@strapi/plugin-users-permissions 5.12.1 → 5.12.2

package/dist/server/controllers/auth.mjs

@@ -0,0 +1,427 @@
+import require$$0 from 'crypto';
+import require$$0$1 from 'lodash';
+import require$$0$2 from 'lodash/fp';
+import require$$1 from '@strapi/utils';
+import { __require as requireUtils } from '../utils/index.mjs';
+import { __require as requireAuth$1 } from './validation/auth.mjs';
+import require$$6 from 'grant';
+
+var auth;
+var hasRequiredAuth;
+function requireAuth() {
+    if (hasRequiredAuth) return auth;
+    hasRequiredAuth = 1;
+    /**
+	 * Auth.js controller
+	 *
+	 * @description: A set of functions called "actions" for managing `Auth`.
+	 */ /* eslint-disable no-useless-escape */ const crypto = require$$0;
+    const _ = require$$0$1;
+    const { concat, compact, isArray } = require$$0$2;
+    const utils = require$$1;
+    const { getService } = requireUtils();
+    const { validateCallbackBody, validateRegisterBody, validateSendEmailConfirmationBody, validateForgotPasswordBody, validateResetPasswordBody, validateEmailConfirmationBody, validateChangePasswordBody } = requireAuth$1();
+    const { ApplicationError, ValidationError, ForbiddenError } = utils.errors;
+    const sanitizeUser = (user, ctx)=>{
+        const { auth } = ctx.state;
+        const userSchema = strapi.getModel('plugin::users-permissions.user');
+        return strapi.contentAPI.sanitize.output(user, userSchema, {
+            auth
+        });
+    };
+    auth = ({ strapi: strapi1 })=>({
+            async callback (ctx) {
+                const provider = ctx.params.provider || 'local';
+                const params = ctx.request.body;
+                const store = strapi1.store({
+                    type: 'plugin',
+                    name: 'users-permissions'
+                });
+                const grantSettings = await store.get({
+                    key: 'grant'
+                });
+                const grantProvider = provider === 'local' ? 'email' : provider;
+                if (!_.get(grantSettings, [
+                    grantProvider,
+                    'enabled'
+                ])) {
+                    throw new ApplicationError('This provider is disabled');
+                }
+                if (provider === 'local') {
+                    await validateCallbackBody(params);
+                    const { identifier } = params;
+                    // Check if the user exists.
+                    const user = await strapi1.db.query('plugin::users-permissions.user').findOne({
+                        where: {
+                            provider,
+                            $or: [
+                                {
+                                    email: identifier.toLowerCase()
+                                },
+                                {
+                                    username: identifier
+                                }
+                            ]
+                        }
+                    });
+                    if (!user) {
+                        throw new ValidationError('Invalid identifier or password');
+                    }
+                    if (!user.password) {
+                        throw new ValidationError('Invalid identifier or password');
+                    }
+                    const validPassword = await getService('user').validatePassword(params.password, user.password);
+                    if (!validPassword) {
+                        throw new ValidationError('Invalid identifier or password');
+                    }
+                    const advancedSettings = await store.get({
+                        key: 'advanced'
+                    });
+                    const requiresConfirmation = _.get(advancedSettings, 'email_confirmation');
+                    if (requiresConfirmation && user.confirmed !== true) {
+                        throw new ApplicationError('Your account email is not confirmed');
+                    }
+                    if (user.blocked === true) {
+                        throw new ApplicationError('Your account has been blocked by an administrator');
+                    }
+                    return ctx.send({
+                        jwt: getService('jwt').issue({
+                            id: user.id
+                        }),
+                        user: await sanitizeUser(user, ctx)
+                    });
+                }
+                // Connect the user with the third-party provider.
+                try {
+                    const user = await getService('providers').connect(provider, ctx.query);
+                    if (user.blocked) {
+                        throw new ForbiddenError('Your account has been blocked by an administrator');
+                    }
+                    return ctx.send({
+                        jwt: getService('jwt').issue({
+                            id: user.id
+                        }),
+                        user: await sanitizeUser(user, ctx)
+                    });
+                } catch (error) {
+                    throw new ApplicationError(error.message);
+                }
+            },
+            async changePassword (ctx) {
+                if (!ctx.state.user) {
+                    throw new ApplicationError('You must be authenticated to reset your password');
+                }
+                const validations = strapi1.config.get('plugin::users-permissions.validationRules');
+                const { currentPassword, password } = await validateChangePasswordBody(ctx.request.body, validations);
+                const user = await strapi1.db.query('plugin::users-permissions.user').findOne({
+                    where: {
+                        id: ctx.state.user.id
+                    }
+                });
+                const validPassword = await getService('user').validatePassword(currentPassword, user.password);
+                if (!validPassword) {
+                    throw new ValidationError('The provided current password is invalid');
+                }
+                if (currentPassword === password) {
+                    throw new ValidationError('Your new password must be different than your current password');
+                }
+                await getService('user').edit(user.id, {
+                    password
+                });
+                ctx.send({
+                    jwt: getService('jwt').issue({
+                        id: user.id
+                    }),
+                    user: await sanitizeUser(user, ctx)
+                });
+            },
+            async resetPassword (ctx) {
+                const validations = strapi1.config.get('plugin::users-permissions.validationRules');
+                const { password, passwordConfirmation, code } = await validateResetPasswordBody(ctx.request.body, validations);
+                if (password !== passwordConfirmation) {
+                    throw new ValidationError('Passwords do not match');
+                }
+                const user = await strapi1.db.query('plugin::users-permissions.user').findOne({
+                    where: {
+                        resetPasswordToken: code
+                    }
+                });
+                if (!user) {
+                    throw new ValidationError('Incorrect code provided');
+                }
+                await getService('user').edit(user.id, {
+                    resetPasswordToken: null,
+                    password
+                });
+                // Update the user.
+                ctx.send({
+                    jwt: getService('jwt').issue({
+                        id: user.id
+                    }),
+                    user: await sanitizeUser(user, ctx)
+                });
+            },
+            async connect (ctx, next) {
+                const grant = require$$6.koa();
+                const providers = await strapi1.store({
+                    type: 'plugin',
+                    name: 'users-permissions',
+                    key: 'grant'
+                }).get();
+                const apiPrefix = strapi1.config.get('api.rest.prefix');
+                const grantConfig = {
+                    defaults: {
+                        prefix: `${apiPrefix}/connect`
+                    },
+                    ...providers
+                };
+                const [requestPath] = ctx.request.url.split('?');
+                const provider = requestPath.split('/connect/')[1].split('/')[0];
+                if (!_.get(grantConfig[provider], 'enabled')) {
+                    throw new ApplicationError('This provider is disabled');
+                }
+                if (!strapi1.config.server.url.startsWith('http')) {
+                    strapi1.log.warn('You are using a third party provider for login. Make sure to set an absolute url in config/server.js. More info here: https://docs.strapi.io/developer-docs/latest/plugins/users-permissions.html#setting-up-the-server-url');
+                }
+                // Ability to pass OAuth callback dynamically
+                const queryCustomCallback = _.get(ctx, 'query.callback');
+                const dynamicSessionCallback = _.get(ctx, 'session.grant.dynamic.callback');
+                const customCallback = queryCustomCallback ?? dynamicSessionCallback;
+                // The custom callback is validated to make sure it's not redirecting to an unwanted actor.
+                if (customCallback !== undefined) {
+                    try {
+                        // We're extracting the callback validator from the plugin config since it can be user-customized
+                        const { validate: validateCallback } = strapi1.plugin('users-permissions').config('callback');
+                        await validateCallback(customCallback, grantConfig[provider]);
+                        grantConfig[provider].callback = customCallback;
+                    } catch (e) {
+                        throw new ValidationError('Invalid callback URL provided', {
+                            callback: customCallback
+                        });
+                    }
+                }
+                // Build a valid redirect URI for the current provider
+                grantConfig[provider].redirect_uri = getService('providers').buildRedirectUri(provider);
+                return grant(grantConfig)(ctx, next);
+            },
+            async forgotPassword (ctx) {
+                const { email } = await validateForgotPasswordBody(ctx.request.body);
+                const pluginStore = await strapi1.store({
+                    type: 'plugin',
+                    name: 'users-permissions'
+                });
+                const emailSettings = await pluginStore.get({
+                    key: 'email'
+                });
+                const advancedSettings = await pluginStore.get({
+                    key: 'advanced'
+                });
+                // Find the user by email.
+                const user = await strapi1.db.query('plugin::users-permissions.user').findOne({
+                    where: {
+                        email: email.toLowerCase()
+                    }
+                });
+                if (!user || user.blocked) {
+                    return ctx.send({
+                        ok: true
+                    });
+                }
+                // Generate random token.
+                const userInfo = await sanitizeUser(user, ctx);
+                const resetPasswordToken = crypto.randomBytes(64).toString('hex');
+                const resetPasswordSettings = _.get(emailSettings, 'reset_password.options', {});
+                const emailBody = await getService('users-permissions').template(resetPasswordSettings.message, {
+                    URL: advancedSettings.email_reset_password,
+                    SERVER_URL: strapi1.config.get('server.absoluteUrl'),
+                    ADMIN_URL: strapi1.config.get('admin.absoluteUrl'),
+                    USER: userInfo,
+                    TOKEN: resetPasswordToken
+                });
+                const emailObject = await getService('users-permissions').template(resetPasswordSettings.object, {
+                    USER: userInfo
+                });
+                const emailToSend = {
+                    to: user.email,
+                    from: resetPasswordSettings.from.email || resetPasswordSettings.from.name ? `${resetPasswordSettings.from.name} <${resetPasswordSettings.from.email}>` : undefined,
+                    replyTo: resetPasswordSettings.response_email,
+                    subject: emailObject,
+                    text: emailBody,
+                    html: emailBody
+                };
+                // NOTE: Update the user before sending the email so an Admin can generate the link if the email fails
+                await getService('user').edit(user.id, {
+                    resetPasswordToken
+                });
+                // Send an email to the user.
+                await strapi1.plugin('email').service('email').send(emailToSend);
+                ctx.send({
+                    ok: true
+                });
+            },
+            async register (ctx) {
+                const pluginStore = await strapi1.store({
+                    type: 'plugin',
+                    name: 'users-permissions'
+                });
+                const settings = await pluginStore.get({
+                    key: 'advanced'
+                });
+                if (!settings.allow_register) {
+                    throw new ApplicationError('Register action is currently disabled');
+                }
+                const { register } = strapi1.config.get('plugin::users-permissions');
+                const alwaysAllowedKeys = [
+                    'username',
+                    'password',
+                    'email'
+                ];
+                // Note that we intentionally do not filter allowedFields to allow a project to explicitly accept private or other Strapi field on registration
+                const allowedKeys = compact(concat(alwaysAllowedKeys, isArray(register?.allowedFields) ? register.allowedFields : []));
+                // Check if there are any keys in requestBody that are not in allowedKeys
+                const invalidKeys = Object.keys(ctx.request.body).filter((key)=>!allowedKeys.includes(key));
+                if (invalidKeys.length > 0) {
+                    // If there are invalid keys, throw an error
+                    throw new ValidationError(`Invalid parameters: ${invalidKeys.join(', ')}`);
+                }
+                const params = {
+                    ..._.pick(ctx.request.body, allowedKeys),
+                    provider: 'local'
+                };
+                const validations = strapi1.config.get('plugin::users-permissions.validationRules');
+                await validateRegisterBody(params, validations);
+                const role = await strapi1.db.query('plugin::users-permissions.role').findOne({
+                    where: {
+                        type: settings.default_role
+                    }
+                });
+                if (!role) {
+                    throw new ApplicationError('Impossible to find the default role');
+                }
+                const { email, username, provider } = params;
+                const identifierFilter = {
+                    $or: [
+                        {
+                            email: email.toLowerCase()
+                        },
+                        {
+                            username: email.toLowerCase()
+                        },
+                        {
+                            username
+                        },
+                        {
+                            email: username
+                        }
+                    ]
+                };
+                const conflictingUserCount = await strapi1.db.query('plugin::users-permissions.user').count({
+                    where: {
+                        ...identifierFilter,
+                        provider
+                    }
+                });
+                if (conflictingUserCount > 0) {
+                    throw new ApplicationError('Email or Username are already taken');
+                }
+                if (settings.unique_email) {
+                    const conflictingUserCount = await strapi1.db.query('plugin::users-permissions.user').count({
+                        where: {
+                            ...identifierFilter
+                        }
+                    });
+                    if (conflictingUserCount > 0) {
+                        throw new ApplicationError('Email or Username are already taken');
+                    }
+                }
+                const newUser = {
+                    ...params,
+                    role: role.id,
+                    email: email.toLowerCase(),
+                    username,
+                    confirmed: !settings.email_confirmation
+                };
+                const user = await getService('user').add(newUser);
+                const sanitizedUser = await sanitizeUser(user, ctx);
+                if (settings.email_confirmation) {
+                    try {
+                        await getService('user').sendConfirmationEmail(sanitizedUser);
+                    } catch (err) {
+                        strapi1.log.error(err);
+                        throw new ApplicationError('Error sending confirmation email');
+                    }
+                    return ctx.send({
+                        user: sanitizedUser
+                    });
+                }
+                const jwt = getService('jwt').issue(_.pick(user, [
+                    'id'
+                ]));
+                return ctx.send({
+                    jwt,
+                    user: sanitizedUser
+                });
+            },
+            async emailConfirmation (ctx, next, returnUser) {
+                const { confirmation: confirmationToken } = await validateEmailConfirmationBody(ctx.query);
+                const userService = getService('user');
+                const jwtService = getService('jwt');
+                const [user] = await userService.fetchAll({
+                    filters: {
+                        confirmationToken
+                    }
+                });
+                if (!user) {
+                    throw new ValidationError('Invalid token');
+                }
+                await userService.edit(user.id, {
+                    confirmed: true,
+                    confirmationToken: null
+                });
+                if (returnUser) {
+                    ctx.send({
+                        jwt: jwtService.issue({
+                            id: user.id
+                        }),
+                        user: await sanitizeUser(user, ctx)
+                    });
+                } else {
+                    const settings = await strapi1.store({
+                        type: 'plugin',
+                        name: 'users-permissions',
+                        key: 'advanced'
+                    }).get();
+                    ctx.redirect(settings.email_confirmation_redirection || '/');
+                }
+            },
+            async sendEmailConfirmation (ctx) {
+                const { email } = await validateSendEmailConfirmationBody(ctx.request.body);
+                const user = await strapi1.db.query('plugin::users-permissions.user').findOne({
+                    where: {
+                        email: email.toLowerCase()
+                    }
+                });
+                if (!user) {
+                    return ctx.send({
+                        email,
+                        sent: true
+                    });
+                }
+                if (user.confirmed) {
+                    throw new ApplicationError('Already confirmed');
+                }
+                if (user.blocked) {
+                    throw new ApplicationError('User blocked');
+                }
+                await getService('user').sendConfirmationEmail(user);
+                ctx.send({
+                    email: user.email,
+                    sent: true
+                });
+            }
+        });
+    return auth;
+}
+
+export { requireAuth as __require };
+//# sourceMappingURL=auth.mjs.map

package/dist/server/controllers/auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.mjs","sources":["../../../server/controllers/auth.js"],"sourcesContent":["'use strict';\n\n/**\n * Auth.js controller\n *\n * @description: A set of functions called \"actions\" for managing `Auth`.\n */\n\n/* eslint-disable no-useless-escape */\nconst crypto = require('crypto');\nconst _ = require('lodash');\nconst { concat, compact, isArray } = require('lodash/fp');\nconst utils = require('@strapi/utils');\nconst { getService } = require('../utils');\nconst {\n  validateCallbackBody,\n  validateRegisterBody,\n  validateSendEmailConfirmationBody,\n  validateForgotPasswordBody,\n  validateResetPasswordBody,\n  validateEmailConfirmationBody,\n  validateChangePasswordBody,\n} = require('./validation/auth');\n\nconst { ApplicationError, ValidationError, ForbiddenError } = utils.errors;\n\nconst sanitizeUser = (user, ctx) => {\n  const { auth } = ctx.state;\n  const userSchema = strapi.getModel('plugin::users-permissions.user');\n\n  return strapi.contentAPI.sanitize.output(user, userSchema, { auth });\n};\n\nmodule.exports = ({ strapi }) => ({\n  async callback(ctx) {\n    const provider = ctx.params.provider || 'local';\n    const params = ctx.request.body;\n\n    const store = strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const grantSettings = await store.get({ key: 'grant' });\n\n    const grantProvider = provider === 'local' ? 'email' : provider;\n\n    if (!_.get(grantSettings, [grantProvider, 'enabled'])) {\n      throw new ApplicationError('This provider is disabled');\n    }\n\n    if (provider === 'local') {\n      await validateCallbackBody(params);\n\n      const { identifier } = params;\n\n      // Check if the user exists.\n      const user = await strapi.db.query('plugin::users-permissions.user').findOne({\n        where: {\n          provider,\n          $or: [{ email: identifier.toLowerCase() }, { username: identifier }],\n        },\n      });\n\n      if (!user) {\n        throw new ValidationError('Invalid identifier or password');\n      }\n\n      if (!user.password) {\n        throw new ValidationError('Invalid identifier or password');\n      }\n\n      const validPassword = await getService('user').validatePassword(\n        params.password,\n        user.password\n      );\n\n      if (!validPassword) {\n        throw new ValidationError('Invalid identifier or password');\n      }\n\n      const advancedSettings = await store.get({ key: 'advanced' });\n      const requiresConfirmation = _.get(advancedSettings, 'email_confirmation');\n\n      if (requiresConfirmation && user.confirmed !== true) {\n        throw new ApplicationError('Your account email is not confirmed');\n      }\n\n      if (user.blocked === true) {\n        throw new ApplicationError('Your account has been blocked by an administrator');\n      }\n\n      return ctx.send({\n        jwt: getService('jwt').issue({ id: user.id }),\n        user: await sanitizeUser(user, ctx),\n      });\n    }\n\n    // Connect the user with the third-party provider.\n    try {\n      const user = await getService('providers').connect(provider, ctx.query);\n\n      if (user.blocked) {\n        throw new ForbiddenError('Your account has been blocked by an administrator');\n      }\n\n      return ctx.send({\n        jwt: getService('jwt').issue({ id: user.id }),\n        user: await sanitizeUser(user, ctx),\n      });\n    } catch (error) {\n      throw new ApplicationError(error.message);\n    }\n  },\n\n  async changePassword(ctx) {\n    if (!ctx.state.user) {\n      throw new ApplicationError('You must be authenticated to reset your password');\n    }\n\n    const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n    const { currentPassword, password } = await validateChangePasswordBody(\n      ctx.request.body,\n      validations\n    );\n\n    const user = await strapi.db\n      .query('plugin::users-permissions.user')\n      .findOne({ where: { id: ctx.state.user.id } });\n\n    const validPassword = await getService('user').validatePassword(currentPassword, user.password);\n\n    if (!validPassword) {\n      throw new ValidationError('The provided current password is invalid');\n    }\n\n    if (currentPassword === password) {\n      throw new ValidationError('Your new password must be different than your current password');\n    }\n\n    await getService('user').edit(user.id, { password });\n\n    ctx.send({\n      jwt: getService('jwt').issue({ id: user.id }),\n      user: await sanitizeUser(user, ctx),\n    });\n  },\n\n  async resetPassword(ctx) {\n    const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n    const { password, passwordConfirmation, code } = await validateResetPasswordBody(\n      ctx.request.body,\n      validations\n    );\n\n    if (password !== passwordConfirmation) {\n      throw new ValidationError('Passwords do not match');\n    }\n\n    const user = await strapi.db\n      .query('plugin::users-permissions.user')\n      .findOne({ where: { resetPasswordToken: code } });\n\n    if (!user) {\n      throw new ValidationError('Incorrect code provided');\n    }\n\n    await getService('user').edit(user.id, {\n      resetPasswordToken: null,\n      password,\n    });\n\n    // Update the user.\n    ctx.send({\n      jwt: getService('jwt').issue({ id: user.id }),\n      user: await sanitizeUser(user, ctx),\n    });\n  },\n\n  async connect(ctx, next) {\n    const grant = require('grant').koa();\n\n    const providers = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n      .get();\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n    const grantConfig = {\n      defaults: {\n        prefix: `${apiPrefix}/connect`,\n      },\n      ...providers,\n    };\n\n    const [requestPath] = ctx.request.url.split('?');\n    const provider = requestPath.split('/connect/')[1].split('/')[0];\n\n    if (!_.get(grantConfig[provider], 'enabled')) {\n      throw new ApplicationError('This provider is disabled');\n    }\n\n    if (!strapi.config.server.url.startsWith('http')) {\n      strapi.log.warn(\n        'You are using a third party provider for login. Make sure to set an absolute url in config/server.js. More info here: https://docs.strapi.io/developer-docs/latest/plugins/users-permissions.html#setting-up-the-server-url'\n      );\n    }\n\n    // Ability to pass OAuth callback dynamically\n    const queryCustomCallback = _.get(ctx, 'query.callback');\n    const dynamicSessionCallback = _.get(ctx, 'session.grant.dynamic.callback');\n\n    const customCallback = queryCustomCallback ?? dynamicSessionCallback;\n\n    // The custom callback is validated to make sure it's not redirecting to an unwanted actor.\n    if (customCallback !== undefined) {\n      try {\n        // We're extracting the callback validator from the plugin config since it can be user-customized\n        const { validate: validateCallback } = strapi\n          .plugin('users-permissions')\n          .config('callback');\n\n        await validateCallback(customCallback, grantConfig[provider]);\n\n        grantConfig[provider].callback = customCallback;\n      } catch (e) {\n        throw new ValidationError('Invalid callback URL provided', { callback: customCallback });\n      }\n    }\n\n    // Build a valid redirect URI for the current provider\n    grantConfig[provider].redirect_uri = getService('providers').buildRedirectUri(provider);\n\n    return grant(grantConfig)(ctx, next);\n  },\n\n  async forgotPassword(ctx) {\n    const { email } = await validateForgotPasswordBody(ctx.request.body);\n\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n    const emailSettings = await pluginStore.get({ key: 'email' });\n    const advancedSettings = await pluginStore.get({ key: 'advanced' });\n\n    // Find the user by email.\n    const user = await strapi.db\n      .query('plugin::users-permissions.user')\n      .findOne({ where: { email: email.toLowerCase() } });\n\n    if (!user || user.blocked) {\n      return ctx.send({ ok: true });\n    }\n\n    // Generate random token.\n    const userInfo = await sanitizeUser(user, ctx);\n\n    const resetPasswordToken = crypto.randomBytes(64).toString('hex');\n\n    const resetPasswordSettings = _.get(emailSettings, 'reset_password.options', {});\n    const emailBody = await getService('users-permissions').template(\n      resetPasswordSettings.message,\n      {\n        URL: advancedSettings.email_reset_password,\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: userInfo,\n        TOKEN: resetPasswordToken,\n      }\n    );\n\n    const emailObject = await getService('users-permissions').template(\n      resetPasswordSettings.object,\n      {\n        USER: userInfo,\n      }\n    );\n\n    const emailToSend = {\n      to: user.email,\n      from:\n        resetPasswordSettings.from.email || resetPasswordSettings.from.name\n          ? `${resetPasswordSettings.from.name} <${resetPasswordSettings.from.email}>`\n          : undefined,\n      replyTo: resetPasswordSettings.response_email,\n      subject: emailObject,\n      text: emailBody,\n      html: emailBody,\n    };\n\n    // NOTE: Update the user before sending the email so an Admin can generate the link if the email fails\n    await getService('user').edit(user.id, { resetPasswordToken });\n\n    // Send an email to the user.\n    await strapi.plugin('email').service('email').send(emailToSend);\n\n    ctx.send({ ok: true });\n  },\n\n  async register(ctx) {\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n    const settings = await pluginStore.get({ key: 'advanced' });\n\n    if (!settings.allow_register) {\n      throw new ApplicationError('Register action is currently disabled');\n    }\n\n    const { register } = strapi.config.get('plugin::users-permissions');\n    const alwaysAllowedKeys = ['username', 'password', 'email'];\n\n    // Note that we intentionally do not filter allowedFields to allow a project to explicitly accept private or other Strapi field on registration\n    const allowedKeys = compact(\n      concat(alwaysAllowedKeys, isArray(register?.allowedFields) ? register.allowedFields : [])\n    );\n\n    // Check if there are any keys in requestBody that are not in allowedKeys\n    const invalidKeys = Object.keys(ctx.request.body).filter((key) => !allowedKeys.includes(key));\n\n    if (invalidKeys.length > 0) {\n      // If there are invalid keys, throw an error\n      throw new ValidationError(`Invalid parameters: ${invalidKeys.join(', ')}`);\n    }\n\n    const params = {\n      ..._.pick(ctx.request.body, allowedKeys),\n      provider: 'local',\n    };\n\n    const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n    await validateRegisterBody(params, validations);\n\n    const role = await strapi.db\n      .query('plugin::users-permissions.role')\n      .findOne({ where: { type: settings.default_role } });\n\n    if (!role) {\n      throw new ApplicationError('Impossible to find the default role');\n    }\n\n    const { email, username, provider } = params;\n\n    const identifierFilter = {\n      $or: [\n        { email: email.toLowerCase() },\n        { username: email.toLowerCase() },\n        { username },\n        { email: username },\n      ],\n    };\n\n    const conflictingUserCount = await strapi.db.query('plugin::users-permissions.user').count({\n      where: { ...identifierFilter, provider },\n    });\n\n    if (conflictingUserCount > 0) {\n      throw new ApplicationError('Email or Username are already taken');\n    }\n\n    if (settings.unique_email) {\n      const conflictingUserCount = await strapi.db.query('plugin::users-permissions.user').count({\n        where: { ...identifierFilter },\n      });\n\n      if (conflictingUserCount > 0) {\n        throw new ApplicationError('Email or Username are already taken');\n      }\n    }\n\n    const newUser = {\n      ...params,\n      role: role.id,\n      email: email.toLowerCase(),\n      username,\n      confirmed: !settings.email_confirmation,\n    };\n\n    const user = await getService('user').add(newUser);\n\n    const sanitizedUser = await sanitizeUser(user, ctx);\n\n    if (settings.email_confirmation) {\n      try {\n        await getService('user').sendConfirmationEmail(sanitizedUser);\n      } catch (err) {\n        strapi.log.error(err);\n        throw new ApplicationError('Error sending confirmation email');\n      }\n\n      return ctx.send({ user: sanitizedUser });\n    }\n\n    const jwt = getService('jwt').issue(_.pick(user, ['id']));\n\n    return ctx.send({\n      jwt,\n      user: sanitizedUser,\n    });\n  },\n\n  async emailConfirmation(ctx, next, returnUser) {\n    const { confirmation: confirmationToken } = await validateEmailConfirmationBody(ctx.query);\n\n    const userService = getService('user');\n    const jwtService = getService('jwt');\n\n    const [user] = await userService.fetchAll({ filters: { confirmationToken } });\n\n    if (!user) {\n      throw new ValidationError('Invalid token');\n    }\n\n    await userService.edit(user.id, { confirmed: true, confirmationToken: null });\n\n    if (returnUser) {\n      ctx.send({\n        jwt: jwtService.issue({ id: user.id }),\n        user: await sanitizeUser(user, ctx),\n      });\n    } else {\n      const settings = await strapi\n        .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })\n        .get();\n\n      ctx.redirect(settings.email_confirmation_redirection || '/');\n    }\n  },\n\n  async sendEmailConfirmation(ctx) {\n    const { email } = await validateSendEmailConfirmationBody(ctx.request.body);\n\n    const user = await strapi.db.query('plugin::users-permissions.user').findOne({\n      where: { email: email.toLowerCase() },\n    });\n\n    if (!user) {\n      return ctx.send({ email, sent: true });\n    }\n\n    if (user.confirmed) {\n      throw new ApplicationError('Already confirmed');\n    }\n\n    if (user.blocked) {\n      throw new ApplicationError('User blocked');\n    }\n\n    await getService('user').sendConfirmationEmail(user);\n\n    ctx.send({\n      email: user.email,\n      sent: true,\n    });\n  },\n});\n"],"names":["crypto","require$$0","_","require$$1","concat","compact","isArray","require$$2","utils","require$$3","getService","require$$4","validateCallbackBody","validateRegisterBody","validateSendEmailConfirmationBody","validateForgotPasswordBody","validateResetPasswordBody","validateEmailConfirmationBody","validateChangePasswordBody","require$$5","ApplicationError","ValidationError","ForbiddenError","errors","sanitizeUser","user","ctx","auth","state","userSchema","strapi","getModel","contentAPI","sanitize","output","callback","provider","params","request","body","store","type","name","grantSettings","get","key","grantProvider","identifier","db","query","findOne","where","$or","email","toLowerCase","username","password","validPassword","validatePassword","advancedSettings","requiresConfirmation","confirmed","blocked","send","jwt","issue","id","connect","error","message","changePassword","validations","config","currentPassword","edit","resetPassword","passwordConfirmation","code","resetPasswordToken","next","grant","require$$6","koa","providers","apiPrefix","grantConfig","defaults","prefix","requestPath","url","split","server","startsWith","log","warn","queryCustomCallback","dynamicSessionCallback","customCallback","undefined","validate","validateCallback","plugin","e","redirect_uri","buildRedirectUri","forgotPassword","pluginStore","emailSettings","ok","userInfo","randomBytes","toString","resetPasswordSettings","emailBody","template","URL","email_reset_password","SERVER_URL","ADMIN_URL","USER","TOKEN","emailObject","object","emailToSend","to","from","replyTo","response_email","subject","text","html","service","register","settings","allow_register","alwaysAllowedKeys","allowedKeys","allowedFields","invalidKeys","Object","keys","filter","includes","length","join","pick","role","default_role","identifierFilter","conflictingUserCount","count","unique_email","newUser","email_confirmation","add","sanitizedUser","sendConfirmationEmail","err","emailConfirmation","returnUser","confirmation","confirmationToken","userService","jwtService","fetchAll","filters","redirect","email_confirmation_redirection","sendEmailConfirmation","sent"],"mappings":";;;;;;;;;;;;;AAEA;;;;4CAOA,MAAMA,MAASC,GAAAA,UAAAA;AACf,IAAA,MAAMC,CAAIC,GAAAA,YAAAA;AACV,IAAA,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,OAAO,EAAE,GAAGC,YAAAA;AACrC,IAAA,MAAMC,KAAQC,GAAAA,UAAAA;IACd,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AACvB,IAAA,MAAM,EACJC,oBAAoB,EACpBC,oBAAoB,EACpBC,iCAAiC,EACjCC,0BAA0B,EAC1BC,yBAAyB,EACzBC,6BAA6B,EAC7BC,0BAA0B,EAC3B,GAAGC,aAAAA,EAAAA;IAEJ,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAEC,cAAc,EAAE,GAAGd,KAAAA,CAAMe,MAAM;IAE1E,MAAMC,YAAAA,GAAe,CAACC,IAAMC,EAAAA,GAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,IAAIE,KAAK;QAC1B,MAAMC,UAAAA,GAAaC,MAAOC,CAAAA,QAAQ,CAAC,gCAAA,CAAA;QAEnC,OAAOD,MAAAA,CAAOE,UAAU,CAACC,QAAQ,CAACC,MAAM,CAACT,MAAMI,UAAY,EAAA;AAAEF,YAAAA;AAAI,SAAA,CAAA;AACnE,KAAA;AAEAA,IAAAA,IAAAA,GAAiB,CAAC,EAAEG,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAChC,YAAA,MAAMK,UAAST,GAAG,EAAA;AAChB,gBAAA,MAAMU,QAAWV,GAAAA,GAAAA,CAAIW,MAAM,CAACD,QAAQ,IAAI,OAAA;AACxC,gBAAA,MAAMC,MAASX,GAAAA,GAAAA,CAAIY,OAAO,CAACC,IAAI;gBAE/B,MAAMC,KAAAA,GAAQV,OAAOU,CAAAA,KAAK,CAAC;oBAAEC,IAAM,EAAA,QAAA;oBAAUC,IAAM,EAAA;AAAmB,iBAAA,CAAA;AACtE,gBAAA,MAAMC,aAAgB,GAAA,MAAMH,KAAMI,CAAAA,GAAG,CAAC;oBAAEC,GAAK,EAAA;AAAO,iBAAA,CAAA;gBAEpD,MAAMC,aAAAA,GAAgBV,QAAa,KAAA,OAAA,GAAU,OAAUA,GAAAA,QAAAA;AAEvD,gBAAA,IAAI,CAAClC,CAAAA,CAAE0C,GAAG,CAACD,aAAe,EAAA;AAACG,oBAAAA,aAAAA;AAAe,oBAAA;iBAAU,CAAG,EAAA;AACrD,oBAAA,MAAM,IAAI1B,gBAAiB,CAAA,2BAAA,CAAA;AAC5B;AAED,gBAAA,IAAIgB,aAAa,OAAS,EAAA;AACxB,oBAAA,MAAMxB,oBAAqByB,CAAAA,MAAAA,CAAAA;oBAE3B,MAAM,EAAEU,UAAU,EAAE,GAAGV,MAAAA;;oBAGvB,MAAMZ,IAAAA,GAAO,MAAMK,OAAOkB,CAAAA,EAAE,CAACC,KAAK,CAAC,gCAAkCC,CAAAA,CAAAA,OAAO,CAAC;wBAC3EC,KAAO,EAAA;AACLf,4BAAAA,QAAAA;4BACAgB,GAAK,EAAA;AAAC,gCAAA;AAAEC,oCAAAA,KAAAA,EAAON,WAAWO,WAAW;;AAAM,gCAAA;oCAAEC,QAAUR,EAAAA;;AAAa;AACrE;AACT,qBAAA,CAAA;AAEM,oBAAA,IAAI,CAACtB,IAAM,EAAA;AACT,wBAAA,MAAM,IAAIJ,eAAgB,CAAA,gCAAA,CAAA;AAC3B;oBAED,IAAI,CAACI,IAAK+B,CAAAA,QAAQ,EAAE;AAClB,wBAAA,MAAM,IAAInC,eAAgB,CAAA,gCAAA,CAAA;AAC3B;oBAED,MAAMoC,aAAAA,GAAgB,MAAM/C,UAAAA,CAAW,MAAQgD,CAAAA,CAAAA,gBAAgB,CAC7DrB,MAAOmB,CAAAA,QAAQ,EACf/B,IAAAA,CAAK+B,QAAQ,CAAA;AAGf,oBAAA,IAAI,CAACC,aAAe,EAAA;AAClB,wBAAA,MAAM,IAAIpC,eAAgB,CAAA,gCAAA,CAAA;AAC3B;AAED,oBAAA,MAAMsC,gBAAmB,GAAA,MAAMnB,KAAMI,CAAAA,GAAG,CAAC;wBAAEC,GAAK,EAAA;AAAU,qBAAA,CAAA;AAC1D,oBAAA,MAAMe,oBAAuB1D,GAAAA,CAAAA,CAAE0C,GAAG,CAACe,gBAAkB,EAAA,oBAAA,CAAA;AAErD,oBAAA,IAAIC,oBAAwBnC,IAAAA,IAAAA,CAAKoC,SAAS,KAAK,IAAM,EAAA;AACnD,wBAAA,MAAM,IAAIzC,gBAAiB,CAAA,qCAAA,CAAA;AAC5B;oBAED,IAAIK,IAAAA,CAAKqC,OAAO,KAAK,IAAM,EAAA;AACzB,wBAAA,MAAM,IAAI1C,gBAAiB,CAAA,mDAAA,CAAA;AAC5B;oBAED,OAAOM,GAAAA,CAAIqC,IAAI,CAAC;wBACdC,GAAKtD,EAAAA,UAAAA,CAAW,KAAOuD,CAAAA,CAAAA,KAAK,CAAC;AAAEC,4BAAAA,EAAAA,EAAIzC,KAAKyC;;wBACxCzC,IAAM,EAAA,MAAMD,aAAaC,IAAMC,EAAAA,GAAAA;AACvC,qBAAA,CAAA;AACK;;gBAGD,IAAI;oBACF,MAAMD,IAAAA,GAAO,MAAMf,UAAW,CAAA,WAAA,CAAA,CAAayD,OAAO,CAAC/B,QAAAA,EAAUV,IAAIuB,KAAK,CAAA;oBAEtE,IAAIxB,IAAAA,CAAKqC,OAAO,EAAE;AAChB,wBAAA,MAAM,IAAIxC,cAAe,CAAA,mDAAA,CAAA;AAC1B;oBAED,OAAOI,GAAAA,CAAIqC,IAAI,CAAC;wBACdC,GAAKtD,EAAAA,UAAAA,CAAW,KAAOuD,CAAAA,CAAAA,KAAK,CAAC;AAAEC,4BAAAA,EAAAA,EAAIzC,KAAKyC;;wBACxCzC,IAAM,EAAA,MAAMD,aAAaC,IAAMC,EAAAA,GAAAA;AACvC,qBAAA,CAAA;AACK,iBAAA,CAAC,OAAO0C,KAAO,EAAA;oBACd,MAAM,IAAIhD,gBAAiBgD,CAAAA,KAAAA,CAAMC,OAAO,CAAA;AACzC;AACF,aAAA;AAED,YAAA,MAAMC,gBAAe5C,GAAG,EAAA;AACtB,gBAAA,IAAI,CAACA,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;AACnB,oBAAA,MAAM,IAAIL,gBAAiB,CAAA,kDAAA,CAAA;AAC5B;AAED,gBAAA,MAAMmD,WAAczC,GAAAA,OAAAA,CAAO0C,MAAM,CAAC5B,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAM,EAAE6B,eAAe,EAAEjB,QAAQ,EAAE,GAAG,MAAMtC,0BAAAA,CAC1CQ,GAAIY,CAAAA,OAAO,CAACC,IAAI,EAChBgC,WAAAA,CAAAA;gBAGF,MAAM9C,IAAAA,GAAO,MAAMK,OAAOkB,CAAAA,EAAE,CACzBC,KAAK,CAAC,gCACNC,CAAAA,CAAAA,OAAO,CAAC;oBAAEC,KAAO,EAAA;AAAEe,wBAAAA,EAAAA,EAAIxC,GAAIE,CAAAA,KAAK,CAACH,IAAI,CAACyC;AAAI;AAAA,iBAAA,CAAA;gBAE7C,MAAMT,aAAAA,GAAgB,MAAM/C,UAAW,CAAA,MAAA,CAAA,CAAQgD,gBAAgB,CAACe,eAAAA,EAAiBhD,KAAK+B,QAAQ,CAAA;AAE9F,gBAAA,IAAI,CAACC,aAAe,EAAA;AAClB,oBAAA,MAAM,IAAIpC,eAAgB,CAAA,0CAAA,CAAA;AAC3B;AAED,gBAAA,IAAIoD,oBAAoBjB,QAAU,EAAA;AAChC,oBAAA,MAAM,IAAInC,eAAgB,CAAA,gEAAA,CAAA;AAC3B;AAED,gBAAA,MAAMX,WAAW,MAAQgE,CAAAA,CAAAA,IAAI,CAACjD,IAAAA,CAAKyC,EAAE,EAAE;AAAEV,oBAAAA;AAAQ,iBAAA,CAAA;AAEjD9B,gBAAAA,GAAAA,CAAIqC,IAAI,CAAC;oBACPC,GAAKtD,EAAAA,UAAAA,CAAW,KAAOuD,CAAAA,CAAAA,KAAK,CAAC;AAAEC,wBAAAA,EAAAA,EAAIzC,KAAKyC;;oBACxCzC,IAAM,EAAA,MAAMD,aAAaC,IAAMC,EAAAA,GAAAA;AACrC,iBAAA,CAAA;AACG,aAAA;AAED,YAAA,MAAMiD,eAAcjD,GAAG,EAAA;AACrB,gBAAA,MAAM6C,WAAczC,GAAAA,OAAAA,CAAO0C,MAAM,CAAC5B,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAM,EAAEY,QAAQ,EAAEoB,oBAAoB,EAAEC,IAAI,EAAE,GAAG,MAAM7D,yBACrDU,CAAAA,GAAAA,CAAIY,OAAO,CAACC,IAAI,EAChBgC,WAAAA,CAAAA;AAGF,gBAAA,IAAIf,aAAaoB,oBAAsB,EAAA;AACrC,oBAAA,MAAM,IAAIvD,eAAgB,CAAA,wBAAA,CAAA;AAC3B;gBAED,MAAMI,IAAAA,GAAO,MAAMK,OAAOkB,CAAAA,EAAE,CACzBC,KAAK,CAAC,gCACNC,CAAAA,CAAAA,OAAO,CAAC;oBAAEC,KAAO,EAAA;wBAAE2B,kBAAoBD,EAAAA;AAAI;AAAI,iBAAA,CAAA;AAElD,gBAAA,IAAI,CAACpD,IAAM,EAAA;AACT,oBAAA,MAAM,IAAIJ,eAAgB,CAAA,yBAAA,CAAA;AAC3B;AAED,gBAAA,MAAMX,WAAW,MAAQgE,CAAAA,CAAAA,IAAI,CAACjD,IAAAA,CAAKyC,EAAE,EAAE;oBACrCY,kBAAoB,EAAA,IAAA;AACpBtB,oBAAAA;AACN,iBAAA,CAAA;;AAGI9B,gBAAAA,GAAAA,CAAIqC,IAAI,CAAC;oBACPC,GAAKtD,EAAAA,UAAAA,CAAW,KAAOuD,CAAAA,CAAAA,KAAK,CAAC;AAAEC,wBAAAA,EAAAA,EAAIzC,KAAKyC;;oBACxCzC,IAAM,EAAA,MAAMD,aAAaC,IAAMC,EAAAA,GAAAA;AACrC,iBAAA,CAAA;AACG,aAAA;YAED,MAAMyC,OAAAA,CAAAA,CAAQzC,GAAG,EAAEqD,IAAI,EAAA;gBACrB,MAAMC,KAAAA,GAAQC,WAAiBC,GAAG,EAAA;AAElC,gBAAA,MAAMC,SAAY,GAAA,MAAMrD,OACrBU,CAAAA,KAAK,CAAC;oBAAEC,IAAM,EAAA,QAAA;oBAAUC,IAAM,EAAA,mBAAA;oBAAqBG,GAAK,EAAA;mBACxDD,GAAG,EAAA;AAEN,gBAAA,MAAMwC,SAAYtD,GAAAA,OAAAA,CAAO0C,MAAM,CAAC5B,GAAG,CAAC,iBAAA,CAAA;AACpC,gBAAA,MAAMyC,WAAc,GAAA;oBAClBC,QAAU,EAAA;AACRC,wBAAAA,MAAAA,EAAQ,CAAC,EAAEH,SAAU,CAAA,QAAQ;AAC9B,qBAAA;AACD,oBAAA,GAAGD;AACT,iBAAA;gBAEI,MAAM,CAACK,YAAY,GAAG9D,GAAAA,CAAIY,OAAO,CAACmD,GAAG,CAACC,KAAK,CAAC,GAAA,CAAA;AAC5C,gBAAA,MAAMtD,QAAWoD,GAAAA,WAAAA,CAAYE,KAAK,CAAC,WAAY,CAAA,CAAC,CAAE,CAAA,CAACA,KAAK,CAAC,GAAI,CAAA,CAAC,CAAE,CAAA;gBAEhE,IAAI,CAACxF,EAAE0C,GAAG,CAACyC,WAAW,CAACjD,QAAAA,CAAS,EAAE,SAAY,CAAA,EAAA;AAC5C,oBAAA,MAAM,IAAIhB,gBAAiB,CAAA,2BAAA,CAAA;AAC5B;gBAED,IAAI,CAACU,OAAO0C,CAAAA,MAAM,CAACmB,MAAM,CAACF,GAAG,CAACG,UAAU,CAAC,MAAS,CAAA,EAAA;oBAChD9D,OAAO+D,CAAAA,GAAG,CAACC,IAAI,CACb,6NAAA,CAAA;AAEH;;AAGD,gBAAA,MAAMC,mBAAsB7F,GAAAA,CAAAA,CAAE0C,GAAG,CAAClB,GAAK,EAAA,gBAAA,CAAA;AACvC,gBAAA,MAAMsE,sBAAyB9F,GAAAA,CAAAA,CAAE0C,GAAG,CAAClB,GAAK,EAAA,gCAAA,CAAA;AAE1C,gBAAA,MAAMuE,iBAAiBF,mBAAuBC,IAAAA,sBAAAA;;AAG9C,gBAAA,IAAIC,mBAAmBC,SAAW,EAAA;oBAChC,IAAI;;wBAEF,MAAM,EAAEC,QAAUC,EAAAA,gBAAgB,EAAE,GAAGtE,QACpCuE,MAAM,CAAC,mBACP7B,CAAAA,CAAAA,MAAM,CAAC,UAAA,CAAA;AAEV,wBAAA,MAAM4B,gBAAiBH,CAAAA,cAAAA,EAAgBZ,WAAW,CAACjD,QAAS,CAAA,CAAA;AAE5DiD,wBAAAA,WAAW,CAACjD,QAAAA,CAAS,CAACD,QAAQ,GAAG8D,cAAAA;AAClC,qBAAA,CAAC,OAAOK,CAAG,EAAA;wBACV,MAAM,IAAIjF,gBAAgB,+BAAiC,EAAA;4BAAEc,QAAU8D,EAAAA;AAAgB,yBAAA,CAAA;AACxF;AACF;;gBAGDZ,WAAW,CAACjD,SAAS,CAACmE,YAAY,GAAG7F,UAAW,CAAA,WAAA,CAAA,CAAa8F,gBAAgB,CAACpE,QAAAA,CAAAA;gBAE9E,OAAO4C,KAAAA,CAAMK,aAAa3D,GAAKqD,EAAAA,IAAAA,CAAAA;AAChC,aAAA;AAED,YAAA,MAAM0B,gBAAe/E,GAAG,EAAA;gBACtB,MAAM,EAAE2B,KAAK,EAAE,GAAG,MAAMtC,0BAA2BW,CAAAA,GAAAA,CAAIY,OAAO,CAACC,IAAI,CAAA;AAEnE,gBAAA,MAAMmE,WAAc,GAAA,MAAM5E,OAAOU,CAAAA,KAAK,CAAC;oBAAEC,IAAM,EAAA,QAAA;oBAAUC,IAAM,EAAA;AAAmB,iBAAA,CAAA;AAElF,gBAAA,MAAMiE,aAAgB,GAAA,MAAMD,WAAY9D,CAAAA,GAAG,CAAC;oBAAEC,GAAK,EAAA;AAAO,iBAAA,CAAA;AAC1D,gBAAA,MAAMc,gBAAmB,GAAA,MAAM+C,WAAY9D,CAAAA,GAAG,CAAC;oBAAEC,GAAK,EAAA;AAAU,iBAAA,CAAA;;gBAGhE,MAAMpB,IAAAA,GAAO,MAAMK,OAAOkB,CAAAA,EAAE,CACzBC,KAAK,CAAC,gCACNC,CAAAA,CAAAA,OAAO,CAAC;oBAAEC,KAAO,EAAA;AAAEE,wBAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAI;AAAA,iBAAA,CAAA;AAElD,gBAAA,IAAI,CAAC7B,IAAAA,IAAQA,IAAKqC,CAAAA,OAAO,EAAE;oBACzB,OAAOpC,GAAAA,CAAIqC,IAAI,CAAC;wBAAE6C,EAAI,EAAA;AAAM,qBAAA,CAAA;AAC7B;;gBAGD,MAAMC,QAAAA,GAAW,MAAMrF,YAAAA,CAAaC,IAAMC,EAAAA,GAAAA,CAAAA;AAE1C,gBAAA,MAAMoD,qBAAqB9E,MAAO8G,CAAAA,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE3D,gBAAA,MAAMC,wBAAwB9G,CAAE0C,CAAAA,GAAG,CAAC+D,aAAAA,EAAe,0BAA0B,EAAA,CAAA;gBAC7E,MAAMM,SAAAA,GAAY,MAAMvG,UAAW,CAAA,mBAAA,CAAA,CAAqBwG,QAAQ,CAC9DF,qBAAAA,CAAsB3C,OAAO,EAC7B;AACE8C,oBAAAA,GAAAA,EAAKxD,iBAAiByD,oBAAoB;AAC1CC,oBAAAA,UAAAA,EAAYvF,OAAO0C,CAAAA,MAAM,CAAC5B,GAAG,CAAC,oBAAA,CAAA;AAC9B0E,oBAAAA,SAAAA,EAAWxF,OAAO0C,CAAAA,MAAM,CAAC5B,GAAG,CAAC,mBAAA,CAAA;oBAC7B2E,IAAMV,EAAAA,QAAAA;oBACNW,KAAO1C,EAAAA;AACR,iBAAA,CAAA;gBAGH,MAAM2C,WAAAA,GAAc,MAAM/G,UAAW,CAAA,mBAAA,CAAA,CAAqBwG,QAAQ,CAChEF,qBAAAA,CAAsBU,MAAM,EAC5B;oBACEH,IAAMV,EAAAA;AACP,iBAAA,CAAA;AAGH,gBAAA,MAAMc,WAAc,GAAA;AAClBC,oBAAAA,EAAAA,EAAInG,KAAK4B,KAAK;oBACdwE,IACEb,EAAAA,qBAAAA,CAAsBa,IAAI,CAACxE,KAAK,IAAI2D,qBAAsBa,CAAAA,IAAI,CAACnF,IAAI,GAC/D,CAAC,EAAEsE,qBAAAA,CAAsBa,IAAI,CAACnF,IAAI,CAAC,EAAE,EAAEsE,qBAAAA,CAAsBa,IAAI,CAACxE,KAAK,CAAC,CAAC,CAAC,GAC1E6C,SAAAA;AACN4B,oBAAAA,OAAAA,EAASd,sBAAsBe,cAAc;oBAC7CC,OAASP,EAAAA,WAAAA;oBACTQ,IAAMhB,EAAAA,SAAAA;oBACNiB,IAAMjB,EAAAA;AACZ,iBAAA;;AAGI,gBAAA,MAAMvG,WAAW,MAAQgE,CAAAA,CAAAA,IAAI,CAACjD,IAAAA,CAAKyC,EAAE,EAAE;AAAEY,oBAAAA;AAAkB,iBAAA,CAAA;;gBAG3D,MAAMhD,OAAAA,CAAOuE,MAAM,CAAC,OAAA,CAAA,CAAS8B,OAAO,CAAC,OAAA,CAAA,CAASpE,IAAI,CAAC4D,WAAAA,CAAAA;AAEnDjG,gBAAAA,GAAAA,CAAIqC,IAAI,CAAC;oBAAE6C,EAAI,EAAA;AAAM,iBAAA,CAAA;AACtB,aAAA;AAED,YAAA,MAAMwB,UAAS1G,GAAG,EAAA;AAChB,gBAAA,MAAMgF,WAAc,GAAA,MAAM5E,OAAOU,CAAAA,KAAK,CAAC;oBAAEC,IAAM,EAAA,QAAA;oBAAUC,IAAM,EAAA;AAAmB,iBAAA,CAAA;AAElF,gBAAA,MAAM2F,QAAW,GAAA,MAAM3B,WAAY9D,CAAAA,GAAG,CAAC;oBAAEC,GAAK,EAAA;AAAU,iBAAA,CAAA;gBAExD,IAAI,CAACwF,QAASC,CAAAA,cAAc,EAAE;AAC5B,oBAAA,MAAM,IAAIlH,gBAAiB,CAAA,uCAAA,CAAA;AAC5B;gBAED,MAAM,EAAEgH,QAAQ,EAAE,GAAGtG,QAAO0C,MAAM,CAAC5B,GAAG,CAAC,2BAAA,CAAA;AACvC,gBAAA,MAAM2F,iBAAoB,GAAA;AAAC,oBAAA,UAAA;AAAY,oBAAA,UAAA;AAAY,oBAAA;AAAQ,iBAAA;;gBAG3D,MAAMC,WAAAA,GAAcnI,OAClBD,CAAAA,MAAAA,CAAOmI,iBAAmBjI,EAAAA,OAAAA,CAAQ8H,UAAUK,aAAiBL,CAAAA,GAAAA,QAAAA,CAASK,aAAa,GAAG,EAAE,CAAA,CAAA;;AAI1F,gBAAA,MAAMC,cAAcC,MAAOC,CAAAA,IAAI,CAAClH,GAAAA,CAAIY,OAAO,CAACC,IAAI,CAAEsG,CAAAA,MAAM,CAAC,CAAChG,GAAAA,GAAQ,CAAC2F,WAAAA,CAAYM,QAAQ,CAACjG,GAAAA,CAAAA,CAAAA;gBAExF,IAAI6F,WAAAA,CAAYK,MAAM,GAAG,CAAG,EAAA;;oBAE1B,MAAM,IAAI1H,gBAAgB,CAAC,oBAAoB,EAAEqH,WAAYM,CAAAA,IAAI,CAAC,IAAA,CAAA,CAAM,CAAC,CAAA;AAC1E;AAED,gBAAA,MAAM3G,MAAS,GAAA;oBACb,GAAGnC,CAAAA,CAAE+I,IAAI,CAACvH,GAAAA,CAAIY,OAAO,CAACC,IAAI,EAAEiG,WAAY,CAAA;oBACxCpG,QAAU,EAAA;AAChB,iBAAA;AAEI,gBAAA,MAAMmC,WAAczC,GAAAA,OAAAA,CAAO0C,MAAM,CAAC5B,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAM/B,qBAAqBwB,MAAQkC,EAAAA,WAAAA,CAAAA;gBAEnC,MAAM2E,IAAAA,GAAO,MAAMpH,OAAOkB,CAAAA,EAAE,CACzBC,KAAK,CAAC,gCACNC,CAAAA,CAAAA,OAAO,CAAC;oBAAEC,KAAO,EAAA;AAAEV,wBAAAA,IAAAA,EAAM4F,SAASc;AAAc;AAAA,iBAAA,CAAA;AAEnD,gBAAA,IAAI,CAACD,IAAM,EAAA;AACT,oBAAA,MAAM,IAAI9H,gBAAiB,CAAA,qCAAA,CAAA;AAC5B;AAED,gBAAA,MAAM,EAAEiC,KAAK,EAAEE,QAAQ,EAAEnB,QAAQ,EAAE,GAAGC,MAAAA;AAEtC,gBAAA,MAAM+G,gBAAmB,GAAA;oBACvBhG,GAAK,EAAA;AACH,wBAAA;AAAEC,4BAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAI,yBAAA;AAC9B,wBAAA;AAAEC,4BAAAA,QAAAA,EAAUF,MAAMC,WAAW;AAAI,yBAAA;AACjC,wBAAA;AAAEC,4BAAAA;AAAU,yBAAA;AACZ,wBAAA;4BAAEF,KAAOE,EAAAA;AAAU;AACpB;AACP,iBAAA;gBAEI,MAAM8F,oBAAAA,GAAuB,MAAMvH,OAAOkB,CAAAA,EAAE,CAACC,KAAK,CAAC,gCAAkCqG,CAAAA,CAAAA,KAAK,CAAC;oBACzFnG,KAAO,EAAA;AAAE,wBAAA,GAAGiG,gBAAgB;AAAEhH,wBAAAA;AAAU;AAC9C,iBAAA,CAAA;AAEI,gBAAA,IAAIiH,uBAAuB,CAAG,EAAA;AAC5B,oBAAA,MAAM,IAAIjI,gBAAiB,CAAA,qCAAA,CAAA;AAC5B;gBAED,IAAIiH,QAAAA,CAASkB,YAAY,EAAE;oBACzB,MAAMF,oBAAAA,GAAuB,MAAMvH,OAAOkB,CAAAA,EAAE,CAACC,KAAK,CAAC,gCAAkCqG,CAAAA,CAAAA,KAAK,CAAC;wBACzFnG,KAAO,EAAA;AAAE,4BAAA,GAAGiG;AAAkB;AACtC,qBAAA,CAAA;AAEM,oBAAA,IAAIC,uBAAuB,CAAG,EAAA;AAC5B,wBAAA,MAAM,IAAIjI,gBAAiB,CAAA,qCAAA,CAAA;AAC5B;AACF;AAED,gBAAA,MAAMoI,OAAU,GAAA;AACd,oBAAA,GAAGnH,MAAM;AACT6G,oBAAAA,IAAAA,EAAMA,KAAKhF,EAAE;AACbb,oBAAAA,KAAAA,EAAOA,MAAMC,WAAW,EAAA;AACxBC,oBAAAA,QAAAA;oBACAM,SAAW,EAAA,CAACwE,SAASoB;AAC3B,iBAAA;AAEI,gBAAA,MAAMhI,IAAO,GAAA,MAAMf,UAAW,CAAA,MAAA,CAAA,CAAQgJ,GAAG,CAACF,OAAAA,CAAAA;gBAE1C,MAAMG,aAAAA,GAAgB,MAAMnI,YAAAA,CAAaC,IAAMC,EAAAA,GAAAA,CAAAA;gBAE/C,IAAI2G,QAAAA,CAASoB,kBAAkB,EAAE;oBAC/B,IAAI;wBACF,MAAM/I,UAAAA,CAAW,MAAQkJ,CAAAA,CAAAA,qBAAqB,CAACD,aAAAA,CAAAA;AAChD,qBAAA,CAAC,OAAOE,GAAK,EAAA;wBACZ/H,OAAO+D,CAAAA,GAAG,CAACzB,KAAK,CAACyF,GAAAA,CAAAA;AACjB,wBAAA,MAAM,IAAIzI,gBAAiB,CAAA,kCAAA,CAAA;AAC5B;oBAED,OAAOM,GAAAA,CAAIqC,IAAI,CAAC;wBAAEtC,IAAMkI,EAAAA;AAAe,qBAAA,CAAA;AACxC;gBAED,MAAM3F,GAAAA,GAAMtD,WAAW,KAAOuD,CAAAA,CAAAA,KAAK,CAAC/D,CAAE+I,CAAAA,IAAI,CAACxH,IAAM,EAAA;AAAC,oBAAA;AAAK,iBAAA,CAAA,CAAA;gBAEvD,OAAOC,GAAAA,CAAIqC,IAAI,CAAC;AACdC,oBAAAA,GAAAA;oBACAvC,IAAMkI,EAAAA;AACZ,iBAAA,CAAA;AACG,aAAA;AAED,YAAA,MAAMG,iBAAkBpI,CAAAA,CAAAA,GAAG,EAAEqD,IAAI,EAAEgF,UAAU,EAAA;gBAC3C,MAAM,EAAEC,cAAcC,iBAAiB,EAAE,GAAG,MAAMhJ,6BAAAA,CAA8BS,IAAIuB,KAAK,CAAA;AAEzF,gBAAA,MAAMiH,cAAcxJ,UAAW,CAAA,MAAA,CAAA;AAC/B,gBAAA,MAAMyJ,aAAazJ,UAAW,CAAA,KAAA,CAAA;AAE9B,gBAAA,MAAM,CAACe,IAAK,CAAA,GAAG,MAAMyI,WAAAA,CAAYE,QAAQ,CAAC;oBAAEC,OAAS,EAAA;AAAEJ,wBAAAA;AAAmB;AAAA,iBAAA,CAAA;AAE1E,gBAAA,IAAI,CAACxI,IAAM,EAAA;AACT,oBAAA,MAAM,IAAIJ,eAAgB,CAAA,eAAA,CAAA;AAC3B;AAED,gBAAA,MAAM6I,WAAYxF,CAAAA,IAAI,CAACjD,IAAAA,CAAKyC,EAAE,EAAE;oBAAEL,SAAW,EAAA,IAAA;oBAAMoG,iBAAmB,EAAA;AAAI,iBAAA,CAAA;AAE1E,gBAAA,IAAIF,UAAY,EAAA;AACdrI,oBAAAA,GAAAA,CAAIqC,IAAI,CAAC;wBACPC,GAAKmG,EAAAA,UAAAA,CAAWlG,KAAK,CAAC;AAAEC,4BAAAA,EAAAA,EAAIzC,KAAKyC;;wBACjCzC,IAAM,EAAA,MAAMD,aAAaC,IAAMC,EAAAA,GAAAA;AACvC,qBAAA,CAAA;iBACW,MAAA;AACL,oBAAA,MAAM2G,QAAW,GAAA,MAAMvG,OACpBU,CAAAA,KAAK,CAAC;wBAAEC,IAAM,EAAA,QAAA;wBAAUC,IAAM,EAAA,mBAAA;wBAAqBG,GAAK,EAAA;uBACxDD,GAAG,EAAA;AAENlB,oBAAAA,GAAAA,CAAI4I,QAAQ,CAACjC,QAASkC,CAAAA,8BAA8B,IAAI,GAAA,CAAA;AACzD;AACF,aAAA;AAED,YAAA,MAAMC,uBAAsB9I,GAAG,EAAA;gBAC7B,MAAM,EAAE2B,KAAK,EAAE,GAAG,MAAMvC,iCAAkCY,CAAAA,GAAAA,CAAIY,OAAO,CAACC,IAAI,CAAA;gBAE1E,MAAMd,IAAAA,GAAO,MAAMK,OAAOkB,CAAAA,EAAE,CAACC,KAAK,CAAC,gCAAkCC,CAAAA,CAAAA,OAAO,CAAC;oBAC3EC,KAAO,EAAA;AAAEE,wBAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAI;AAC3C,iBAAA,CAAA;AAEI,gBAAA,IAAI,CAAC7B,IAAM,EAAA;oBACT,OAAOC,GAAAA,CAAIqC,IAAI,CAAC;AAAEV,wBAAAA,KAAAA;wBAAOoH,IAAM,EAAA;AAAI,qBAAA,CAAA;AACpC;gBAED,IAAIhJ,IAAAA,CAAKoC,SAAS,EAAE;AAClB,oBAAA,MAAM,IAAIzC,gBAAiB,CAAA,mBAAA,CAAA;AAC5B;gBAED,IAAIK,IAAAA,CAAKqC,OAAO,EAAE;AAChB,oBAAA,MAAM,IAAI1C,gBAAiB,CAAA,cAAA,CAAA;AAC5B;gBAED,MAAMV,UAAAA,CAAW,MAAQkJ,CAAAA,CAAAA,qBAAqB,CAACnI,IAAAA,CAAAA;AAE/CC,gBAAAA,GAAAA,CAAIqC,IAAI,CAAC;AACPV,oBAAAA,KAAAA,EAAO5B,KAAK4B,KAAK;oBACjBoH,IAAM,EAAA;AACZ,iBAAA,CAAA;AACG;SACH,CAAA;;;;;;"}

package/dist/server/controllers/content-manager-user.js

@@ -0,0 +1,168 @@
+'use strict';
+
+var require$$0 = require('lodash');
+var require$$1 = require('@strapi/utils');
+var user = require('./validation/user.js');
+
+var contentManagerUser;
+var hasRequiredContentManagerUser;
+function requireContentManagerUser() {
+    if (hasRequiredContentManagerUser) return contentManagerUser;
+    hasRequiredContentManagerUser = 1;
+    const _ = require$$0;
+    const { contentTypes: contentTypesUtils } = require$$1;
+    const { ApplicationError, ValidationError, NotFoundError, ForbiddenError } = require$$1.errors;
+    const { validateCreateUserBody, validateUpdateUserBody } = user.__require();
+    const { UPDATED_BY_ATTRIBUTE, CREATED_BY_ATTRIBUTE } = contentTypesUtils.constants;
+    const userModel = 'plugin::users-permissions.user';
+    const ACTIONS = {
+        read: 'plugin::content-manager.explorer.read',
+        create: 'plugin::content-manager.explorer.create',
+        edit: 'plugin::content-manager.explorer.update',
+        delete: 'plugin::content-manager.explorer.delete'
+    };
+    const findEntityAndCheckPermissions = async (ability, action, model, id)=>{
+        const doc = await strapi.service('plugin::content-manager.document-manager').findOne(id, model, {
+            populate: [
+                `${CREATED_BY_ATTRIBUTE}.roles`
+            ]
+        });
+        if (_.isNil(doc)) {
+            throw new NotFoundError();
+        }
+        const pm = strapi.service('admin::permission').createPermissionsManager({
+            ability,
+            action,
+            model
+        });
+        if (pm.ability.cannot(pm.action, pm.toSubject(doc))) {
+            throw new ForbiddenError();
+        }
+        const docWithoutCreatorRoles = _.omit(doc, `${CREATED_BY_ATTRIBUTE}.roles`);
+        return {
+            pm,
+            doc: docWithoutCreatorRoles
+        };
+    };
+    contentManagerUser = {
+        /**
+	   * Create a/an user record.
+	   * @return {Object}
+	   */ async create (ctx) {
+            const { body } = ctx.request;
+            const { user: admin, userAbility } = ctx.state;
+            const { email, username } = body;
+            const pm = strapi.service('admin::permission').createPermissionsManager({
+                ability: userAbility,
+                action: ACTIONS.create,
+                model: userModel
+            });
+            if (!pm.isAllowed) {
+                return ctx.forbidden();
+            }
+            const sanitizedBody = await pm.pickPermittedFieldsOf(body, {
+                subject: userModel
+            });
+            const advanced = await strapi.store({
+                type: 'plugin',
+                name: 'users-permissions',
+                key: 'advanced'
+            }).get();
+            await validateCreateUserBody(ctx.request.body);
+            const userWithSameUsername = await strapi.db.query('plugin::users-permissions.user').findOne({
+                where: {
+                    username
+                }
+            });
+            if (userWithSameUsername) {
+                throw new ApplicationError('Username already taken');
+            }
+            if (advanced.unique_email) {
+                const userWithSameEmail = await strapi.db.query('plugin::users-permissions.user').findOne({
+                    where: {
+                        email: email.toLowerCase()
+                    }
+                });
+                if (userWithSameEmail) {
+                    throw new ApplicationError('Email already taken');
+                }
+            }
+            const user = {
+                ...sanitizedBody,
+                provider: 'local',
+                [CREATED_BY_ATTRIBUTE]: admin.id,
+                [UPDATED_BY_ATTRIBUTE]: admin.id
+            };
+            user.email = _.toLower(user.email);
+            try {
+                const data = await strapi.service('plugin::content-manager.document-manager').create(userModel, {
+                    data: user
+                });
+                const sanitizedData = await pm.sanitizeOutput(data, {
+                    action: ACTIONS.read
+                });
+                ctx.created(sanitizedData);
+            } catch (error) {
+                throw new ApplicationError(error.message);
+            }
+        },
+        /**
+	   * Update a/an user record.
+	   * @return {Object}
+	   */ async update (ctx) {
+            const { id: documentId } = ctx.params;
+            const { body } = ctx.request;
+            const { user: admin, userAbility } = ctx.state;
+            const advancedConfigs = await strapi.store({
+                type: 'plugin',
+                name: 'users-permissions',
+                key: 'advanced'
+            }).get();
+            const { email, username, password } = body;
+            const { pm, doc } = await findEntityAndCheckPermissions(userAbility, ACTIONS.edit, userModel, documentId);
+            const user = doc;
+            await validateUpdateUserBody(ctx.request.body);
+            if (_.has(body, 'password') && !password && user.provider === 'local') {
+                throw new ValidationError('password.notNull');
+            }
+            if (_.has(body, 'username')) {
+                const userWithSameUsername = await strapi.db.query('plugin::users-permissions.user').findOne({
+                    where: {
+                        username
+                    }
+                });
+                if (userWithSameUsername && _.toString(userWithSameUsername.id) !== _.toString(user.id)) {
+                    throw new ApplicationError('Username already taken');
+                }
+            }
+            if (_.has(body, 'email') && advancedConfigs.unique_email) {
+                const userWithSameEmail = await strapi.db.query('plugin::users-permissions.user').findOne({
+                    where: {
+                        email: _.toLower(email)
+                    }
+                });
+                if (userWithSameEmail && _.toString(userWithSameEmail.id) !== _.toString(user.id)) {
+                    throw new ApplicationError('Email already taken');
+                }
+                body.email = _.toLower(body.email);
+            }
+            const sanitizedData = await pm.pickPermittedFieldsOf(body, {
+                subject: pm.toSubject(user)
+            });
+            const updateData = _.omit({
+                ...sanitizedData,
+                updatedBy: admin.id
+            }, 'createdBy');
+            const data = await strapi.service('plugin::content-manager.document-manager').update(documentId, userModel, {
+                data: updateData
+            });
+            ctx.body = await pm.sanitizeOutput(data, {
+                action: ACTIONS.read
+            });
+        }
+    };
+    return contentManagerUser;
+}
+
+exports.__require = requireContentManagerUser;
+//# sourceMappingURL=content-manager-user.js.map