\n"],"names":["role","method","path","handler","config","policies","name","actions"],"mappings":";;;;;;;IAEAA,IAAAA,GAAiB;AACf,QAAA;YACEC,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,YAAA;YACNC,OAAAA,EAAS,cAAA;YACTC,MAAAA,EAAQ;gBACNC,QAAAA,EAAU;AACR,oBAAA;wBACEC,IAAAA,EAAM,uBAAA;wBACNF,MAAAA,EAAQ;4BACNG,OAAAA,EAAS;AAAC,gCAAA;AAAuC;AAC7D;AACA;AACO;AACP;AACA,SAAA;AACE,QAAA;YACEN,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,QAAA;YACNC,OAAAA,EAAS,WAAA;YACTC,MAAAA,EAAQ;gBACNC,QAAAA,EAAU;AACR,oBAAA;wBACEC,IAAAA,EAAM,uBAAA;wBACNF,MAAAA,EAAQ;4BACNG,OAAAA,EAAS;AAAC,gCAAA;AAAuC;AAC7D;AACA;AACO;AACP;AACA,SAAA;AACE,QAAA;YACEN,MAAAA,EAAQ,MAAA;YACRC,IAAAA,EAAM,QAAA;YACNC,OAAAA,EAAS,iBAAA;YACTC,MAAAA,EAAQ;gBACNC,QAAAA,EAAU;AACR,oBAAA;wBACEC,IAAAA,EAAM,uBAAA;wBACNF,MAAAA,EAAQ;4BACNG,OAAAA,EAAS;AAAC,gCAAA;AAAyC;AAC/D;AACA;AACO;AACP;AACA,SAAA;AACE,QAAA;YACEN,MAAAA,EAAQ,KAAA;YACRC,IAAAA,EAAM,cAAA;YACNC,OAAAA,EAAS,iBAAA;YACTC,MAAAA,EAAQ;gBACNC,QAAAA,EAAU;AACR,oBAAA;wBACEC,IAAAA,EAAM,uBAAA;wBACNF,MAAAA,EAAQ;4BACNG,OAAAA,EAAS;AAAC,gCAAA;AAAyC;AAC/D;AACA;AACO;AACP;AACA,SAAA;AACE,QAAA;YACEN,MAAAA,EAAQ,QAAA;YACRC,IAAAA,EAAM,cAAA;YACNC,OAAAA,EAAS,iBAAA;YACTC,MAAAA,EAAQ;gBACNC,QAAAA,EAAU;AACR,oBAAA;wBACEC,IAAAA,EAAM,uBAAA;wBACNF,MAAAA,EAAQ;4BACNG,OAAAA,EAAS;AAAC,gCAAA;AAAyC;AAC/D;AACA;AACO;AACP;AACA;AACC,KAAA;;;;;;"}