@strapi/plugin-users-permissions 0.0.0-experimental.6340da17068c3bed7fb006e7bcc554c71129e282 → 0.0.0-experimental.63624e21eb5b0713345a0cf2f68f1c40eab427bc

package/dist/server/services/user.js

@@ -1,17 +1,17 @@
 'use strict';
 
 var require$$0$1 = require('crypto');
-var require$$1$1 = require('bcryptjs');
-var require$$2 = require('url-join');
+var require$$1$2 = require('bcryptjs');
+var require$$1$1 = require('url-join');
 var require$$1 = require('@strapi/utils');
-var require$$0 = require('lodash/fp');
+var require$$0 = require('lodash');
 var index = require('../utils/index.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var require$$0__default$1 = /*#__PURE__*/_interopDefault(require$$0$1);
+var require$$1__default$2 = /*#__PURE__*/_interopDefault(require$$1$2);
 var require$$1__default$1 = /*#__PURE__*/_interopDefault(require$$1$1);
-var require$$2__default = /*#__PURE__*/_interopDefault(require$$2);
 var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
 var require$$0__default = /*#__PURE__*/_interopDefault(require$$0);
 
@@ -25,12 +25,13 @@ function requireUser() {
 	 *
 	 * @description: A set of functions similar to controller's actions to avoid code duplication.
 	 */ const crypto = require$$0__default$1.default;
-    const bcrypt = require$$1__default$1.default;
-    const urlJoin = require$$2__default.default;
-    const { sanitize } = require$$1__default.default;
-    const { toNumber, getOr } = require$$0__default.default;
+    const bcrypt = require$$1__default$2.default;
+    const urlJoin = require$$1__default$1.default;
+    const { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require$$1__default.default;
+    const { pick, get, toNumber } = require$$0__default.default;
     const { getService } = index.__require();
     const USER_MODEL_UID = 'plugin::users-permissions.user';
+    const pickAllowedQueryParams = (params)=>pick(params, ALLOWED_QUERY_PARAM_KEYS);
     const getSessionManager = ()=>{
         const manager = strapi.sessionManager;
         return manager ?? null;
@@ -41,9 +42,8 @@ function requireUser() {
 	   *
 	   * @return {Promise}
 	   */ count (params) {
-                return strapi1.db.query(USER_MODEL_UID).count({
-                    where: params
-                });
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
+                return strapi1.db.query(USER_MODEL_UID).count(query);
             },
             /**
 	   * Hashes password fields in the provided values object if they are present.
@@ -57,7 +57,7 @@ function requireUser() {
                 for(const key in values){
                     if (attributes[key] && attributes[key].type === 'password') {
                         // Check if a custom encryption.rounds has been set on the password attribute
-                        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));
+                        const rounds = toNumber(get(attributes[key], 'encryption.rounds', 10));
                         values[key] = await bcrypt.hash(values[key], rounds);
                     }
                 }
@@ -112,7 +112,7 @@ function requireUser() {
 	   * Promise to fetch a/an user.
 	   * @return {Promise}
 	   */ fetch (id, params) {
-                const query = strapi1.get('query-params').transform(USER_MODEL_UID, params ?? {});
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
                 return strapi1.db.query(USER_MODEL_UID).findOne({
                     ...query,
                     where: {
@@ -142,7 +142,7 @@ function requireUser() {
 	   * Promise to fetch all users.
 	   * @return {Promise}
 	   */ fetchAll (params) {
-                const query = strapi1.get('query-params').transform(USER_MODEL_UID, params ?? {});
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
                 return strapi1.db.query(USER_MODEL_UID).findMany(query);
             },
             /**

package/dist/server/services/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sources":["../../../server/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize } = require('@strapi/utils');\nconst { toNumber, getOr } = require('lodash/fp');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    return strapi.db.query(USER_MODEL_UID).count({ where: params });\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","require$$3","toNumber","getOr","require$$4","getService","require$$5","USER_MODEL_UID","getSessionManager","manager","strapi","sessionManager","user","count","params","db","query","where","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","id","select","update","documentId","fetch","get","transform","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,2BAAAA;IAEhB,MAAM,EAAEC,QAAQ,EAAE,GAAGC,2BAAAA;AACrB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,KAAK,EAAE,GAAGC,2BAAAA;IAC5B,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMC,MAAM,EAAA;AACV,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgBM,KAAK,CAAC;oBAAEI,KAAAA,EAAOH;AAAM,iBAAA,CAAA;AAChE,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMI,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaV,OAAAA,CAAOW,QAAQ,CAACd,gBAAgBa,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAAStB,QAAAA,CAASC,KAAAA,CAAM,IAAI,mBAAA,EAAqBiB,UAAU,CAACE,GAAAA,CAAI,CAAA,CAAA;wBACtEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM1B,MAAAA,CAAO6B,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOT,OAAAA,CAAOiB,SAAS,CAACpB,cAAAA,CAAAA,CAAgBqB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAElB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMmB,KAAAA,GAAQ,MAAMvB,OAAAA,CAAOK,EAAE,CAC1BC,KAAK,CAACT,cAAAA,CAAAA,CACN2B,OAAO,CAAC;oBAAEjB,KAAAA,EAAO;wBAAEkB,EAAAA,EAAIH;AAAM,qBAAA;oBAAII,MAAAA,EAAQ;AAAC,wBAAA;AAAa;AAAA,iBAAA,CAAA;AAE1D,gBAAA,IAAI,CAACH,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOvB,OAAAA,CAAOiB,SAAS,CAACpB,cAAAA,CAAAA,CAAgB8B,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYL,MAAMK,UAAU;oBAC5BT,IAAAA,EAAMf,MAAAA;oBACNgB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIES,KAAAA,CAAAA,CAAMJ,EAAE,EAAErB,MAAM,EAAA;gBACd,MAAME,KAAAA,GAAQN,QAAO8B,GAAG,CAAC,gBAAgBC,SAAS,CAAClC,cAAAA,EAAgBO,MAAAA,IAAU,EAAA,CAAA;AAE7E,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2B,OAAO,CAAC;AAC7C,oBAAA,GAAGlB,KAAK;oBACRC,KAAAA,EAAO;wBACLyB,IAAAA,EAAM;AAAC,4BAAA;AAAEP,gCAAAA;AAAE,6BAAA;4BAAInB,KAAAA,CAAMC,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACE0B,wBAAuBR,EAAE,EAAA;AACvB,gBAAA,OAAOzB,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2B,OAAO,CAAC;oBAAEjB,KAAAA,EAAO;AAAEkB,wBAAAA;AAAE,qBAAA;oBAAIL,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEc,UAAS9B,MAAM,EAAA;gBACb,MAAME,KAAAA,GAAQN,QAAO8B,GAAG,CAAC,gBAAgBC,SAAS,CAAClC,cAAAA,EAAgBO,MAAAA,IAAU,EAAA,CAAA;AAE7E,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgBsC,QAAQ,CAAC7B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM8B,QAAOhC,MAAM,EAAA;;AAEjB,gBAAA,MAAMH,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAeoC,SAAS,CAAC,mBAAA,CAAA,IAAwBjC,MAAAA,CAAOqB,EAAE,EAAE;AAChF,oBAAA,MAAMxB,eAAe,mBAAA,CAAA,CAAqBqC,sBAAsB,CAACC,MAAAA,CAAOnC,OAAOqB,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAOzB,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2C,MAAM,CAAC;oBAAEjC,KAAAA,EAAOH;AAAM,iBAAA,CAAA;AACjE,YAAA,CAAA;YAEEqC,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE3B,IAAI,EAAA;gBAC7B,OAAO7B,MAAAA,CAAOyD,OAAO,CAACD,QAAAA,EAAU3B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM6B,uBAAsB1C,IAAI,EAAA;AAC9B,gBAAA,MAAM2C,wBAAwBlD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMmD,WAAAA,GAAc,MAAM9C,OAAAA,CAAO+C,KAAK,CAAC;oBAAElC,IAAAA,EAAM,QAAA;oBAAUmC,IAAAA,EAAM;AAAmB,iBAAA,CAAA;gBAClF,MAAMC,UAAAA,GAAajD,OAAAA,CAAOW,QAAQ,CAACd,cAAAA,CAAAA;AAEnC,gBAAA,MAAMqD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBhB,GAAG,CAAC;oBAAElB,GAAAA,EAAK;mBACXuC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMjE,QAAAA,CAASkE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRtC,oBAAAA,QAAAA,EAAUX,OAAAA,CAAOW,QAAQ,CAACgD,IAAI,CAAC3D,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAM0D,oBAAoB5E,MAAAA,CAAO6E,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACzC,IAAI,CAACnB,IAAAA,CAAKuB,EAAE,EAAE;AAAEmC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY/D,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACFoB,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAK/E,QACHY,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,uBAClBiC,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYpE,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,oBAAA,CAAA;AAC9BuC,wBAAAA,SAAAA,EAAWrE,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,mBAAA,CAAA;wBAC7BwC,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNvD,OAAAA,CAAOyE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAM1E,OAAAA,CACH2E,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI5E,KAAK6E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAI,GACrC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAC,GAChDE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}
+{"version":3,"file":"user.js","sources":["../../../server/src/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require('@strapi/utils');\nconst { pick, get, toNumber } = require('lodash');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst pickAllowedQueryParams = (params) => pick(params, ALLOWED_QUERY_PARAM_KEYS);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).count(query);\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(get(attributes[key], 'encryption.rounds', 10));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","ALLOWED_QUERY_PARAM_KEYS","require$$3","pick","get","toNumber","require$$4","getService","require$$5","USER_MODEL_UID","pickAllowedQueryParams","params","getSessionManager","manager","strapi","sessionManager","user","count","query","transform","db","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","where","id","select","update","documentId","fetch","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,6BAAAA;AAEhB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,wBAAwB,EAAE,GAAGC,2BAAAA;AAC/C,IAAA,MAAM,EAAEC,IAAI,EAAEC,GAAG,EAAEC,QAAQ,EAAE,GAAGC,2BAAAA;IAChC,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,sBAAAA,GAAyB,CAACC,MAAAA,GAAWR,IAAAA,CAAKQ,MAAAA,EAAQV,wBAAAA,CAAAA;AAExD,IAAA,MAAMW,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMN,MAAM,EAAA;gBACV,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgBQ,KAAK,CAACC,KAAAA,CAAAA;AACjD,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMG,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaT,OAAAA,CAAOU,QAAQ,CAACf,gBAAgBc,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAAStB,QAAAA,CAASD,GAAAA,CAAImB,UAAU,CAACE,GAAAA,CAAI,EAAE,mBAAA,EAAqB,EAAA,CAAA,CAAA;wBAClEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM7B,MAAAA,CAAOgC,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOR,OAAAA,CAAOgB,SAAS,CAACrB,cAAAA,CAAAA,CAAgBsB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAExB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMyB,KAAAA,GAAQ,MAAMtB,OAAAA,CAAOM,EAAA,CACxBF,KAAK,CAACT,cAAAA,CAAAA,CACN4B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEC,EAAAA,EAAIJ;AAAM,qBAAA;oBAAIK,MAAAA,EAAQ;AAAC,wBAAA;AAAa;;AAE1D,gBAAA,IAAI,CAACJ,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOtB,OAAAA,CAAOgB,SAAS,CAACrB,cAAAA,CAAAA,CAAgBgC,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYN,MAAMM,UAAU;oBAC5BV,IAAAA,EAAMrB,MAAAA;oBACNsB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIEU,KAAAA,CAAAA,CAAMJ,EAAE,EAAE5B,MAAM,EAAA;gBACd,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB4B,OAAO,CAAC;AAC7C,oBAAA,GAAGnB,KAAK;oBACRoB,KAAAA,EAAO;wBACLM,IAAAA,EAAM;AAAC,4BAAA;AAAEL,gCAAAA;AAAE,6BAAA;4BAAIrB,KAAAA,CAAMoB,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACEO,wBAAuBN,EAAE,EAAA;AACvB,gBAAA,OAAOzB,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB4B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEC,wBAAAA;AAAE,qBAAA;oBAAIN,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEa,UAASnC,MAAM,EAAA;gBACb,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgBsC,QAAQ,CAAC7B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM8B,QAAOrC,MAAM,EAAA;;AAEjB,gBAAA,MAAMI,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAekC,SAAS,CAAC,mBAAA,CAAA,IAAwBtC,MAAAA,CAAO4B,EAAE,EAAE;AAChF,oBAAA,MAAMxB,eAAe,mBAAA,CAAA,CAAqBmC,sBAAsB,CAACC,MAAAA,CAAOxC,OAAO4B,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAOzB,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB2C,MAAM,CAAC;oBAAEd,KAAAA,EAAO3B;;AAC3D,YAAA,CAAA;YAEE0C,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE1B,IAAI,EAAA;gBAC7B,OAAOhC,MAAAA,CAAO2D,OAAO,CAACD,QAAAA,EAAU1B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM4B,uBAAsBxC,IAAI,EAAA;AAC9B,gBAAA,MAAMyC,wBAAwBlD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMmD,WAAAA,GAAc,MAAM5C,OAAAA,CAAO6C,KAAK,CAAC;oBAAEjC,IAAAA,EAAM,QAAA;oBAAUkC,IAAAA,EAAM;;gBAC/D,MAAMC,UAAAA,GAAa/C,OAAAA,CAAOU,QAAQ,CAACf,cAAAA,CAAAA;AAEnC,gBAAA,MAAMqD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBtD,GAAG,CAAC;oBAAEqB,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAClBsC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMnE,QAAAA,CAASoE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRrC,oBAAAA,QAAAA,EAAUV,OAAAA,CAAOU,QAAQ,CAAC+C,IAAI,CAACzD,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAMwD,oBAAoB9E,MAAAA,CAAO+E,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACxC,IAAI,CAAClB,IAAAA,CAAKuB,EAAE,EAAE;AAAEiC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY7D,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACF0D,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAKjF,QACHgB,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,uBAClBuE,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYlE,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,oBAAA,CAAA;AAC9B6E,wBAAAA,SAAAA,EAAWnE,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,mBAAA,CAAA;wBAC7B8E,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNrD,OAAAA,CAAOuE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAMxE,OAAAA,CACHyE,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI1E,KAAK2E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAA,GACjC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAA,GAC/CE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}

package/dist/server/services/user.mjs

@@ -1,8 +1,8 @@
 import require$$0$1 from 'crypto';
-import require$$1$1 from 'bcryptjs';
-import require$$2 from 'url-join';
+import require$$1$2 from 'bcryptjs';
+import require$$1$1 from 'url-join';
 import require$$1 from '@strapi/utils';
-import require$$0 from 'lodash/fp';
+import require$$0 from 'lodash';
 import { __require as requireUtils } from '../utils/index.mjs';
 
 var user;
@@ -15,12 +15,13 @@ function requireUser() {
 	 *
 	 * @description: A set of functions similar to controller's actions to avoid code duplication.
 	 */ const crypto = require$$0$1;
-    const bcrypt = require$$1$1;
-    const urlJoin = require$$2;
-    const { sanitize } = require$$1;
-    const { toNumber, getOr } = require$$0;
+    const bcrypt = require$$1$2;
+    const urlJoin = require$$1$1;
+    const { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require$$1;
+    const { pick, get, toNumber } = require$$0;
     const { getService } = requireUtils();
     const USER_MODEL_UID = 'plugin::users-permissions.user';
+    const pickAllowedQueryParams = (params)=>pick(params, ALLOWED_QUERY_PARAM_KEYS);
     const getSessionManager = ()=>{
         const manager = strapi.sessionManager;
         return manager ?? null;
@@ -31,9 +32,8 @@ function requireUser() {
 	   *
 	   * @return {Promise}
 	   */ count (params) {
-                return strapi1.db.query(USER_MODEL_UID).count({
-                    where: params
-                });
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
+                return strapi1.db.query(USER_MODEL_UID).count(query);
             },
             /**
 	   * Hashes password fields in the provided values object if they are present.
@@ -47,7 +47,7 @@ function requireUser() {
                 for(const key in values){
                     if (attributes[key] && attributes[key].type === 'password') {
                         // Check if a custom encryption.rounds has been set on the password attribute
-                        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));
+                        const rounds = toNumber(get(attributes[key], 'encryption.rounds', 10));
                         values[key] = await bcrypt.hash(values[key], rounds);
                     }
                 }
@@ -102,7 +102,7 @@ function requireUser() {
 	   * Promise to fetch a/an user.
 	   * @return {Promise}
 	   */ fetch (id, params) {
-                const query = strapi1.get('query-params').transform(USER_MODEL_UID, params ?? {});
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
                 return strapi1.db.query(USER_MODEL_UID).findOne({
                     ...query,
                     where: {
@@ -132,7 +132,7 @@ function requireUser() {
 	   * Promise to fetch all users.
 	   * @return {Promise}
 	   */ fetchAll (params) {
-                const query = strapi1.get('query-params').transform(USER_MODEL_UID, params ?? {});
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
                 return strapi1.db.query(USER_MODEL_UID).findMany(query);
             },
             /**

package/dist/server/services/user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"user.mjs","sources":["../../../server/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize } = require('@strapi/utils');\nconst { toNumber, getOr } = require('lodash/fp');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    return strapi.db.query(USER_MODEL_UID).count({ where: params });\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","require$$3","toNumber","getOr","require$$4","getService","require$$5","USER_MODEL_UID","getSessionManager","manager","strapi","sessionManager","user","count","params","db","query","where","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","id","select","update","documentId","fetch","get","transform","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,UAAAA;IAEhB,MAAM,EAAEC,QAAQ,EAAE,GAAGC,UAAAA;AACrB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,KAAK,EAAE,GAAGC,UAAAA;IAC5B,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMC,MAAM,EAAA;AACV,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgBM,KAAK,CAAC;oBAAEI,KAAAA,EAAOH;AAAM,iBAAA,CAAA;AAChE,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMI,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaV,OAAAA,CAAOW,QAAQ,CAACd,gBAAgBa,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAAStB,QAAAA,CAASC,KAAAA,CAAM,IAAI,mBAAA,EAAqBiB,UAAU,CAACE,GAAAA,CAAI,CAAA,CAAA;wBACtEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM1B,MAAAA,CAAO6B,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOT,OAAAA,CAAOiB,SAAS,CAACpB,cAAAA,CAAAA,CAAgBqB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAElB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMmB,KAAAA,GAAQ,MAAMvB,OAAAA,CAAOK,EAAE,CAC1BC,KAAK,CAACT,cAAAA,CAAAA,CACN2B,OAAO,CAAC;oBAAEjB,KAAAA,EAAO;wBAAEkB,EAAAA,EAAIH;AAAM,qBAAA;oBAAII,MAAAA,EAAQ;AAAC,wBAAA;AAAa;AAAA,iBAAA,CAAA;AAE1D,gBAAA,IAAI,CAACH,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOvB,OAAAA,CAAOiB,SAAS,CAACpB,cAAAA,CAAAA,CAAgB8B,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYL,MAAMK,UAAU;oBAC5BT,IAAAA,EAAMf,MAAAA;oBACNgB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIES,KAAAA,CAAAA,CAAMJ,EAAE,EAAErB,MAAM,EAAA;gBACd,MAAME,KAAAA,GAAQN,QAAO8B,GAAG,CAAC,gBAAgBC,SAAS,CAAClC,cAAAA,EAAgBO,MAAAA,IAAU,EAAA,CAAA;AAE7E,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2B,OAAO,CAAC;AAC7C,oBAAA,GAAGlB,KAAK;oBACRC,KAAAA,EAAO;wBACLyB,IAAAA,EAAM;AAAC,4BAAA;AAAEP,gCAAAA;AAAE,6BAAA;4BAAInB,KAAAA,CAAMC,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACE0B,wBAAuBR,EAAE,EAAA;AACvB,gBAAA,OAAOzB,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2B,OAAO,CAAC;oBAAEjB,KAAAA,EAAO;AAAEkB,wBAAAA;AAAE,qBAAA;oBAAIL,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEc,UAAS9B,MAAM,EAAA;gBACb,MAAME,KAAAA,GAAQN,QAAO8B,GAAG,CAAC,gBAAgBC,SAAS,CAAClC,cAAAA,EAAgBO,MAAAA,IAAU,EAAA,CAAA;AAE7E,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgBsC,QAAQ,CAAC7B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM8B,QAAOhC,MAAM,EAAA;;AAEjB,gBAAA,MAAMH,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAeoC,SAAS,CAAC,mBAAA,CAAA,IAAwBjC,MAAAA,CAAOqB,EAAE,EAAE;AAChF,oBAAA,MAAMxB,eAAe,mBAAA,CAAA,CAAqBqC,sBAAsB,CAACC,MAAAA,CAAOnC,OAAOqB,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAOzB,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2C,MAAM,CAAC;oBAAEjC,KAAAA,EAAOH;AAAM,iBAAA,CAAA;AACjE,YAAA,CAAA;YAEEqC,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE3B,IAAI,EAAA;gBAC7B,OAAO7B,MAAAA,CAAOyD,OAAO,CAACD,QAAAA,EAAU3B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM6B,uBAAsB1C,IAAI,EAAA;AAC9B,gBAAA,MAAM2C,wBAAwBlD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMmD,WAAAA,GAAc,MAAM9C,OAAAA,CAAO+C,KAAK,CAAC;oBAAElC,IAAAA,EAAM,QAAA;oBAAUmC,IAAAA,EAAM;AAAmB,iBAAA,CAAA;gBAClF,MAAMC,UAAAA,GAAajD,OAAAA,CAAOW,QAAQ,CAACd,cAAAA,CAAAA;AAEnC,gBAAA,MAAMqD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBhB,GAAG,CAAC;oBAAElB,GAAAA,EAAK;mBACXuC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMjE,QAAAA,CAASkE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRtC,oBAAAA,QAAAA,EAAUX,OAAAA,CAAOW,QAAQ,CAACgD,IAAI,CAAC3D,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAM0D,oBAAoB5E,MAAAA,CAAO6E,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACzC,IAAI,CAACnB,IAAAA,CAAKuB,EAAE,EAAE;AAAEmC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY/D,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACFoB,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAK/E,QACHY,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,uBAClBiC,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYpE,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,oBAAA,CAAA;AAC9BuC,wBAAAA,SAAAA,EAAWrE,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,mBAAA,CAAA;wBAC7BwC,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNvD,OAAAA,CAAOyE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAM1E,OAAAA,CACH2E,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI5E,KAAK6E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAI,GACrC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAC,GAChDE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}
+{"version":3,"file":"user.mjs","sources":["../../../server/src/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require('@strapi/utils');\nconst { pick, get, toNumber } = require('lodash');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst pickAllowedQueryParams = (params) => pick(params, ALLOWED_QUERY_PARAM_KEYS);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).count(query);\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(get(attributes[key], 'encryption.rounds', 10));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","ALLOWED_QUERY_PARAM_KEYS","require$$3","pick","get","toNumber","require$$4","getService","require$$5","USER_MODEL_UID","pickAllowedQueryParams","params","getSessionManager","manager","strapi","sessionManager","user","count","query","transform","db","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","where","id","select","update","documentId","fetch","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,YAAAA;AAEhB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,wBAAwB,EAAE,GAAGC,UAAAA;AAC/C,IAAA,MAAM,EAAEC,IAAI,EAAEC,GAAG,EAAEC,QAAQ,EAAE,GAAGC,UAAAA;IAChC,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,sBAAAA,GAAyB,CAACC,MAAAA,GAAWR,IAAAA,CAAKQ,MAAAA,EAAQV,wBAAAA,CAAAA;AAExD,IAAA,MAAMW,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMN,MAAM,EAAA;gBACV,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgBQ,KAAK,CAACC,KAAAA,CAAAA;AACjD,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMG,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaT,OAAAA,CAAOU,QAAQ,CAACf,gBAAgBc,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAAStB,QAAAA,CAASD,GAAAA,CAAImB,UAAU,CAACE,GAAAA,CAAI,EAAE,mBAAA,EAAqB,EAAA,CAAA,CAAA;wBAClEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM7B,MAAAA,CAAOgC,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOR,OAAAA,CAAOgB,SAAS,CAACrB,cAAAA,CAAAA,CAAgBsB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAExB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMyB,KAAAA,GAAQ,MAAMtB,OAAAA,CAAOM,EAAA,CACxBF,KAAK,CAACT,cAAAA,CAAAA,CACN4B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEC,EAAAA,EAAIJ;AAAM,qBAAA;oBAAIK,MAAAA,EAAQ;AAAC,wBAAA;AAAa;;AAE1D,gBAAA,IAAI,CAACJ,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOtB,OAAAA,CAAOgB,SAAS,CAACrB,cAAAA,CAAAA,CAAgBgC,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYN,MAAMM,UAAU;oBAC5BV,IAAAA,EAAMrB,MAAAA;oBACNsB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIEU,KAAAA,CAAAA,CAAMJ,EAAE,EAAE5B,MAAM,EAAA;gBACd,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB4B,OAAO,CAAC;AAC7C,oBAAA,GAAGnB,KAAK;oBACRoB,KAAAA,EAAO;wBACLM,IAAAA,EAAM;AAAC,4BAAA;AAAEL,gCAAAA;AAAE,6BAAA;4BAAIrB,KAAAA,CAAMoB,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACEO,wBAAuBN,EAAE,EAAA;AACvB,gBAAA,OAAOzB,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB4B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEC,wBAAAA;AAAE,qBAAA;oBAAIN,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEa,UAASnC,MAAM,EAAA;gBACb,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgBsC,QAAQ,CAAC7B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM8B,QAAOrC,MAAM,EAAA;;AAEjB,gBAAA,MAAMI,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAekC,SAAS,CAAC,mBAAA,CAAA,IAAwBtC,MAAAA,CAAO4B,EAAE,EAAE;AAChF,oBAAA,MAAMxB,eAAe,mBAAA,CAAA,CAAqBmC,sBAAsB,CAACC,MAAAA,CAAOxC,OAAO4B,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAOzB,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB2C,MAAM,CAAC;oBAAEd,KAAAA,EAAO3B;;AAC3D,YAAA,CAAA;YAEE0C,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE1B,IAAI,EAAA;gBAC7B,OAAOhC,MAAAA,CAAO2D,OAAO,CAACD,QAAAA,EAAU1B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM4B,uBAAsBxC,IAAI,EAAA;AAC9B,gBAAA,MAAMyC,wBAAwBlD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMmD,WAAAA,GAAc,MAAM5C,OAAAA,CAAO6C,KAAK,CAAC;oBAAEjC,IAAAA,EAAM,QAAA;oBAAUkC,IAAAA,EAAM;;gBAC/D,MAAMC,UAAAA,GAAa/C,OAAAA,CAAOU,QAAQ,CAACf,cAAAA,CAAAA;AAEnC,gBAAA,MAAMqD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBtD,GAAG,CAAC;oBAAEqB,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAClBsC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMnE,QAAAA,CAASoE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRrC,oBAAAA,QAAAA,EAAUV,OAAAA,CAAOU,QAAQ,CAAC+C,IAAI,CAACzD,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAMwD,oBAAoB9E,MAAAA,CAAO+E,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACxC,IAAI,CAAClB,IAAAA,CAAKuB,EAAE,EAAE;AAAEiC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY7D,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACF0D,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAKjF,QACHgB,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,uBAClBuE,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYlE,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,oBAAA,CAAA;AAC9B6E,wBAAAA,SAAAA,EAAWnE,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,mBAAA,CAAA;wBAC7B8E,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNrD,OAAAA,CAAOuE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAMxE,OAAAA,CACHyE,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI1E,KAAK2E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAA,GACjC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAA,GAC/CE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}

package/dist/server/services/users-permissions.js

@@ -1,16 +1,14 @@
 'use strict';
 
-var require$$0$1 = require('lodash');
-var require$$0 = require('lodash/fp');
-var require$$2 = require('url-join');
+var require$$0 = require('lodash');
+var require$$1$1 = require('url-join');
 var require$$1 = require('@strapi/utils');
 var index = require('../utils/index.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
-var require$$0__default$1 = /*#__PURE__*/_interopDefault(require$$0$1);
 var require$$0__default = /*#__PURE__*/_interopDefault(require$$0);
-var require$$2__default = /*#__PURE__*/_interopDefault(require$$2);
+var require$$1__default$1 = /*#__PURE__*/_interopDefault(require$$1$1);
 var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
 
 var usersPermissions;
@@ -18,9 +16,8 @@ var hasRequiredUsersPermissions;
 function requireUsersPermissions() {
     if (hasRequiredUsersPermissions) return usersPermissions;
     hasRequiredUsersPermissions = 1;
-    const _ = require$$0__default$1.default;
-    const { filter, map, pipe, prop } = require$$0__default.default;
-    const urlJoin = require$$2__default.default;
+    const _ = require$$0__default.default;
+    const urlJoin = require$$1__default$1.default;
     const { template: { createStrictInterpolationRegExp }, errors, objects, sanitizeRoutesMapForSerialization } = require$$1__default.default;
     const { getService } = index.__require();
     const DEFAULT_PERMISSIONS = [
@@ -94,7 +91,7 @@ function requireUsersPermissions() {
                     }
                     return action[Symbol.for('__type__')].includes('content-api');
                 };
-                _.forEach(strapi.apis, (api, apiName)=>{
+                for (const [apiName, api] of Object.entries(strapi.apis)){
                     const controllers = _.reduce(api.controllers, (acc, controller, controllerName)=>{
                         const contentApiActions = _.pickBy(controller, isContentApi);
                         if (_.isEmpty(contentApiActions)) {
@@ -113,8 +110,8 @@ function requireUsersPermissions() {
                             controllers
                         };
                     }
-                });
-                _.forEach(strapi.plugins, (plugin, pluginName)=>{
+                }
+                for (const [pluginName, plugin] of Object.entries(strapi.plugins)){
                     const controllers = _.reduce(plugin.controllers, (acc, controller, controllerName)=>{
                         const contentApiActions = _.pickBy(controller, isContentApi);
                         if (_.isEmpty(contentApiActions)) {
@@ -133,13 +130,13 @@ function requireUsersPermissions() {
                             controllers
                         };
                     }
-                });
+                }
                 // Return a deeply cloned version to avoid circular references
                 return _.cloneDeep(actionMap);
             },
             async getRoutes () {
                 const routesMap = {};
-                _.forEach(strapi.apis, (api, apiName)=>{
+                for (const [apiName, api] of Object.entries(strapi.apis)){
                     const routes = _.flatMap(api.routes, (route)=>{
                         if (_.has(route, 'routes')) {
                             return route.routes;
@@ -147,15 +144,15 @@ function requireUsersPermissions() {
                         return route;
                     }).filter((route)=>route.info.type === 'content-api');
                     if (routes.length === 0) {
-                        return;
+                        continue;
                     }
                     const apiPrefix = strapi.config.get('api.rest.prefix');
                     routesMap[`api::${apiName}`] = routes.map((route)=>({
                             ...route,
                             path: urlJoin(apiPrefix, route.path)
                         }));
-                });
-                _.forEach(strapi.plugins, (plugin, pluginName)=>{
+                }
+                for (const [pluginName, plugin] of Object.entries(strapi.plugins)){
                     const transformPrefix = transformRoutePrefixFor(pluginName);
                     const routes = _.flatMap(plugin.routes, (route)=>{
                         if (_.has(route, 'routes')) {
@@ -164,14 +161,14 @@ function requireUsersPermissions() {
                         return transformPrefix(route);
                     }).filter((route)=>route.info.type === 'content-api');
                     if (routes.length === 0) {
-                        return;
+                        continue;
                     }
                     const apiPrefix = strapi.config.get('api.rest.prefix');
                     routesMap[`plugin::${pluginName}`] = routes.map((route)=>({
                             ...route,
                             path: urlJoin(apiPrefix, route.path)
                         }));
-                });
+                }
                 return sanitizeRoutesMapForSerialization(routesMap);
             },
             async syncPermissions () {
@@ -207,7 +204,7 @@ function requireUsersPermissions() {
                 if (permissionsFoundInDB.length === 0) {
                     // create default permissions
                     for (const role of roles){
-                        const toCreate = pipe(filter(({ roleType })=>roleType === role.type || roleType === null), map(prop('action')))(DEFAULT_PERMISSIONS);
+                        const toCreate = DEFAULT_PERMISSIONS.filter(({ roleType })=>roleType === role.type || roleType === null).map(({ action })=>action);
                         await Promise.all(toCreate.map((action)=>{
                             return strapi.db.query('plugin::users-permissions.permission').create({
                                 data: {
@@ -259,7 +256,7 @@ function requireUsersPermissions() {
                         evaluate: false,
                         escape: false
                     })(data);
-                } catch (e) {
+                } catch  {
                     throw new errors.ApplicationError('Invalid email template');
                 }
             }

package/dist/server/services/users-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"users-permissions.js","sources":["../../../server/services/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst _ = require('lodash');\nconst { filter, map, pipe, prop } = require('lodash/fp');\nconst urlJoin = require('url-join');\nconst {\n  template: { createStrictInterpolationRegExp },\n  errors,\n  objects,\n  sanitizeRoutesMapForSerialization,\n} = require('@strapi/utils');\n\nconst { getService } = require('../utils');\n\nconst DEFAULT_PERMISSIONS = [\n  { action: 'plugin::users-permissions.auth.callback', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.connect', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.forgotPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.resetPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.register', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.emailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.sendEmailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.refresh', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.logout', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.getSessions', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.revokeSession', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.user.me', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.changePassword', roleType: 'authenticated' },\n];\n\nconst transformRoutePrefixFor = (pluginName) => (route) => {\n  const prefix = route.config && route.config.prefix;\n  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;\n\n  return {\n    ...route,\n    path,\n  };\n};\n\nmodule.exports = ({ strapi }) => ({\n  getActions({ defaultEnable = false } = {}) {\n    const actionMap = {};\n\n    const isContentApi = (action) => {\n      if (!_.has(action, Symbol.for('__type__'))) {\n        return false;\n      }\n\n      return action[Symbol.for('__type__')].includes('content-api');\n    };\n\n    _.forEach(strapi.apis, (api, apiName) => {\n      const controllers = _.reduce(\n        api.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`api::${apiName}`] = { controllers };\n      }\n    });\n\n    _.forEach(strapi.plugins, (plugin, pluginName) => {\n      const controllers = _.reduce(\n        plugin.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`plugin::${pluginName}`] = { controllers };\n      }\n    });\n\n    // Return a deeply cloned version to avoid circular references\n    return _.cloneDeep(actionMap);\n  },\n\n  async getRoutes() {\n    const routesMap = {};\n\n    _.forEach(strapi.apis, (api, apiName) => {\n      const routes = _.flatMap(api.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes;\n        }\n\n        return route;\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        return;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`api::${apiName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    });\n\n    _.forEach(strapi.plugins, (plugin, pluginName) => {\n      const transformPrefix = transformRoutePrefixFor(pluginName);\n\n      const routes = _.flatMap(plugin.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes.map(transformPrefix);\n        }\n\n        return transformPrefix(route);\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        return;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    });\n\n    return sanitizeRoutesMapForSerialization(routesMap);\n  },\n\n  async syncPermissions() {\n    const roles = await strapi.db.query('plugin::users-permissions.role').findMany();\n    const dbPermissions = await strapi.db.query('plugin::users-permissions.permission').findMany();\n\n    const permissionsFoundInDB = _.uniq(_.map(dbPermissions, 'action'));\n\n    const appActions = _.flatMap(strapi.apis, (api, apiName) => {\n      return _.flatMap(api.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `api::${apiName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const pluginsActions = _.flatMap(strapi.plugins, (plugin, pluginName) => {\n      return _.flatMap(plugin.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `plugin::${pluginName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const allActions = [...appActions, ...pluginsActions];\n\n    const toDelete = _.difference(permissionsFoundInDB, allActions);\n\n    await Promise.all(\n      toDelete.map((action) => {\n        return strapi.db\n          .query('plugin::users-permissions.permission')\n          .delete({ where: { action } });\n      })\n    );\n\n    if (permissionsFoundInDB.length === 0) {\n      // create default permissions\n      for (const role of roles) {\n        const toCreate = pipe(\n          filter(({ roleType }) => roleType === role.type || roleType === null),\n          map(prop('action'))\n        )(DEFAULT_PERMISSIONS);\n\n        await Promise.all(\n          toCreate.map((action) => {\n            return strapi.db.query('plugin::users-permissions.permission').create({\n              data: {\n                action,\n                role: role.id,\n              },\n            });\n          })\n        );\n      }\n    }\n  },\n\n  async initialize() {\n    const roleCount = await strapi.db.query('plugin::users-permissions.role').count();\n\n    if (roleCount === 0) {\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Authenticated',\n          description: 'Default role given to authenticated user.',\n          type: 'authenticated',\n        },\n      });\n\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Public',\n          description: 'Default role given to unauthenticated user.',\n          type: 'public',\n        },\n      });\n    }\n\n    return getService('users-permissions').syncPermissions();\n  },\n\n  async updateUserRole(user, role) {\n    return strapi.db\n      .query('plugin::users-permissions.user')\n      .update({ where: { id: user.id }, data: { role } });\n  },\n\n  template(layout, data) {\n    const allowedTemplateVariables = objects.keysDeep(data);\n\n    // Create a strict interpolation RegExp based on possible variable names\n    const interpolate = createStrictInterpolationRegExp(allowedTemplateVariables, 'g');\n\n    try {\n      return _.template(layout, { interpolate, evaluate: false, escape: false })(data);\n    } catch (e) {\n      throw new errors.ApplicationError('Invalid email template');\n    }\n  },\n});\n"],"names":["_","require$$0","filter","map","pipe","prop","require$$1","urlJoin","require$$2","template","createStrictInterpolationRegExp","errors","objects","sanitizeRoutesMapForSerialization","require$$3","getService","require$$4","DEFAULT_PERMISSIONS","action","roleType","transformRoutePrefixFor","pluginName","route","prefix","config","path","undefined","usersPermissions","strapi","getActions","defaultEnable","actionMap","isContentApi","has","Symbol","for","includes","forEach","apis","api","apiName","controllers","reduce","acc","controller","controllerName","contentApiActions","pickBy","isEmpty","mapValues","enabled","policy","plugins","plugin","cloneDeep","getRoutes","routesMap","routes","flatMap","info","type","length","apiPrefix","get","transformPrefix","syncPermissions","roles","db","query","findMany","dbPermissions","permissionsFoundInDB","uniq","appActions","keys","actionName","pluginsActions","allActions","toDelete","difference","Promise","all","delete","where","role","toCreate","create","data","id","initialize","roleCount","count","name","description","updateUserRole","user","update","layout","allowedTemplateVariables","keysDeep","interpolate","evaluate","escape","e","ApplicationError"],"mappings":";;;;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAMA,CAAAA,GAAIC,6BAAAA;IACV,MAAM,EAAEC,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGC,2BAAAA;AACpC,IAAA,MAAMC,OAAAA,GAAUC,2BAAAA;AAChB,IAAA,MAAM,EACJC,QAAAA,EAAU,EAAEC,+BAA+B,EAAE,EAC7CC,MAAM,EACNC,OAAO,EACPC,iCAAiC,EAClC,GAAGC,2BAAAA;IAEJ,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB;AAC1B,QAAA;YAAEC,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAQ,SAAA;AAC7E,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAQ,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,kDAAA;YAAoDC,QAAAA,EAAU;AAAQ,SAAA;AAChF,QAAA;YAAED,MAAAA,EAAQ,sDAAA;YAAwDC,QAAAA,EAAU;AAAQ,SAAA;AACpF,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,uCAAA;YAAyCC,QAAAA,EAAU;AAAe,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,4CAAA;YAA8CC,QAAAA,EAAU;AAAe,SAAA;AACjF,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAe,SAAA;AACnF,QAAA;YAAED,MAAAA,EAAQ,mCAAA;YAAqCC,QAAAA,EAAU;AAAe,SAAA;AACxE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAe;AACrF,KAAA;IAED,MAAMC,uBAAAA,GAA0B,CAACC,UAAAA,GAAe,CAACC,KAAAA,GAAAA;AAC/C,YAAA,MAAMC,SAASD,KAAAA,CAAME,MAAM,IAAIF,KAAAA,CAAME,MAAM,CAACD,MAAM;AAClD,YAAA,MAAME,IAAAA,GAAOF,MAAAA,KAAWG,SAAAA,GAAY,CAAA,EAAGH,SAASD,KAAAA,CAAMG,IAAI,CAAA,CAAE,GAAG,CAAC,CAAC,EAAEJ,UAAAA,CAAAA,EAAaC,KAAAA,CAAMG,IAAI,CAAA,CAAE;YAE5F,OAAO;AACL,gBAAA,GAAGH,KAAK;AACRG,gBAAAA;AACJ,aAAA;AACA,QAAA,CAAA;AAEAE,IAAAA,gBAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,IAAM;AAChCC,YAAAA,UAAAA,CAAAA,CAAW,EAAEC,aAAAA,GAAgB,KAAK,EAAE,GAAG,EAAE,EAAA;AACvC,gBAAA,MAAMC,YAAY,EAAA;AAElB,gBAAA,MAAMC,eAAe,CAACd,MAAAA,GAAAA;oBACpB,IAAI,CAAClB,EAAEiC,GAAG,CAACf,QAAQgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAA,EAAc;wBAC1C,OAAO,KAAA;AACf,oBAAA;oBAEM,OAAOjB,MAAM,CAACgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAY,CAACC,QAAQ,CAAC,aAAA,CAAA;AACrD,gBAAA,CAAA;AAEIpC,gBAAAA,CAAAA,CAAEqC,OAAO,CAACT,MAAAA,CAAOU,IAAI,EAAE,CAACC,GAAAA,EAAKC,OAAAA,GAAAA;oBAC3B,MAAMC,WAAAA,GAAczC,EAAE0C,MAAM,CAC1BH,IAAIE,WAAW,EACf,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB9C,CAAAA,CAAE+C,MAAM,CAACH,UAAAA,EAAYZ,YAAAA,CAAAA;wBAE/C,IAAIhC,CAAAA,CAAEgD,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAG7C,CAAAA,CAAEiD,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASpB,aAAAA;gCACTqB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAAC3C,CAAAA,CAAEgD,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BV,wBAAAA,SAAS,CAAC,CAAC,KAAK,EAAES,OAAAA,CAAAA,CAAS,CAAC,GAAG;AAAEC,4BAAAA;;AACzC,oBAAA;AACA,gBAAA,CAAA,CAAA;AAEIzC,gBAAAA,CAAAA,CAAEqC,OAAO,CAACT,MAAAA,CAAOwB,OAAO,EAAE,CAACC,MAAAA,EAAQhC,UAAAA,GAAAA;oBACjC,MAAMoB,WAAAA,GAAczC,EAAE0C,MAAM,CAC1BW,OAAOZ,WAAW,EAClB,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB9C,CAAAA,CAAE+C,MAAM,CAACH,UAAAA,EAAYZ,YAAAA,CAAAA;wBAE/C,IAAIhC,CAAAA,CAAEgD,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAG7C,CAAAA,CAAEiD,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASpB,aAAAA;gCACTqB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAAC3C,CAAAA,CAAEgD,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BV,wBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEV,UAAAA,CAAAA,CAAY,CAAC,GAAG;AAAEoB,4BAAAA;;AAC/C,oBAAA;AACA,gBAAA,CAAA,CAAA;;gBAGI,OAAOzC,CAAAA,CAAEsD,SAAS,CAACvB,SAAAA,CAAAA;AACvB,YAAA,CAAA;YAEE,MAAMwB,SAAAA,CAAAA,GAAAA;AACJ,gBAAA,MAAMC,YAAY,EAAA;AAElBxD,gBAAAA,CAAAA,CAAEqC,OAAO,CAACT,MAAAA,CAAOU,IAAI,EAAE,CAACC,GAAAA,EAAKC,OAAAA,GAAAA;AAC3B,oBAAA,MAAMiB,SAASzD,CAAAA,CAAE0D,OAAO,CAACnB,GAAAA,CAAIkB,MAAM,EAAE,CAACnC,KAAAA,GAAAA;AACpC,wBAAA,IAAItB,CAAAA,CAAEiC,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,MAAMmC,MAAM;AAC7B,wBAAA;wBAEQ,OAAOnC,KAAAA;oBACf,CAAA,CAAA,CAASpB,MAAM,CAAC,CAACoB,KAAAA,GAAUA,MAAMqC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIH,MAAAA,CAAOI,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYlC,MAAAA,CAAOJ,MAAM,CAACuC,GAAG,CAAC,iBAAA,CAAA;AACpCP,oBAAAA,SAAS,CAAC,CAAC,KAAK,EAAEhB,OAAAA,CAAAA,CAAS,CAAC,GAAGiB,MAAAA,CAAOtD,GAAG,CAAC,CAACmB,KAAAA,IAAW;AACpD,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQuD,SAAAA,EAAWxC,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;AAEIzB,gBAAAA,CAAAA,CAAEqC,OAAO,CAACT,MAAAA,CAAOwB,OAAO,EAAE,CAACC,MAAAA,EAAQhC,UAAAA,GAAAA;AACjC,oBAAA,MAAM2C,kBAAkB5C,uBAAAA,CAAwBC,UAAAA,CAAAA;AAEhD,oBAAA,MAAMoC,SAASzD,CAAAA,CAAE0D,OAAO,CAACL,MAAAA,CAAOI,MAAM,EAAE,CAACnC,KAAAA,GAAAA;AACvC,wBAAA,IAAItB,CAAAA,CAAEiC,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,KAAAA,CAAMmC,MAAM,CAACtD,GAAG,CAAC6D,eAAAA,CAAAA;AAClC,wBAAA;AAEQ,wBAAA,OAAOA,eAAAA,CAAgB1C,KAAAA,CAAAA;oBAC/B,CAAA,CAAA,CAASpB,MAAM,CAAC,CAACoB,KAAAA,GAAUA,MAAMqC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIH,MAAAA,CAAOI,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYlC,MAAAA,CAAOJ,MAAM,CAACuC,GAAG,CAAC,iBAAA,CAAA;AACpCP,oBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEnC,UAAAA,CAAAA,CAAY,CAAC,GAAGoC,MAAAA,CAAOtD,GAAG,CAAC,CAACmB,KAAAA,IAAW;AAC1D,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQuD,SAAAA,EAAWxC,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;AAEI,gBAAA,OAAOZ,iCAAAA,CAAkC2C,SAAAA,CAAAA;AAC7C,YAAA,CAAA;YAEE,MAAMS,eAAAA,CAAAA,GAAAA;gBACJ,MAAMC,KAAAA,GAAQ,MAAMtC,MAAAA,CAAOuC,EAAE,CAACC,KAAK,CAAC,kCAAkCC,QAAQ,EAAA;gBAC9E,MAAMC,aAAAA,GAAgB,MAAM1C,MAAAA,CAAOuC,EAAE,CAACC,KAAK,CAAC,wCAAwCC,QAAQ,EAAA;AAE5F,gBAAA,MAAME,uBAAuBvE,CAAAA,CAAEwE,IAAI,CAACxE,CAAAA,CAAEG,GAAG,CAACmE,aAAAA,EAAe,QAAA,CAAA,CAAA;gBAEzD,MAAMG,UAAAA,GAAazE,EAAE0D,OAAO,CAAC9B,OAAOU,IAAI,EAAE,CAACC,GAAAA,EAAKC,OAAAA,GAAAA;AAC9C,oBAAA,OAAOxC,EAAE0D,OAAO,CAACnB,IAAIE,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAC7C,wBAAA,OAAO7C,EAAE0E,IAAI,CAAC9B,UAAAA,CAAAA,CAAYzC,GAAG,CAAC,CAACwE,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,KAAK,EAAEnC,OAAAA,CAAQ,CAAC,EAAEK,cAAAA,CAAe,CAAC,EAAE8B,UAAAA,CAAAA,CAAY;AAClE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;gBAEI,MAAMC,cAAAA,GAAiB5E,EAAE0D,OAAO,CAAC9B,OAAOwB,OAAO,EAAE,CAACC,MAAAA,EAAQhC,UAAAA,GAAAA;AACxD,oBAAA,OAAOrB,EAAE0D,OAAO,CAACL,OAAOZ,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAChD,wBAAA,OAAO7C,EAAE0E,IAAI,CAAC9B,UAAAA,CAAAA,CAAYzC,GAAG,CAAC,CAACwE,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,QAAQ,EAAEtD,UAAAA,CAAW,CAAC,EAAEwB,cAAAA,CAAe,CAAC,EAAE8B,UAAAA,CAAAA,CAAY;AACxE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;AAEI,gBAAA,MAAME,UAAAA,GAAa;AAAIJ,oBAAAA,GAAAA,UAAAA;AAAeG,oBAAAA,GAAAA;AAAe,iBAAA;AAErD,gBAAA,MAAME,QAAAA,GAAW9E,CAAAA,CAAE+E,UAAU,CAACR,oBAAAA,EAAsBM,UAAAA,CAAAA;AAEpD,gBAAA,MAAMG,QAAQC,GAAG,CACfH,QAAAA,CAAS3E,GAAG,CAAC,CAACe,MAAAA,GAAAA;AACZ,oBAAA,OAAOU,OAAOuC,EAAE,CACbC,KAAK,CAAC,sCAAA,CAAA,CACNc,MAAM,CAAC;wBAAEC,KAAAA,EAAO;AAAEjE,4BAAAA;AAAM;AAAE,qBAAA,CAAA;AACrC,gBAAA,CAAA,CAAA,CAAA;gBAGI,IAAIqD,oBAAAA,CAAqBV,MAAM,KAAK,CAAA,EAAG;;oBAErC,KAAK,MAAMuB,QAAQlB,KAAAA,CAAO;AACxB,wBAAA,MAAMmB,WAAWjF,IAAAA,CACfF,MAAAA,CAAO,CAAC,EAAEiB,QAAQ,EAAE,GAAKA,QAAAA,KAAaiE,IAAAA,CAAKxB,IAAI,IAAIzC,QAAAA,KAAa,IAAA,CAAA,EAChEhB,GAAAA,CAAIE,KAAK,QAAA,CAAA,CAAA,CAAA,CACTY,mBAAAA,CAAAA;AAEF,wBAAA,MAAM+D,QAAQC,GAAG,CACfI,QAAAA,CAASlF,GAAG,CAAC,CAACe,MAAAA,GAAAA;AACZ,4BAAA,OAAOU,OAAOuC,EAAE,CAACC,KAAK,CAAC,sCAAA,CAAA,CAAwCkB,MAAM,CAAC;gCACpEC,IAAAA,EAAM;AACJrE,oCAAAA,MAAAA;AACAkE,oCAAAA,IAAAA,EAAMA,KAAKI;AAC3B;AACA,6BAAA,CAAA;AACA,wBAAA,CAAA,CAAA,CAAA;AAEA,oBAAA;AACA,gBAAA;AACA,YAAA,CAAA;YAEE,MAAMC,UAAAA,CAAAA,GAAAA;gBACJ,MAAMC,SAAAA,GAAY,MAAM9D,MAAAA,CAAOuC,EAAE,CAACC,KAAK,CAAC,kCAAkCuB,KAAK,EAAA;AAE/E,gBAAA,IAAID,cAAc,CAAA,EAAG;AACnB,oBAAA,MAAM9D,OAAOuC,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,eAAA;4BACNC,WAAAA,EAAa,2CAAA;4BACbjC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AAEM,oBAAA,MAAMhC,OAAOuC,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,QAAA;4BACNC,WAAAA,EAAa,6CAAA;4BACbjC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AACA,gBAAA;gBAEI,OAAO7C,UAAAA,CAAW,qBAAqBkD,eAAe,EAAA;AAC1D,YAAA,CAAA;YAEE,MAAM6B,cAAAA,CAAAA,CAAeC,IAAI,EAAEX,IAAI,EAAA;AAC7B,gBAAA,OAAOxD,OAAOuC,EAAE,CACbC,KAAK,CAAC,gCAAA,CAAA,CACN4B,MAAM,CAAC;oBAAEb,KAAAA,EAAO;AAAEK,wBAAAA,EAAAA,EAAIO,KAAKP;AAAE,qBAAA;oBAAID,IAAAA,EAAM;AAAEH,wBAAAA;AAAI;AAAE,iBAAA,CAAA;AACtD,YAAA,CAAA;YAEE3E,QAAAA,CAAAA,CAASwF,MAAM,EAAEV,IAAI,EAAA;gBACnB,MAAMW,wBAAAA,GAA2BtF,OAAAA,CAAQuF,QAAQ,CAACZ,IAAAA,CAAAA;;gBAGlD,MAAMa,WAAAA,GAAc1F,gCAAgCwF,wBAAAA,EAA0B,GAAA,CAAA;gBAE9E,IAAI;oBACF,OAAOlG,CAAAA,CAAES,QAAQ,CAACwF,MAAAA,EAAQ;AAAEG,wBAAAA,WAAAA;wBAAaC,QAAAA,EAAU,KAAA;wBAAOC,MAAAA,EAAQ;uBAASf,IAAAA,CAAAA;AACjF,gBAAA,CAAA,CAAM,OAAOgB,CAAAA,EAAG;oBACV,MAAM,IAAI5F,MAAAA,CAAO6F,gBAAgB,CAAC,wBAAA,CAAA;AACxC,gBAAA;AACA,YAAA;SACA,CAAA;;;;;;"}
+{"version":3,"file":"users-permissions.js","sources":["../../../server/src/services/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst _ = require('lodash');\nconst urlJoin = require('url-join');\nconst {\n  template: { createStrictInterpolationRegExp },\n  errors,\n  objects,\n  sanitizeRoutesMapForSerialization,\n} = require('@strapi/utils');\n\nconst { getService } = require('../utils');\n\nconst DEFAULT_PERMISSIONS = [\n  { action: 'plugin::users-permissions.auth.callback', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.connect', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.forgotPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.resetPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.register', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.emailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.sendEmailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.refresh', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.logout', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.getSessions', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.revokeSession', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.user.me', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.changePassword', roleType: 'authenticated' },\n];\n\nconst transformRoutePrefixFor = (pluginName) => (route) => {\n  const prefix = route.config && route.config.prefix;\n  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;\n\n  return {\n    ...route,\n    path,\n  };\n};\n\nmodule.exports = ({ strapi }) => ({\n  getActions({ defaultEnable = false } = {}) {\n    const actionMap = {};\n\n    const isContentApi = (action) => {\n      if (!_.has(action, Symbol.for('__type__'))) {\n        return false;\n      }\n\n      return action[Symbol.for('__type__')].includes('content-api');\n    };\n\n    for (const [apiName, api] of Object.entries(strapi.apis)) {\n      const controllers = _.reduce(\n        api.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`api::${apiName}`] = { controllers };\n      }\n    }\n\n    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {\n      const controllers = _.reduce(\n        plugin.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`plugin::${pluginName}`] = { controllers };\n      }\n    }\n\n    // Return a deeply cloned version to avoid circular references\n    return _.cloneDeep(actionMap);\n  },\n\n  async getRoutes() {\n    const routesMap = {};\n\n    for (const [apiName, api] of Object.entries(strapi.apis)) {\n      const routes = _.flatMap(api.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes;\n        }\n\n        return route;\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`api::${apiName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    }\n\n    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {\n      const transformPrefix = transformRoutePrefixFor(pluginName);\n\n      const routes = _.flatMap(plugin.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes.map(transformPrefix);\n        }\n\n        return transformPrefix(route);\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    }\n\n    return sanitizeRoutesMapForSerialization(routesMap);\n  },\n\n  async syncPermissions() {\n    const roles = await strapi.db.query('plugin::users-permissions.role').findMany();\n    const dbPermissions = await strapi.db.query('plugin::users-permissions.permission').findMany();\n\n    const permissionsFoundInDB = _.uniq(_.map(dbPermissions, 'action'));\n\n    const appActions = _.flatMap(strapi.apis, (api, apiName) => {\n      return _.flatMap(api.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `api::${apiName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const pluginsActions = _.flatMap(strapi.plugins, (plugin, pluginName) => {\n      return _.flatMap(plugin.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `plugin::${pluginName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const allActions = [...appActions, ...pluginsActions];\n\n    const toDelete = _.difference(permissionsFoundInDB, allActions);\n\n    await Promise.all(\n      toDelete.map((action) => {\n        return strapi.db\n          .query('plugin::users-permissions.permission')\n          .delete({ where: { action } });\n      })\n    );\n\n    if (permissionsFoundInDB.length === 0) {\n      // create default permissions\n      for (const role of roles) {\n        const toCreate = DEFAULT_PERMISSIONS.filter(\n          ({ roleType }) => roleType === role.type || roleType === null\n        ).map(({ action }) => action);\n\n        await Promise.all(\n          toCreate.map((action) => {\n            return strapi.db.query('plugin::users-permissions.permission').create({\n              data: {\n                action,\n                role: role.id,\n              },\n            });\n          })\n        );\n      }\n    }\n  },\n\n  async initialize() {\n    const roleCount = await strapi.db.query('plugin::users-permissions.role').count();\n\n    if (roleCount === 0) {\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Authenticated',\n          description: 'Default role given to authenticated user.',\n          type: 'authenticated',\n        },\n      });\n\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Public',\n          description: 'Default role given to unauthenticated user.',\n          type: 'public',\n        },\n      });\n    }\n\n    return getService('users-permissions').syncPermissions();\n  },\n\n  async updateUserRole(user, role) {\n    return strapi.db\n      .query('plugin::users-permissions.user')\n      .update({ where: { id: user.id }, data: { role } });\n  },\n\n  template(layout, data) {\n    const allowedTemplateVariables = objects.keysDeep(data);\n\n    // Create a strict interpolation RegExp based on possible variable names\n    const interpolate = createStrictInterpolationRegExp(allowedTemplateVariables, 'g');\n\n    try {\n      return _.template(layout, { interpolate, evaluate: false, escape: false })(data);\n    } catch {\n      throw new errors.ApplicationError('Invalid email template');\n    }\n  },\n});\n"],"names":["_","require$$0","urlJoin","require$$1","template","createStrictInterpolationRegExp","errors","objects","sanitizeRoutesMapForSerialization","require$$2","getService","require$$3","DEFAULT_PERMISSIONS","action","roleType","transformRoutePrefixFor","pluginName","route","prefix","config","path","undefined","usersPermissions","strapi","getActions","defaultEnable","actionMap","isContentApi","has","Symbol","for","includes","apiName","api","Object","entries","apis","controllers","reduce","acc","controller","controllerName","contentApiActions","pickBy","isEmpty","mapValues","enabled","policy","plugin","plugins","cloneDeep","getRoutes","routesMap","routes","flatMap","filter","info","type","length","apiPrefix","get","map","transformPrefix","syncPermissions","roles","db","query","findMany","dbPermissions","permissionsFoundInDB","uniq","appActions","keys","actionName","pluginsActions","allActions","toDelete","difference","Promise","all","delete","where","role","toCreate","create","data","id","initialize","roleCount","count","name","description","updateUserRole","user","update","layout","allowedTemplateVariables","keysDeep","interpolate","evaluate","escape","ApplicationError"],"mappings":";;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAMA,CAAAA,GAAIC,2BAAAA;AACV,IAAA,MAAMC,OAAAA,GAAUC,6BAAAA;AAChB,IAAA,MAAM,EACJC,QAAAA,EAAU,EAAEC,+BAA+B,EAAE,EAC7CC,MAAM,EACNC,OAAO,EACPC,iCAAiC,EAClC,GAAGC,2BAAAA;IAEJ,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB;AAC1B,QAAA;YAAEC,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAQ,SAAA;AAC7E,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAQ,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,kDAAA;YAAoDC,QAAAA,EAAU;AAAQ,SAAA;AAChF,QAAA;YAAED,MAAAA,EAAQ,sDAAA;YAAwDC,QAAAA,EAAU;AAAQ,SAAA;AACpF,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,uCAAA;YAAyCC,QAAAA,EAAU;AAAe,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,4CAAA;YAA8CC,QAAAA,EAAU;AAAe,SAAA;AACjF,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAe,SAAA;AACnF,QAAA;YAAED,MAAAA,EAAQ,mCAAA;YAAqCC,QAAAA,EAAU;AAAe,SAAA;AACxE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAe;AACrF,KAAA;IAED,MAAMC,uBAAAA,GAA0B,CAACC,UAAAA,GAAe,CAACC,KAAAA,GAAAA;AAC/C,YAAA,MAAMC,SAASD,KAAAA,CAAME,MAAM,IAAIF,KAAAA,CAAME,MAAM,CAACD,MAAM;AAClD,YAAA,MAAME,IAAAA,GAAOF,MAAAA,KAAWG,SAAAA,GAAY,CAAA,EAAGH,SAASD,KAAAA,CAAMG,IAAI,CAAA,CAAE,GAAG,CAAC,CAAC,EAAEJ,UAAAA,CAAAA,EAAaC,KAAAA,CAAMG,IAAI,CAAA,CAAE;YAE5F,OAAO;AACL,gBAAA,GAAGH,KAAK;AACRG,gBAAAA;AACJ,aAAA;AACA,QAAA,CAAA;AAEAE,IAAAA,gBAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,IAAM;AAChCC,YAAAA,UAAAA,CAAAA,CAAW,EAAEC,aAAAA,GAAgB,KAAK,EAAE,GAAG,EAAE,EAAA;AACvC,gBAAA,MAAMC,YAAY,EAAA;AAElB,gBAAA,MAAMC,eAAe,CAACd,MAAAA,GAAAA;oBACpB,IAAI,CAACb,EAAE4B,GAAG,CAACf,QAAQgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAA,EAAc;wBAC1C,OAAO,KAAA;AACf,oBAAA;oBAEM,OAAOjB,MAAM,CAACgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAY,CAACC,QAAQ,CAAC,aAAA,CAAA;AACrD,gBAAA,CAAA;gBAEI,KAAK,MAAM,CAACC,OAAAA,EAASC,GAAAA,CAAI,IAAIC,OAAOC,OAAO,CAACZ,MAAAA,CAAOa,IAAI,CAAA,CAAG;oBACxD,MAAMC,WAAAA,GAAcrC,EAAEsC,MAAM,CAC1BL,IAAII,WAAW,EACf,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB1C,CAAAA,CAAE2C,MAAM,CAACH,UAAAA,EAAYb,YAAAA,CAAAA;wBAE/C,IAAI3B,CAAAA,CAAE4C,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAGzC,CAAAA,CAAE6C,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASrB,aAAAA;gCACTsB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAACvC,CAAAA,CAAE4C,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BX,wBAAAA,SAAS,CAAC,CAAC,KAAK,EAAEM,OAAAA,CAAAA,CAAS,CAAC,GAAG;AAAEK,4BAAAA;AAAW,yBAAA;AACpD,oBAAA;AACA,gBAAA;gBAEI,KAAK,MAAM,CAACrB,UAAAA,EAAYgC,MAAAA,CAAO,IAAId,OAAOC,OAAO,CAACZ,MAAAA,CAAO0B,OAAO,CAAA,CAAG;oBACjE,MAAMZ,WAAAA,GAAcrC,EAAEsC,MAAM,CAC1BU,OAAOX,WAAW,EAClB,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB1C,CAAAA,CAAE2C,MAAM,CAACH,UAAAA,EAAYb,YAAAA,CAAAA;wBAE/C,IAAI3B,CAAAA,CAAE4C,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAGzC,CAAAA,CAAE6C,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASrB,aAAAA;gCACTsB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAACvC,CAAAA,CAAE4C,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BX,wBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEV,UAAAA,CAAAA,CAAY,CAAC,GAAG;AAAEqB,4BAAAA;AAAW,yBAAA;AAC1D,oBAAA;AACA,gBAAA;;gBAGI,OAAOrC,CAAAA,CAAEkD,SAAS,CAACxB,SAAAA,CAAAA;AACvB,YAAA,CAAA;YAEE,MAAMyB,SAAAA,CAAAA,GAAAA;AACJ,gBAAA,MAAMC,YAAY,EAAA;gBAElB,KAAK,MAAM,CAACpB,OAAAA,EAASC,GAAAA,CAAI,IAAIC,OAAOC,OAAO,CAACZ,MAAAA,CAAOa,IAAI,CAAA,CAAG;AACxD,oBAAA,MAAMiB,SAASrD,CAAAA,CAAEsD,OAAO,CAACrB,GAAAA,CAAIoB,MAAM,EAAE,CAACpC,KAAAA,GAAAA;AACpC,wBAAA,IAAIjB,CAAAA,CAAE4B,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,MAAMoC,MAAM;AAC7B,wBAAA;wBAEQ,OAAOpC,KAAAA;oBACf,CAAA,CAAA,CAASsC,MAAM,CAAC,CAACtC,KAAAA,GAAUA,MAAMuC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIJ,MAAAA,CAAOK,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYpC,MAAAA,CAAOJ,MAAM,CAACyC,GAAG,CAAC,iBAAA,CAAA;AACpCR,oBAAAA,SAAS,CAAC,CAAC,KAAK,EAAEpB,OAAAA,CAAAA,CAAS,CAAC,GAAGqB,MAAAA,CAAOQ,GAAG,CAAC,CAAC5C,KAAAA,IAAW;AACpD,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQyD,SAAAA,EAAW1C,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA;gBAEI,KAAK,MAAM,CAACJ,UAAAA,EAAYgC,MAAAA,CAAO,IAAId,OAAOC,OAAO,CAACZ,MAAAA,CAAO0B,OAAO,CAAA,CAAG;AACjE,oBAAA,MAAMa,kBAAkB/C,uBAAAA,CAAwBC,UAAAA,CAAAA;AAEhD,oBAAA,MAAMqC,SAASrD,CAAAA,CAAEsD,OAAO,CAACN,MAAAA,CAAOK,MAAM,EAAE,CAACpC,KAAAA,GAAAA;AACvC,wBAAA,IAAIjB,CAAAA,CAAE4B,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,KAAAA,CAAMoC,MAAM,CAACQ,GAAG,CAACC,eAAAA,CAAAA;AAClC,wBAAA;AAEQ,wBAAA,OAAOA,eAAAA,CAAgB7C,KAAAA,CAAAA;oBAC/B,CAAA,CAAA,CAASsC,MAAM,CAAC,CAACtC,KAAAA,GAAUA,MAAMuC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIJ,MAAAA,CAAOK,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYpC,MAAAA,CAAOJ,MAAM,CAACyC,GAAG,CAAC,iBAAA,CAAA;AACpCR,oBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEpC,UAAAA,CAAAA,CAAY,CAAC,GAAGqC,MAAAA,CAAOQ,GAAG,CAAC,CAAC5C,KAAAA,IAAW;AAC1D,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQyD,SAAAA,EAAW1C,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA;AAEI,gBAAA,OAAOZ,iCAAAA,CAAkC4C,SAAAA,CAAAA;AAC7C,YAAA,CAAA;YAEE,MAAMW,eAAAA,CAAAA,GAAAA;gBACJ,MAAMC,KAAAA,GAAQ,MAAMzC,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,kCAAkCC,QAAQ,EAAA;gBAC9E,MAAMC,aAAAA,GAAgB,MAAM7C,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,wCAAwCC,QAAQ,EAAA;AAE5F,gBAAA,MAAME,uBAAuBrE,CAAAA,CAAEsE,IAAI,CAACtE,CAAAA,CAAE6D,GAAG,CAACO,aAAAA,EAAe,QAAA,CAAA,CAAA;gBAEzD,MAAMG,UAAAA,GAAavE,EAAEsD,OAAO,CAAC/B,OAAOa,IAAI,EAAE,CAACH,GAAAA,EAAKD,OAAAA,GAAAA;AAC9C,oBAAA,OAAOhC,EAAEsD,OAAO,CAACrB,IAAII,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAC7C,wBAAA,OAAOzC,EAAEwE,IAAI,CAAChC,UAAAA,CAAAA,CAAYqB,GAAG,CAAC,CAACY,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,KAAK,EAAEzC,OAAAA,CAAQ,CAAC,EAAES,cAAAA,CAAe,CAAC,EAAEgC,UAAAA,CAAAA,CAAY;AAClE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;gBAEI,MAAMC,cAAAA,GAAiB1E,EAAEsD,OAAO,CAAC/B,OAAO0B,OAAO,EAAE,CAACD,MAAAA,EAAQhC,UAAAA,GAAAA;AACxD,oBAAA,OAAOhB,EAAEsD,OAAO,CAACN,OAAOX,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAChD,wBAAA,OAAOzC,EAAEwE,IAAI,CAAChC,UAAAA,CAAAA,CAAYqB,GAAG,CAAC,CAACY,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,QAAQ,EAAEzD,UAAAA,CAAW,CAAC,EAAEyB,cAAAA,CAAe,CAAC,EAAEgC,UAAAA,CAAAA,CAAY;AACxE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;AAEI,gBAAA,MAAME,UAAAA,GAAa;AAAIJ,oBAAAA,GAAAA,UAAAA;AAAeG,oBAAAA,GAAAA;AAAe,iBAAA;AAErD,gBAAA,MAAME,QAAAA,GAAW5E,CAAAA,CAAE6E,UAAU,CAACR,oBAAAA,EAAsBM,UAAAA,CAAAA;AAEpD,gBAAA,MAAMG,QAAQC,GAAG,CACfH,QAAAA,CAASf,GAAG,CAAC,CAAChD,MAAAA,GAAAA;AACZ,oBAAA,OAAOU,OAAO0C,EAAA,CACXC,KAAK,CAAC,sCAAA,CAAA,CACNc,MAAM,CAAC;wBAAEC,KAAAA,EAAO;AAAEpE,4BAAAA;AAAM;AAAE,qBAAA,CAAA;AACrC,gBAAA,CAAA,CAAA,CAAA;gBAGI,IAAIwD,oBAAAA,CAAqBX,MAAM,KAAK,CAAA,EAAG;;oBAErC,KAAK,MAAMwB,QAAQlB,KAAAA,CAAO;wBACxB,MAAMmB,QAAAA,GAAWvE,oBAAoB2C,MAAM,CACzC,CAAC,EAAEzC,QAAQ,EAAE,GAAKA,QAAAA,KAAaoE,KAAKzB,IAAI,IAAI3C,aAAa,IAAA,CAAA,CACzD+C,GAAG,CAAC,CAAC,EAAEhD,MAAM,EAAE,GAAKA,MAAAA,CAAAA;AAEtB,wBAAA,MAAMiE,QAAQC,GAAG,CACfI,QAAAA,CAAStB,GAAG,CAAC,CAAChD,MAAAA,GAAAA;AACZ,4BAAA,OAAOU,OAAO0C,EAAE,CAACC,KAAK,CAAC,sCAAA,CAAA,CAAwCkB,MAAM,CAAC;gCACpEC,IAAAA,EAAM;AACJxE,oCAAAA,MAAAA;AACAqE,oCAAAA,IAAAA,EAAMA,KAAKI;AAC3B;AACA,6BAAA,CAAA;AACA,wBAAA,CAAA,CAAA,CAAA;AAEA,oBAAA;AACA,gBAAA;AACA,YAAA,CAAA;YAEE,MAAMC,UAAAA,CAAAA,GAAAA;gBACJ,MAAMC,SAAAA,GAAY,MAAMjE,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,kCAAkCuB,KAAK,EAAA;AAE/E,gBAAA,IAAID,cAAc,CAAA,EAAG;AACnB,oBAAA,MAAMjE,OAAO0C,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,eAAA;4BACNC,WAAAA,EAAa,2CAAA;4BACblC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AAEM,oBAAA,MAAMlC,OAAO0C,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,QAAA;4BACNC,WAAAA,EAAa,6CAAA;4BACblC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AACA,gBAAA;gBAEI,OAAO/C,UAAAA,CAAW,qBAAqBqD,eAAe,EAAA;AAC1D,YAAA,CAAA;YAEE,MAAM6B,cAAAA,CAAAA,CAAeC,IAAI,EAAEX,IAAI,EAAA;AAC7B,gBAAA,OAAO3D,OAAO0C,EAAA,CACXC,KAAK,CAAC,gCAAA,CAAA,CACN4B,MAAM,CAAC;oBAAEb,KAAAA,EAAO;AAAEK,wBAAAA,EAAAA,EAAIO,KAAKP;AAAE,qBAAA;oBAAID,IAAAA,EAAM;AAAEH,wBAAAA;AAAI;;AACpD,YAAA,CAAA;YAEE9E,QAAAA,CAAAA,CAAS2F,MAAM,EAAEV,IAAI,EAAA;gBACnB,MAAMW,wBAAAA,GAA2BzF,OAAAA,CAAQ0F,QAAQ,CAACZ,IAAAA,CAAAA;;gBAGlD,MAAMa,WAAAA,GAAc7F,gCAAgC2F,wBAAAA,EAA0B,GAAA,CAAA;gBAE9E,IAAI;oBACF,OAAOhG,CAAAA,CAAEI,QAAQ,CAAC2F,MAAAA,EAAQ;AAAEG,wBAAAA,WAAAA;wBAAaC,QAAAA,EAAU,KAAA;wBAAOC,MAAAA,EAAQ;qBAAK,CAAA,CAAIf,IAAAA,CAAAA;AACjF,gBAAA,CAAA,CAAM,OAAM;oBACN,MAAM,IAAI/E,MAAAA,CAAO+F,gBAAgB,CAAC,wBAAA,CAAA;AACxC,gBAAA;AACA,YAAA;SACA,CAAA;;;;;;"}

package/dist/server/services/users-permissions.mjs

@@ -1,6 +1,5 @@
-import require$$0$1 from 'lodash';
-import require$$0 from 'lodash/fp';
-import require$$2 from 'url-join';
+import require$$0 from 'lodash';
+import require$$1$1 from 'url-join';
 import require$$1 from '@strapi/utils';
 import { __require as requireUtils } from '../utils/index.mjs';
 
@@ -9,9 +8,8 @@ var hasRequiredUsersPermissions;
 function requireUsersPermissions() {
     if (hasRequiredUsersPermissions) return usersPermissions;
     hasRequiredUsersPermissions = 1;
-    const _ = require$$0$1;
-    const { filter, map, pipe, prop } = require$$0;
-    const urlJoin = require$$2;
+    const _ = require$$0;
+    const urlJoin = require$$1$1;
     const { template: { createStrictInterpolationRegExp }, errors, objects, sanitizeRoutesMapForSerialization } = require$$1;
     const { getService } = requireUtils();
     const DEFAULT_PERMISSIONS = [
@@ -85,7 +83,7 @@ function requireUsersPermissions() {
                     }
                     return action[Symbol.for('__type__')].includes('content-api');
                 };
-                _.forEach(strapi.apis, (api, apiName)=>{
+                for (const [apiName, api] of Object.entries(strapi.apis)){
                     const controllers = _.reduce(api.controllers, (acc, controller, controllerName)=>{
                         const contentApiActions = _.pickBy(controller, isContentApi);
                         if (_.isEmpty(contentApiActions)) {
@@ -104,8 +102,8 @@ function requireUsersPermissions() {
                             controllers
                         };
                     }
-                });
-                _.forEach(strapi.plugins, (plugin, pluginName)=>{
+                }
+                for (const [pluginName, plugin] of Object.entries(strapi.plugins)){
                     const controllers = _.reduce(plugin.controllers, (acc, controller, controllerName)=>{
                         const contentApiActions = _.pickBy(controller, isContentApi);
                         if (_.isEmpty(contentApiActions)) {
@@ -124,13 +122,13 @@ function requireUsersPermissions() {
                             controllers
                         };
                     }
-                });
+                }
                 // Return a deeply cloned version to avoid circular references
                 return _.cloneDeep(actionMap);
             },
             async getRoutes () {
                 const routesMap = {};
-                _.forEach(strapi.apis, (api, apiName)=>{
+                for (const [apiName, api] of Object.entries(strapi.apis)){
                     const routes = _.flatMap(api.routes, (route)=>{
                         if (_.has(route, 'routes')) {
                             return route.routes;
@@ -138,15 +136,15 @@ function requireUsersPermissions() {
                         return route;
                     }).filter((route)=>route.info.type === 'content-api');
                     if (routes.length === 0) {
-                        return;
+                        continue;
                     }
                     const apiPrefix = strapi.config.get('api.rest.prefix');
                     routesMap[`api::${apiName}`] = routes.map((route)=>({
                             ...route,
                             path: urlJoin(apiPrefix, route.path)
                         }));
-                });
-                _.forEach(strapi.plugins, (plugin, pluginName)=>{
+                }
+                for (const [pluginName, plugin] of Object.entries(strapi.plugins)){
                     const transformPrefix = transformRoutePrefixFor(pluginName);
                     const routes = _.flatMap(plugin.routes, (route)=>{
                         if (_.has(route, 'routes')) {
@@ -155,14 +153,14 @@ function requireUsersPermissions() {
                         return transformPrefix(route);
                     }).filter((route)=>route.info.type === 'content-api');
                     if (routes.length === 0) {
-                        return;
+                        continue;
                     }
                     const apiPrefix = strapi.config.get('api.rest.prefix');
                     routesMap[`plugin::${pluginName}`] = routes.map((route)=>({
                             ...route,
                             path: urlJoin(apiPrefix, route.path)
                         }));
-                });
+                }
                 return sanitizeRoutesMapForSerialization(routesMap);
             },
             async syncPermissions () {
@@ -198,7 +196,7 @@ function requireUsersPermissions() {
                 if (permissionsFoundInDB.length === 0) {
                     // create default permissions
                     for (const role of roles){
-                        const toCreate = pipe(filter(({ roleType })=>roleType === role.type || roleType === null), map(prop('action')))(DEFAULT_PERMISSIONS);
+                        const toCreate = DEFAULT_PERMISSIONS.filter(({ roleType })=>roleType === role.type || roleType === null).map(({ action })=>action);
                         await Promise.all(toCreate.map((action)=>{
                             return strapi.db.query('plugin::users-permissions.permission').create({
                                 data: {
@@ -250,7 +248,7 @@ function requireUsersPermissions() {
                         evaluate: false,
                         escape: false
                     })(data);
-                } catch (e) {
+                } catch  {
                     throw new errors.ApplicationError('Invalid email template');
                 }
             }