@strapi/plugin-users-permissions 5.48.0 → 5.48.1

package/dist/server/strategies/users-permissions.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"users-permissions.mjs","sources":["../../../server/strategies/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst { castArray, map, every, pipe } = require('lodash/fp');\nconst { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;\n\nconst { getService } = require('../utils');\n\nconst getAdvancedSettings = () => {\n  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });\n};\n\nconst authenticate = async (ctx) => {\n  try {\n    const token = await getService('jwt').getToken(ctx);\n\n    if (token) {\n      const { id } = token;\n\n      // Invalid token\n      if (id === undefined) {\n        return { authenticated: false };\n      }\n\n      const user = await getService('user').fetchAuthenticatedUser(id);\n\n      // No user associated to the token\n      if (!user) {\n        return { error: 'Invalid credentials' };\n      }\n\n      const advancedSettings = await getAdvancedSettings();\n\n      // User not confirmed\n      if (advancedSettings.email_confirmation && !user.confirmed) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // User blocked\n      if (user.blocked) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // Fetch user's permissions\n      const permissions = await Promise.resolve(user.role.id)\n        .then(getService('permission').findRolePermissions)\n        .then(map(getService('permission').toContentAPIPermission));\n\n      // Generate an ability (content API engine) based on the given permissions\n      const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);\n\n      ctx.state.user = user;\n\n      return {\n        authenticated: true,\n        credentials: user,\n        ability,\n      };\n    }\n\n    const publicPermissions = await getService('permission')\n      .findPublicPermissions()\n      .then(map(getService('permission').toContentAPIPermission));\n\n    if (publicPermissions.length === 0) {\n      return { authenticated: false };\n    }\n\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(publicPermissions);\n\n    return {\n      authenticated: true,\n      credentials: null,\n      ability,\n    };\n  } catch (err) {\n    return { authenticated: false };\n  }\n};\n\nconst verify = async (auth, config) => {\n  const { credentials: user, ability } = auth;\n\n  if (!config.scope) {\n    if (!user) {\n      // A non authenticated user cannot access routes that do not have a scope\n      throw new UnauthorizedError();\n    } else {\n      // An authenticated user can access non scoped routes\n      return;\n    }\n  }\n\n  // If no ability have been generated, then consider auth is missing\n  if (!ability) {\n    throw new UnauthorizedError();\n  }\n\n  const isAllowed = pipe(\n    // Make sure we're dealing with an array\n    castArray,\n    // Transform the scope array into an action array\n    every((scope) => ability.can(scope))\n  )(config.scope);\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nmodule.exports = {\n  name: 'users-permissions',\n  authenticate,\n  verify,\n};\n"],"names":["castArray","map","every","pipe","require$$0","ForbiddenError","UnauthorizedError","require$$1","errors","getService","require$$2","getAdvancedSettings","strapi","store","type","name","get","key","authenticate","ctx","token","getToken","id","undefined","authenticated","user","fetchAuthenticatedUser","error","advancedSettings","email_confirmation","confirmed","blocked","permissions","Promise","resolve","role","then","findRolePermissions","toContentAPIPermission","ability","contentAPI","engine","generateAbility","state","credentials","publicPermissions","findPublicPermissions","length","err","verify","auth","config","scope","isAllowed","can","usersPermissions"],"mappings":";;;;;;;;;IAEA,MAAM,EAAEA,SAAS,EAAEC,GAAG,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,UAAAA;AACxC,IAAA,MAAM,EAAEC,cAAc,EAAEC,iBAAiB,EAAE,GAAGC,WAAyBC,MAAM;IAE7E,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB,IAAA;QAC1B,OAAOC,MAAAA,CAAOC,KAAK,CAAC;YAAEC,IAAAA,EAAM,QAAA;YAAUC,IAAAA,EAAM;AAAmB,SAAA,CAAA,CAAIC,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAU,SAAA,CAAA;AAC1F,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,OAAOC,GAAAA,GAAAA;QAC1B,IAAI;AACF,YAAA,MAAMC,KAAAA,GAAQ,MAAMX,UAAAA,CAAW,KAAA,CAAA,CAAOY,QAAQ,CAACF,GAAAA,CAAAA;AAE/C,YAAA,IAAIC,KAAAA,EAAO;gBACT,MAAM,EAAEE,EAAE,EAAE,GAAGF,KAAAA;;AAGf,gBAAA,IAAIE,OAAOC,SAAAA,EAAW;oBACpB,OAAO;wBAAEC,aAAAA,EAAe;AAAK,qBAAA;AACrC,gBAAA;AAEM,gBAAA,MAAMC,IAAAA,GAAO,MAAMhB,UAAAA,CAAW,MAAA,CAAA,CAAQiB,sBAAsB,CAACJ,EAAAA,CAAAA;;AAG7D,gBAAA,IAAI,CAACG,IAAAA,EAAM;oBACT,OAAO;wBAAEE,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;AAEM,gBAAA,MAAMC,mBAAmB,MAAMjB,mBAAAA,EAAAA;;AAG/B,gBAAA,IAAIiB,iBAAiBC,kBAAkB,IAAI,CAACJ,IAAAA,CAAKK,SAAS,EAAE;oBAC1D,OAAO;wBAAEH,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;;gBAGM,IAAIF,IAAAA,CAAKM,OAAO,EAAE;oBAChB,OAAO;wBAAEJ,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;;gBAGM,MAAMK,WAAAA,GAAc,MAAMC,OAAAA,CAAQC,OAAO,CAACT,IAAAA,CAAKU,IAAI,CAACb,EAAE,CAAA,CACnDc,IAAI,CAAC3B,UAAAA,CAAW,cAAc4B,mBAAmB,CAAA,CACjDD,IAAI,CAACnC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc6B,sBAAsB,CAAA,CAAA;;gBAG3D,MAAMC,OAAAA,GAAU,MAAM3B,MAAAA,CAAO4B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACV,WAAAA,CAAAA;gBAE3Eb,GAAAA,CAAIwB,KAAK,CAAClB,IAAI,GAAGA,IAAAA;gBAEjB,OAAO;oBACLD,aAAAA,EAAe,IAAA;oBACfoB,WAAAA,EAAanB,IAAAA;AACbc,oBAAAA;AACR,iBAAA;AACA,YAAA;YAEI,MAAMM,iBAAAA,GAAoB,MAAMpC,UAAAA,CAAW,YAAA,CAAA,CACxCqC,qBAAqB,EAAA,CACrBV,IAAI,CAACnC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc6B,sBAAsB,CAAA,CAAA;YAE3D,IAAIO,iBAAAA,CAAkBE,MAAM,KAAK,CAAA,EAAG;gBAClC,OAAO;oBAAEvB,aAAAA,EAAe;AAAK,iBAAA;AACnC,YAAA;YAEI,MAAMe,OAAAA,GAAU,MAAM3B,MAAAA,CAAO4B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACG,iBAAAA,CAAAA;YAE3E,OAAO;gBACLrB,aAAAA,EAAe,IAAA;gBACfoB,WAAAA,EAAa,IAAA;AACbL,gBAAAA;AACN,aAAA;AACA,QAAA,CAAA,CAAI,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAExB,aAAAA,EAAe;AAAK,aAAA;AACjC,QAAA;AACA,IAAA,CAAA;IAEA,MAAMyB,MAAAA,GAAS,OAAOC,IAAAA,EAAMC,MAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEP,WAAAA,EAAanB,IAAI,EAAEc,OAAO,EAAE,GAAGW,IAAAA;QAEvC,IAAI,CAACC,MAAAA,CAAOC,KAAK,EAAE;AACjB,YAAA,IAAI,CAAC3B,IAAAA,EAAM;;AAET,gBAAA,MAAM,IAAInB,iBAAAA,EAAAA;YAChB,CAAA,MAAW;;AAEL,gBAAA;AACN,YAAA;AACA,QAAA;;AAGE,QAAA,IAAI,CAACiC,OAAAA,EAAS;AACZ,YAAA,MAAM,IAAIjC,iBAAAA,EAAAA;AACd,QAAA;QAEE,MAAM+C,SAAAA,GAAYlD;AAEhBH,QAAAA,SAAAA;AAEAE,QAAAA,KAAAA,CAAM,CAACkD,KAAAA,GAAUb,OAAAA,CAAQe,GAAG,CAACF,KAAAA,CAAAA,CAAAA,CAAAA,CAC7BD,OAAOC,KAAK,CAAA;AAEd,QAAA,IAAI,CAACC,SAAAA,EAAW;AACd,YAAA,MAAM,IAAIhD,cAAAA,EAAAA;AACd,QAAA;AACA,IAAA,CAAA;IAEAkD,gBAAAA,GAAiB;QACfxC,IAAAA,EAAM,mBAAA;AACNG,QAAAA,YAAAA;AACA+B,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"users-permissions.mjs","sources":["../../../server/strategies/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst { castArray, map, every, pipe } = require('lodash/fp');\nconst { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;\n\nconst { getService } = require('../utils');\n\nconst getAdvancedSettings = () => {\n  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });\n};\n\nconst authenticate = async (ctx) => {\n  try {\n    const token = await getService('jwt').getToken(ctx);\n\n    if (token) {\n      const { id } = token;\n\n      // Invalid token\n      if (id === undefined) {\n        return { authenticated: false };\n      }\n\n      const user = await getService('user').fetchAuthenticatedUser(id);\n\n      // No user associated to the token\n      if (!user) {\n        return { error: 'Invalid credentials' };\n      }\n\n      const advancedSettings = await getAdvancedSettings();\n\n      // User not confirmed\n      if (advancedSettings.email_confirmation && !user.confirmed) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // User blocked\n      if (user.blocked) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // Fetch user's permissions\n      const permissions = await Promise.resolve(user.role.id)\n        .then(getService('permission').findRolePermissions)\n        .then(map(getService('permission').toContentAPIPermission));\n\n      // Generate an ability (content API engine) based on the given permissions\n      const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);\n\n      ctx.state.user = user;\n\n      return {\n        authenticated: true,\n        credentials: user,\n        ability,\n      };\n    }\n\n    const publicPermissions = await getService('permission')\n      .findPublicPermissions()\n      .then(map(getService('permission').toContentAPIPermission));\n\n    if (publicPermissions.length === 0) {\n      return { authenticated: false };\n    }\n\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(publicPermissions);\n\n    return {\n      authenticated: true,\n      credentials: null,\n      ability,\n    };\n  } catch (err) {\n    return { authenticated: false };\n  }\n};\n\nconst verify = async (auth, config) => {\n  const { credentials: user, ability } = auth;\n\n  if (!config.scope) {\n    if (!user) {\n      // A non authenticated user cannot access routes that do not have a scope\n      throw new UnauthorizedError();\n    } else {\n      // An authenticated user can access non scoped routes\n      return;\n    }\n  }\n\n  // If no ability have been generated, then consider auth is missing\n  if (!ability) {\n    throw new UnauthorizedError();\n  }\n\n  const isAllowed = pipe(\n    // Make sure we're dealing with an array\n    castArray,\n    // Transform the scope array into an action array\n    every((scope) => ability.can(scope))\n  )(config.scope);\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nmodule.exports = {\n  name: 'users-permissions',\n  authenticate,\n  verify,\n};\n"],"names":["castArray","map","every","pipe","require$$0","ForbiddenError","UnauthorizedError","require$$1","errors","getService","require$$2","getAdvancedSettings","strapi","store","type","name","get","key","authenticate","ctx","token","getToken","id","undefined","authenticated","user","fetchAuthenticatedUser","error","advancedSettings","email_confirmation","confirmed","blocked","permissions","Promise","resolve","role","then","findRolePermissions","toContentAPIPermission","ability","contentAPI","engine","generateAbility","state","credentials","publicPermissions","findPublicPermissions","length","err","verify","auth","config","scope","isAllowed","can","usersPermissions"],"mappings":";;;;;;;;;IAEA,MAAM,EAAEA,SAAS,EAAEC,GAAG,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,UAAAA;AACxC,IAAA,MAAM,EAAEC,cAAc,EAAEC,iBAAiB,EAAE,GAAGC,WAAyBC,MAAM;IAE7E,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB,IAAA;QAC1B,OAAOC,MAAAA,CAAOC,KAAK,CAAC;YAAEC,IAAAA,EAAM,QAAA;YAAUC,IAAAA,EAAM;AAAmB,SAAA,CAAA,CAAIC,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAU,SAAA,CAAA;AAC1F,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,OAAOC,GAAAA,GAAAA;QAC1B,IAAI;AACF,YAAA,MAAMC,KAAAA,GAAQ,MAAMX,UAAAA,CAAW,KAAA,CAAA,CAAOY,QAAQ,CAACF,GAAAA,CAAAA;AAE/C,YAAA,IAAIC,KAAAA,EAAO;gBACT,MAAM,EAAEE,EAAE,EAAE,GAAGF,KAAAA;;AAGf,gBAAA,IAAIE,OAAOC,SAAAA,EAAW;oBACpB,OAAO;wBAAEC,aAAAA,EAAe;;AAChC,gBAAA;AAEM,gBAAA,MAAMC,IAAAA,GAAO,MAAMhB,UAAAA,CAAW,MAAA,CAAA,CAAQiB,sBAAsB,CAACJ,EAAAA,CAAAA;;AAG7D,gBAAA,IAAI,CAACG,IAAAA,EAAM;oBACT,OAAO;wBAAEE,KAAAA,EAAO;;AACxB,gBAAA;AAEM,gBAAA,MAAMC,mBAAmB,MAAMjB,mBAAAA,EAAAA;;AAG/B,gBAAA,IAAIiB,iBAAiBC,kBAAkB,IAAI,CAACJ,IAAAA,CAAKK,SAAS,EAAE;oBAC1D,OAAO;wBAAEH,KAAAA,EAAO;;AACxB,gBAAA;;gBAGM,IAAIF,IAAAA,CAAKM,OAAO,EAAE;oBAChB,OAAO;wBAAEJ,KAAAA,EAAO;;AACxB,gBAAA;;gBAGM,MAAMK,WAAAA,GAAc,MAAMC,OAAAA,CAAQC,OAAO,CAACT,IAAAA,CAAKU,IAAI,CAACb,EAAE,CAAA,CACnDc,IAAI,CAAC3B,UAAAA,CAAW,cAAc4B,mBAAmB,CAAA,CACjDD,IAAI,CAACnC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc6B,sBAAsB,CAAA,CAAA;;gBAG3D,MAAMC,OAAAA,GAAU,MAAM3B,MAAAA,CAAO4B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACV,WAAAA,CAAAA;gBAE3Eb,GAAAA,CAAIwB,KAAK,CAAClB,IAAI,GAAGA,IAAAA;gBAEjB,OAAO;oBACLD,aAAAA,EAAe,IAAA;oBACfoB,WAAAA,EAAanB,IAAAA;AACbc,oBAAAA;AACR,iBAAA;AACA,YAAA;YAEI,MAAMM,iBAAAA,GAAoB,MAAMpC,UAAAA,CAAW,YAAA,CAAA,CACxCqC,qBAAqB,EAAA,CACrBV,IAAI,CAACnC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc6B,sBAAsB,CAAA,CAAA;YAE3D,IAAIO,iBAAAA,CAAkBE,MAAM,KAAK,CAAA,EAAG;gBAClC,OAAO;oBAAEvB,aAAAA,EAAe;;AAC9B,YAAA;YAEI,MAAMe,OAAAA,GAAU,MAAM3B,MAAAA,CAAO4B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACG,iBAAAA,CAAAA;YAE3E,OAAO;gBACLrB,aAAAA,EAAe,IAAA;gBACfoB,WAAAA,EAAa,IAAA;AACbL,gBAAAA;AACN,aAAA;AACA,QAAA,CAAA,CAAI,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAExB,aAAAA,EAAe;;AAC5B,QAAA;AACA,IAAA,CAAA;IAEA,MAAMyB,MAAAA,GAAS,OAAOC,IAAAA,EAAMC,MAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEP,WAAAA,EAAanB,IAAI,EAAEc,OAAO,EAAE,GAAGW,IAAAA;QAEvC,IAAI,CAACC,MAAAA,CAAOC,KAAK,EAAE;AACjB,YAAA,IAAI,CAAC3B,IAAAA,EAAM;;AAET,gBAAA,MAAM,IAAInB,iBAAAA,EAAAA;YAChB,CAAA,MAAW;;AAEL,gBAAA;AACN,YAAA;AACA,QAAA;;AAGE,QAAA,IAAI,CAACiC,OAAAA,EAAS;AACZ,YAAA,MAAM,IAAIjC,iBAAAA,EAAAA;AACd,QAAA;QAEE,MAAM+C,SAAAA,GAAYlD;AAEhBH,QAAAA,SAAAA;AAEAE,QAAAA,KAAAA,CAAM,CAACkD,KAAAA,GAAUb,OAAAA,CAAQe,GAAG,CAACF,KAAAA,CAAAA,CAAAA,CAAAA,CAC7BD,OAAOC,KAAK,CAAA;AAEd,QAAA,IAAI,CAACC,SAAAA,EAAW;AACd,YAAA,MAAM,IAAIhD,cAAAA,EAAAA;AACd,QAAA;AACA,IAAA,CAAA;IAEAkD,gBAAAA,GAAiB;QACfxC,IAAAA,EAAM,mBAAA;AACNG,QAAAA,YAAAA;AACA+B,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../server/utils/index.js"],"sourcesContent":["'use strict';\n\nconst crypto = require('crypto');\nconst sanitize = require('./sanitize');\n\nconst MAX_USERNAME_ATTEMPTS = 10;\n\nconst getService = (name) => {\n  return strapi.plugin('users-permissions').service(name);\n};\n\nconst isUsernameTaken = async (username) => {\n  const user = await strapi.db\n    .query('plugin::users-permissions.user')\n    .findOne({ where: { username } });\n  return Boolean(user);\n};\n\nconst findValidUsername = async (basename) => {\n  const minLength =\n    strapi.getModel('plugin::users-permissions.user')?.attributes?.username?.minLength ?? 3;\n  const tryBasenameFirst = basename.length >= minLength;\n\n  let attempt = 0;\n  let candidate;\n  let taken;\n  do {\n    candidate =\n      attempt === 0 && tryBasenameFirst ? basename : `${basename}${crypto.randomInt(1000, 9999)}`;\n    taken = await isUsernameTaken(candidate);\n    attempt += 1;\n  } while (taken && attempt <= MAX_USERNAME_ATTEMPTS);\n\n  return taken ? crypto.randomUUID() : candidate;\n};\n\nmodule.exports = {\n  getService,\n  isUsernameTaken,\n  findValidUsername,\n  sanitize,\n};\n"],"names":["crypto","require$$0","sanitize","require$$1","MAX_USERNAME_ATTEMPTS","getService","name","strapi","plugin","service","isUsernameTaken","username","user","db","query","findOne","where","Boolean","findValidUsername","basename","minLength","getModel","attributes","tryBasenameFirst","length","attempt","candidate","taken","randomInt","randomUUID","utils"],"mappings":";;;;;;;;;;AAEA,IAAA,MAAMA,MAAAA,GAASC,UAAAA;AACf,IAAA,MAAMC,QAAAA,GAAWC,eAAAA,EAAAA;AAEjB,IAAA,MAAMC,qBAAAA,GAAwB,EAAA;AAE9B,IAAA,MAAMC,aAAa,CAACC,IAAAA,GAAAA;AAClB,QAAA,OAAOC,MAAAA,CAAOC,MAAM,CAAC,mBAAA,CAAA,CAAqBC,OAAO,CAACH,IAAAA,CAAAA;AACpD,IAAA,CAAA;AAEA,IAAA,MAAMI,kBAAkB,OAAOC,QAAAA,GAAAA;QAC7B,MAAMC,IAAAA,GAAO,MAAML,MAAAA,CAAOM,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;YAAEC,KAAAA,EAAO;AAAEL,gBAAAA;AAAQ;AAAE,SAAA,CAAA;AAChC,QAAA,OAAOM,OAAAA,CAAQL,IAAAA,CAAAA;AACjB,IAAA,CAAA;AAEA,IAAA,MAAMM,oBAAoB,OAAOC,QAAAA,GAAAA;AAC/B,QAAA,MAAMC,YACJb,MAAAA,CAAOc,QAAQ,CAAC,gCAAA,CAAA,EAAmCC,UAAAA,EAAYX,UAAUS,SAAAA,IAAa,CAAA;QACxF,MAAMG,gBAAAA,GAAmBJ,QAAAA,CAASK,MAAM,IAAIJ,SAAAA;AAE5C,QAAA,IAAIK,OAAAA,GAAU,CAAA;QACd,IAAIC,SAAAA;QACJ,IAAIC,KAAAA;QACJ,GAAG;YACDD,SAAAA,GACED,OAAAA,KAAY,CAAA,IAAKF,gBAAAA,GAAmBJ,QAAAA,GAAW,CAAA,EAAGA,WAAWnB,MAAAA,CAAO4B,SAAS,CAAC,IAAA,EAAM,IAAA,CAAA,CAAA,CAAO;AAC7FD,YAAAA,KAAAA,GAAQ,MAAMjB,eAAAA,CAAgBgB,SAAAA,CAAAA;YAC9BD,OAAAA,IAAW,CAAA;QACf,CAAA,OAAWE,KAAAA,IAASF,WAAWrB,qBAAAA;QAE7B,OAAOuB,KAAAA,GAAQ3B,MAAAA,CAAO6B,UAAU,EAAA,GAAKH,SAAAA;AACvC,IAAA,CAAA;IAEAI,KAAAA,GAAiB;AACfzB,QAAAA,UAAAA;AACAK,QAAAA,eAAAA;AACAQ,QAAAA,iBAAAA;AACAhB,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"index.js","sources":["../../../server/utils/index.js"],"sourcesContent":["'use strict';\n\nconst crypto = require('crypto');\nconst sanitize = require('./sanitize');\n\nconst MAX_USERNAME_ATTEMPTS = 10;\n\nconst getService = (name) => {\n  return strapi.plugin('users-permissions').service(name);\n};\n\nconst isUsernameTaken = async (username) => {\n  const user = await strapi.db\n    .query('plugin::users-permissions.user')\n    .findOne({ where: { username } });\n  return Boolean(user);\n};\n\nconst findValidUsername = async (basename) => {\n  const minLength =\n    strapi.getModel('plugin::users-permissions.user')?.attributes?.username?.minLength ?? 3;\n  const tryBasenameFirst = basename.length >= minLength;\n\n  let attempt = 0;\n  let candidate;\n  let taken;\n  do {\n    candidate =\n      attempt === 0 && tryBasenameFirst ? basename : `${basename}${crypto.randomInt(1000, 9999)}`;\n    taken = await isUsernameTaken(candidate);\n    attempt += 1;\n  } while (taken && attempt <= MAX_USERNAME_ATTEMPTS);\n\n  return taken ? crypto.randomUUID() : candidate;\n};\n\nmodule.exports = {\n  getService,\n  isUsernameTaken,\n  findValidUsername,\n  sanitize,\n};\n"],"names":["crypto","require$$0","sanitize","require$$1","MAX_USERNAME_ATTEMPTS","getService","name","strapi","plugin","service","isUsernameTaken","username","user","db","query","findOne","where","Boolean","findValidUsername","basename","minLength","getModel","attributes","tryBasenameFirst","length","attempt","candidate","taken","randomInt","randomUUID","utils"],"mappings":";;;;;;;;;;AAEA,IAAA,MAAMA,MAAAA,GAASC,UAAAA;AACf,IAAA,MAAMC,QAAAA,GAAWC,eAAAA,EAAAA;AAEjB,IAAA,MAAMC,qBAAAA,GAAwB,EAAA;AAE9B,IAAA,MAAMC,aAAa,CAACC,IAAAA,GAAAA;AAClB,QAAA,OAAOC,MAAAA,CAAOC,MAAM,CAAC,mBAAA,CAAA,CAAqBC,OAAO,CAACH,IAAAA,CAAAA;AACpD,IAAA,CAAA;AAEA,IAAA,MAAMI,kBAAkB,OAAOC,QAAAA,GAAAA;QAC7B,MAAMC,IAAAA,GAAO,MAAML,MAAAA,CAAOM,EAAE,CACzBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;YAAEC,KAAAA,EAAO;AAAEL,gBAAAA;AAAQ;AAAE,SAAA,CAAA;AAChC,QAAA,OAAOM,OAAAA,CAAQL,IAAAA,CAAAA;AACjB,IAAA,CAAA;AAEA,IAAA,MAAMM,oBAAoB,OAAOC,QAAAA,GAAAA;AAC/B,QAAA,MAAMC,YACJb,MAAAA,CAAOc,QAAQ,CAAC,gCAAA,CAAA,EAAmCC,UAAAA,EAAYX,UAAUS,SAAAA,IAAa,CAAA;QACxF,MAAMG,gBAAAA,GAAmBJ,QAAAA,CAASK,MAAM,IAAIJ,SAAAA;AAE5C,QAAA,IAAIK,OAAAA,GAAU,CAAA;QACd,IAAIC,SAAAA;QACJ,IAAIC,KAAAA;QACJ,GAAG;YACDD,SAAAA,GACED,OAAAA,KAAY,CAAA,IAAKF,gBAAAA,GAAmBJ,QAAAA,GAAW,CAAA,EAAGA,WAAWnB,MAAAA,CAAO4B,SAAS,CAAC,IAAA,EAAM,IAAA,CAAA,CAAA,CAAO;AAC7FD,YAAAA,KAAAA,GAAQ,MAAMjB,eAAAA,CAAgBgB,SAAAA,CAAAA;YAC9BD,OAAAA,IAAW,CAAA;QACf,CAAA,OAAWE,KAAAA,IAASF,WAAWrB,qBAAAA;QAE7B,OAAOuB,KAAAA,GAAQ3B,MAAAA,CAAO6B,UAAU,EAAA,GAAKH,SAAAA;AACvC,IAAA,CAAA;IAEAI,KAAAA,GAAiB;AACfzB,QAAAA,UAAAA;AACAK,QAAAA,eAAAA;AACAQ,QAAAA,iBAAAA;AACAhB,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":["../../../server/utils/index.js"],"sourcesContent":["'use strict';\n\nconst crypto = require('crypto');\nconst sanitize = require('./sanitize');\n\nconst MAX_USERNAME_ATTEMPTS = 10;\n\nconst getService = (name) => {\n  return strapi.plugin('users-permissions').service(name);\n};\n\nconst isUsernameTaken = async (username) => {\n  const user = await strapi.db\n    .query('plugin::users-permissions.user')\n    .findOne({ where: { username } });\n  return Boolean(user);\n};\n\nconst findValidUsername = async (basename) => {\n  const minLength =\n    strapi.getModel('plugin::users-permissions.user')?.attributes?.username?.minLength ?? 3;\n  const tryBasenameFirst = basename.length >= minLength;\n\n  let attempt = 0;\n  let candidate;\n  let taken;\n  do {\n    candidate =\n      attempt === 0 && tryBasenameFirst ? basename : `${basename}${crypto.randomInt(1000, 9999)}`;\n    taken = await isUsernameTaken(candidate);\n    attempt += 1;\n  } while (taken && attempt <= MAX_USERNAME_ATTEMPTS);\n\n  return taken ? crypto.randomUUID() : candidate;\n};\n\nmodule.exports = {\n  getService,\n  isUsernameTaken,\n  findValidUsername,\n  sanitize,\n};\n"],"names":["crypto","require$$0","sanitize","require$$1","MAX_USERNAME_ATTEMPTS","getService","name","strapi","plugin","service","isUsernameTaken","username","user","db","query","findOne","where","Boolean","findValidUsername","basename","minLength","getModel","attributes","tryBasenameFirst","length","attempt","candidate","taken","randomInt","randomUUID","utils"],"mappings":";;;;;;;;AAEA,IAAA,MAAMA,MAAAA,GAASC,UAAAA;AACf,IAAA,MAAMC,QAAAA,GAAWC,eAAAA,EAAAA;AAEjB,IAAA,MAAMC,qBAAAA,GAAwB,EAAA;AAE9B,IAAA,MAAMC,aAAa,CAACC,IAAAA,GAAAA;AAClB,QAAA,OAAOC,MAAAA,CAAOC,MAAM,CAAC,mBAAA,CAAA,CAAqBC,OAAO,CAACH,IAAAA,CAAAA;AACpD,IAAA,CAAA;AAEA,IAAA,MAAMI,kBAAkB,OAAOC,QAAAA,GAAAA;QAC7B,MAAMC,IAAAA,GAAO,MAAML,MAAAA,CAAOM,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;YAAEC,KAAAA,EAAO;AAAEL,gBAAAA;AAAQ;AAAE,SAAA,CAAA;AAChC,QAAA,OAAOM,OAAAA,CAAQL,IAAAA,CAAAA;AACjB,IAAA,CAAA;AAEA,IAAA,MAAMM,oBAAoB,OAAOC,QAAAA,GAAAA;AAC/B,QAAA,MAAMC,YACJb,MAAAA,CAAOc,QAAQ,CAAC,gCAAA,CAAA,EAAmCC,UAAAA,EAAYX,UAAUS,SAAAA,IAAa,CAAA;QACxF,MAAMG,gBAAAA,GAAmBJ,QAAAA,CAASK,MAAM,IAAIJ,SAAAA;AAE5C,QAAA,IAAIK,OAAAA,GAAU,CAAA;QACd,IAAIC,SAAAA;QACJ,IAAIC,KAAAA;QACJ,GAAG;YACDD,SAAAA,GACED,OAAAA,KAAY,CAAA,IAAKF,gBAAAA,GAAmBJ,QAAAA,GAAW,CAAA,EAAGA,WAAWnB,MAAAA,CAAO4B,SAAS,CAAC,IAAA,EAAM,IAAA,CAAA,CAAA,CAAO;AAC7FD,YAAAA,KAAAA,GAAQ,MAAMjB,eAAAA,CAAgBgB,SAAAA,CAAAA;YAC9BD,OAAAA,IAAW,CAAA;QACf,CAAA,OAAWE,KAAAA,IAASF,WAAWrB,qBAAAA;QAE7B,OAAOuB,KAAAA,GAAQ3B,MAAAA,CAAO6B,UAAU,EAAA,GAAKH,SAAAA;AACvC,IAAA,CAAA;IAEAI,KAAAA,GAAiB;AACfzB,QAAAA,UAAAA;AACAK,QAAAA,eAAAA;AACAQ,QAAAA,iBAAAA;AACAhB,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"index.mjs","sources":["../../../server/utils/index.js"],"sourcesContent":["'use strict';\n\nconst crypto = require('crypto');\nconst sanitize = require('./sanitize');\n\nconst MAX_USERNAME_ATTEMPTS = 10;\n\nconst getService = (name) => {\n  return strapi.plugin('users-permissions').service(name);\n};\n\nconst isUsernameTaken = async (username) => {\n  const user = await strapi.db\n    .query('plugin::users-permissions.user')\n    .findOne({ where: { username } });\n  return Boolean(user);\n};\n\nconst findValidUsername = async (basename) => {\n  const minLength =\n    strapi.getModel('plugin::users-permissions.user')?.attributes?.username?.minLength ?? 3;\n  const tryBasenameFirst = basename.length >= minLength;\n\n  let attempt = 0;\n  let candidate;\n  let taken;\n  do {\n    candidate =\n      attempt === 0 && tryBasenameFirst ? basename : `${basename}${crypto.randomInt(1000, 9999)}`;\n    taken = await isUsernameTaken(candidate);\n    attempt += 1;\n  } while (taken && attempt <= MAX_USERNAME_ATTEMPTS);\n\n  return taken ? crypto.randomUUID() : candidate;\n};\n\nmodule.exports = {\n  getService,\n  isUsernameTaken,\n  findValidUsername,\n  sanitize,\n};\n"],"names":["crypto","require$$0","sanitize","require$$1","MAX_USERNAME_ATTEMPTS","getService","name","strapi","plugin","service","isUsernameTaken","username","user","db","query","findOne","where","Boolean","findValidUsername","basename","minLength","getModel","attributes","tryBasenameFirst","length","attempt","candidate","taken","randomInt","randomUUID","utils"],"mappings":";;;;;;;;AAEA,IAAA,MAAMA,MAAAA,GAASC,UAAAA;AACf,IAAA,MAAMC,QAAAA,GAAWC,eAAAA,EAAAA;AAEjB,IAAA,MAAMC,qBAAAA,GAAwB,EAAA;AAE9B,IAAA,MAAMC,aAAa,CAACC,IAAAA,GAAAA;AAClB,QAAA,OAAOC,MAAAA,CAAOC,MAAM,CAAC,mBAAA,CAAA,CAAqBC,OAAO,CAACH,IAAAA,CAAAA;AACpD,IAAA,CAAA;AAEA,IAAA,MAAMI,kBAAkB,OAAOC,QAAAA,GAAAA;QAC7B,MAAMC,IAAAA,GAAO,MAAML,MAAAA,CAAOM,EAAE,CACzBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;YAAEC,KAAAA,EAAO;AAAEL,gBAAAA;AAAQ;AAAE,SAAA,CAAA;AAChC,QAAA,OAAOM,OAAAA,CAAQL,IAAAA,CAAAA;AACjB,IAAA,CAAA;AAEA,IAAA,MAAMM,oBAAoB,OAAOC,QAAAA,GAAAA;AAC/B,QAAA,MAAMC,YACJb,MAAAA,CAAOc,QAAQ,CAAC,gCAAA,CAAA,EAAmCC,UAAAA,EAAYX,UAAUS,SAAAA,IAAa,CAAA;QACxF,MAAMG,gBAAAA,GAAmBJ,QAAAA,CAASK,MAAM,IAAIJ,SAAAA;AAE5C,QAAA,IAAIK,OAAAA,GAAU,CAAA;QACd,IAAIC,SAAAA;QACJ,IAAIC,KAAAA;QACJ,GAAG;YACDD,SAAAA,GACED,OAAAA,KAAY,CAAA,IAAKF,gBAAAA,GAAmBJ,QAAAA,GAAW,CAAA,EAAGA,WAAWnB,MAAAA,CAAO4B,SAAS,CAAC,IAAA,EAAM,IAAA,CAAA,CAAA,CAAO;AAC7FD,YAAAA,KAAAA,GAAQ,MAAMjB,eAAAA,CAAgBgB,SAAAA,CAAAA;YAC9BD,OAAAA,IAAW,CAAA;QACf,CAAA,OAAWE,KAAAA,IAASF,WAAWrB,qBAAAA;QAE7B,OAAOuB,KAAAA,GAAQ3B,MAAAA,CAAO6B,UAAU,EAAA,GAAKH,SAAAA;AACvC,IAAA,CAAA;IAEAI,KAAAA,GAAiB;AACfzB,QAAAA,UAAAA;AACAK,QAAAA,eAAAA;AACAQ,QAAAA,iBAAAA;AACAhB,QAAAA;AACF,KAAA;;;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/plugin-users-permissions",
-  "version": "5.48.0",
+  "version": "5.48.1",
   "description": "Protect your API with a full-authentication process based on JWT",
   "homepage": "https://strapi.io",
   "bugs": {
@@ -55,7 +55,7 @@
   "dependencies": {
     "@strapi/design-system": "2.2.0",
     "@strapi/icons": "2.2.0",
-    "@strapi/utils": "5.48.0",
+    "@strapi/utils": "5.48.1",
     "bcryptjs": "2.4.3",
     "formik": "2.4.5",
     "grant": "5.4.24",
@@ -75,7 +75,7 @@
     "zod": "3.25.67"
   },
   "devDependencies": {
-    "@strapi/strapi": "5.48.0",
+    "@strapi/strapi": "5.48.1",
     "@testing-library/dom": "10.4.1",
     "@testing-library/react": "16.3.2",
     "@testing-library/user-event": "14.6.1",
@@ -93,7 +93,7 @@
     "styled-components": "^6.0.0"
   },
   "engines": {
-    "node": ">=20.0.0 <=24.x.x",
+    "node": ">=20.0.0 <=26.x.x",
     "npm": ">=6.0.0"
   },
   "strapi": {

package/server/services/user.js

@@ -59,8 +59,12 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   async add(values) {
-    return strapi.db.query(USER_MODEL_UID).create({
-      data: await this.ensureHashedPasswords(values),
+    // Use the Document Service so relation inputs accept both the internal
+    // numeric id (legacy) and the documentId (v5 default) syntax, consistent
+    // with every other content-type endpoint. The Document Service hashes
+    // `password` attributes itself, so we must not pre-hash here.
+    return strapi.documents(USER_MODEL_UID).create({
+      data: values,
       populate: ['role'],
     });
   },
@@ -72,9 +76,22 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   async edit(userId, params = {}) {
-    return strapi.db.query(USER_MODEL_UID).update({
-      where: { id: userId },
-      data: await this.ensureHashedPasswords(params),
+    // The user is addressed by its numeric id (e.g. the `/users/:id` route),
+    // but the Document Service updates by documentId. Resolve it first so the
+    // relation inputs are processed by the Document Service, which accepts both
+    // numeric ids (legacy) and documentIds (v5 default). The Document Service
+    // hashes `password` attributes itself, so we must not pre-hash here.
+    const entry = await strapi.db
+      .query(USER_MODEL_UID)
+      .findOne({ where: { id: userId }, select: ['documentId'] });
+
+    if (!entry) {
+      return null;
+    }
+
+    return strapi.documents(USER_MODEL_UID).update({
+      documentId: entry.documentId,
+      data: params,
       populate: ['role'],
     });
   },