@strapi/plugin-users-permissions 5.49.0 → 5.50.0

package/dist/server/strategies/users-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"users-permissions.js","sources":["../../../server/strategies/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst { castArray, map, every, pipe } = require('lodash/fp');\nconst { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;\n\nconst { getService } = require('../utils');\n\nconst getAdvancedSettings = () => {\n  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });\n};\n\nconst authenticate = async (ctx) => {\n  try {\n    const token = await getService('jwt').getToken(ctx);\n\n    if (token) {\n      const { id } = token;\n\n      // Invalid token\n      if (id === undefined) {\n        return { authenticated: false };\n      }\n\n      const user = await getService('user').fetchAuthenticatedUser(id);\n\n      // No user associated to the token\n      if (!user) {\n        return { error: 'Invalid credentials' };\n      }\n\n      const advancedSettings = await getAdvancedSettings();\n\n      // User not confirmed\n      if (advancedSettings.email_confirmation && !user.confirmed) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // User blocked\n      if (user.blocked) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // Fetch user's permissions\n      const permissions = await Promise.resolve(user.role.id)\n        .then(getService('permission').findRolePermissions)\n        .then(map(getService('permission').toContentAPIPermission));\n\n      // Generate an ability (content API engine) based on the given permissions\n      const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);\n\n      ctx.state.user = user;\n\n      return {\n        authenticated: true,\n        credentials: user,\n        ability,\n      };\n    }\n\n    const publicPermissions = await getService('permission')\n      .findPublicPermissions()\n      .then(map(getService('permission').toContentAPIPermission));\n\n    if (publicPermissions.length === 0) {\n      return { authenticated: false };\n    }\n\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(publicPermissions);\n\n    return {\n      authenticated: true,\n      credentials: null,\n      ability,\n    };\n  } catch (err) {\n    return { authenticated: false };\n  }\n};\n\nconst verify = async (auth, config) => {\n  const { credentials: user, ability } = auth;\n\n  if (!config.scope) {\n    if (!user) {\n      // A non authenticated user cannot access routes that do not have a scope\n      throw new UnauthorizedError();\n    } else {\n      // An authenticated user can access non scoped routes\n      return;\n    }\n  }\n\n  // If no ability have been generated, then consider auth is missing\n  if (!ability) {\n    throw new UnauthorizedError();\n  }\n\n  const isAllowed = pipe(\n    // Make sure we're dealing with an array\n    castArray,\n    // Transform the scope array into an action array\n    every((scope) => ability.can(scope))\n  )(config.scope);\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nmodule.exports = {\n  name: 'users-permissions',\n  authenticate,\n  verify,\n};\n"],"names":["castArray","map","every","pipe","require$$0","ForbiddenError","UnauthorizedError","require$$1","errors","getService","require$$2","getAdvancedSettings","strapi","store","type","name","get","key","authenticate","ctx","token","getToken","id","undefined","authenticated","user","fetchAuthenticatedUser","error","advancedSettings","email_confirmation","confirmed","blocked","permissions","Promise","resolve","role","then","findRolePermissions","toContentAPIPermission","ability","contentAPI","engine","generateAbility","state","credentials","publicPermissions","findPublicPermissions","length","err","verify","auth","config","scope","isAllowed","can","usersPermissions"],"mappings":";;;;;;;;;;;;;;;;IAEA,MAAM,EAAEA,SAAS,EAAEC,GAAG,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,2BAAAA;AACxC,IAAA,MAAM,EAAEC,cAAc,EAAEC,iBAAiB,EAAE,GAAGC,4BAAyBC,MAAM;IAE7E,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB,IAAA;QAC1B,OAAOC,MAAAA,CAAOC,KAAK,CAAC;YAAEC,IAAAA,EAAM,QAAA;YAAUC,IAAAA,EAAM;AAAmB,SAAA,CAAA,CAAIC,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAU,SAAA,CAAA;AAC1F,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,OAAOC,GAAAA,GAAAA;QAC1B,IAAI;AACF,YAAA,MAAMC,KAAAA,GAAQ,MAAMX,UAAAA,CAAW,KAAA,CAAA,CAAOY,QAAQ,CAACF,GAAAA,CAAAA;AAE/C,YAAA,IAAIC,KAAAA,EAAO;gBACT,MAAM,EAAEE,EAAE,EAAE,GAAGF,KAAAA;;AAGf,gBAAA,IAAIE,OAAOC,SAAAA,EAAW;oBACpB,OAAO;wBAAEC,aAAAA,EAAe;;AAChC,gBAAA;AAEM,gBAAA,MAAMC,IAAAA,GAAO,MAAMhB,UAAAA,CAAW,MAAA,CAAA,CAAQiB,sBAAsB,CAACJ,EAAAA,CAAAA;;AAG7D,gBAAA,IAAI,CAACG,IAAAA,EAAM;oBACT,OAAO;wBAAEE,KAAAA,EAAO;;AACxB,gBAAA;AAEM,gBAAA,MAAMC,mBAAmB,MAAMjB,mBAAAA,EAAAA;;AAG/B,gBAAA,IAAIiB,iBAAiBC,kBAAkB,IAAI,CAACJ,IAAAA,CAAKK,SAAS,EAAE;oBAC1D,OAAO;wBAAEH,KAAAA,EAAO;;AACxB,gBAAA;;gBAGM,IAAIF,IAAAA,CAAKM,OAAO,EAAE;oBAChB,OAAO;wBAAEJ,KAAAA,EAAO;;AACxB,gBAAA;;gBAGM,MAAMK,WAAAA,GAAc,MAAMC,OAAAA,CAAQC,OAAO,CAACT,IAAAA,CAAKU,IAAI,CAACb,EAAE,CAAA,CACnDc,IAAI,CAAC3B,UAAAA,CAAW,cAAc4B,mBAAmB,CAAA,CACjDD,IAAI,CAACnC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc6B,sBAAsB,CAAA,CAAA;;gBAG3D,MAAMC,OAAAA,GAAU,MAAM3B,MAAAA,CAAO4B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACV,WAAAA,CAAAA;gBAE3Eb,GAAAA,CAAIwB,KAAK,CAAClB,IAAI,GAAGA,IAAAA;gBAEjB,OAAO;oBACLD,aAAAA,EAAe,IAAA;oBACfoB,WAAAA,EAAanB,IAAAA;AACbc,oBAAAA;AACR,iBAAA;AACA,YAAA;YAEI,MAAMM,iBAAAA,GAAoB,MAAMpC,UAAAA,CAAW,YAAA,CAAA,CACxCqC,qBAAqB,EAAA,CACrBV,IAAI,CAACnC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc6B,sBAAsB,CAAA,CAAA;YAE3D,IAAIO,iBAAAA,CAAkBE,MAAM,KAAK,CAAA,EAAG;gBAClC,OAAO;oBAAEvB,aAAAA,EAAe;;AAC9B,YAAA;YAEI,MAAMe,OAAAA,GAAU,MAAM3B,MAAAA,CAAO4B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACG,iBAAAA,CAAAA;YAE3E,OAAO;gBACLrB,aAAAA,EAAe,IAAA;gBACfoB,WAAAA,EAAa,IAAA;AACbL,gBAAAA;AACN,aAAA;AACA,QAAA,CAAA,CAAI,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAExB,aAAAA,EAAe;;AAC5B,QAAA;AACA,IAAA,CAAA;IAEA,MAAMyB,MAAAA,GAAS,OAAOC,IAAAA,EAAMC,MAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEP,WAAAA,EAAanB,IAAI,EAAEc,OAAO,EAAE,GAAGW,IAAAA;QAEvC,IAAI,CAACC,MAAAA,CAAOC,KAAK,EAAE;AACjB,YAAA,IAAI,CAAC3B,IAAAA,EAAM;;AAET,gBAAA,MAAM,IAAInB,iBAAAA,EAAAA;YAChB,CAAA,MAAW;;AAEL,gBAAA;AACN,YAAA;AACA,QAAA;;AAGE,QAAA,IAAI,CAACiC,OAAAA,EAAS;AACZ,YAAA,MAAM,IAAIjC,iBAAAA,EAAAA;AACd,QAAA;QAEE,MAAM+C,SAAAA,GAAYlD;AAEhBH,QAAAA,SAAAA;AAEAE,QAAAA,KAAAA,CAAM,CAACkD,KAAAA,GAAUb,OAAAA,CAAQe,GAAG,CAACF,KAAAA,CAAAA,CAAAA,CAAAA,CAC7BD,OAAOC,KAAK,CAAA;AAEd,QAAA,IAAI,CAACC,SAAAA,EAAW;AACd,YAAA,MAAM,IAAIhD,cAAAA,EAAAA;AACd,QAAA;AACA,IAAA,CAAA;IAEAkD,gBAAAA,GAAiB;QACfxC,IAAAA,EAAM,mBAAA;AACNG,QAAAA,YAAAA;AACA+B,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"users-permissions.js","sources":["../../../server/strategies/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst { castArray, map, every, pipe } = require('lodash/fp');\nconst { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;\n\nconst { getService } = require('../utils');\n\nconst getAdvancedSettings = () => {\n  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });\n};\n\nconst authenticate = async (ctx) => {\n  try {\n    const token = await getService('jwt').getToken(ctx);\n\n    if (token) {\n      const { id, sessionId } = token;\n\n      // Invalid token\n      if (id === undefined) {\n        return { authenticated: false };\n      }\n\n      const user = await getService('user').fetchAuthenticatedUser(id);\n\n      // No user associated to the token\n      if (!user) {\n        return { error: 'Invalid credentials' };\n      }\n\n      const advancedSettings = await getAdvancedSettings();\n\n      // User not confirmed\n      if (advancedSettings.email_confirmation && !user.confirmed) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // User blocked\n      if (user.blocked) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // Fetch user's permissions\n      const permissions = await Promise.resolve(user.role.id)\n        .then(getService('permission').findRolePermissions)\n        .then(map(getService('permission').toContentAPIPermission));\n\n      // Generate an ability (content API engine) based on the given permissions\n      const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);\n\n      ctx.state.user = user;\n      // Expose the session backing this request (refresh mode only) so endpoints\n      // can flag the \"current\" session when listing active sessions.\n      if (sessionId) {\n        ctx.state.session = { id: sessionId };\n      }\n\n      return {\n        authenticated: true,\n        credentials: user,\n        ability,\n      };\n    }\n\n    const publicPermissions = await getService('permission')\n      .findPublicPermissions()\n      .then(map(getService('permission').toContentAPIPermission));\n\n    if (publicPermissions.length === 0) {\n      return { authenticated: false };\n    }\n\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(publicPermissions);\n\n    return {\n      authenticated: true,\n      credentials: null,\n      ability,\n    };\n  } catch (err) {\n    return { authenticated: false };\n  }\n};\n\nconst verify = async (auth, config) => {\n  const { credentials: user, ability } = auth;\n\n  if (!config.scope) {\n    if (!user) {\n      // A non authenticated user cannot access routes that do not have a scope\n      throw new UnauthorizedError();\n    } else {\n      // An authenticated user can access non scoped routes\n      return;\n    }\n  }\n\n  // If no ability have been generated, then consider auth is missing\n  if (!ability) {\n    throw new UnauthorizedError();\n  }\n\n  const isAllowed = pipe(\n    // Make sure we're dealing with an array\n    castArray,\n    // Transform the scope array into an action array\n    every((scope) => ability.can(scope))\n  )(config.scope);\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nmodule.exports = {\n  name: 'users-permissions',\n  authenticate,\n  verify,\n};\n"],"names":["castArray","map","every","pipe","require$$0","ForbiddenError","UnauthorizedError","require$$1","errors","getService","require$$2","getAdvancedSettings","strapi","store","type","name","get","key","authenticate","ctx","token","getToken","id","sessionId","undefined","authenticated","user","fetchAuthenticatedUser","error","advancedSettings","email_confirmation","confirmed","blocked","permissions","Promise","resolve","role","then","findRolePermissions","toContentAPIPermission","ability","contentAPI","engine","generateAbility","state","session","credentials","publicPermissions","findPublicPermissions","length","err","verify","auth","config","scope","isAllowed","can","usersPermissions"],"mappings":";;;;;;;;;;;;;;;;IAEA,MAAM,EAAEA,SAAS,EAAEC,GAAG,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,2BAAAA;AACxC,IAAA,MAAM,EAAEC,cAAc,EAAEC,iBAAiB,EAAE,GAAGC,4BAAyBC,MAAM;IAE7E,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB,IAAA;QAC1B,OAAOC,MAAAA,CAAOC,KAAK,CAAC;YAAEC,IAAAA,EAAM,QAAA;YAAUC,IAAAA,EAAM;AAAmB,SAAA,CAAA,CAAIC,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAU,SAAA,CAAA;AAC1F,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,OAAOC,GAAAA,GAAAA;QAC1B,IAAI;AACF,YAAA,MAAMC,KAAAA,GAAQ,MAAMX,UAAAA,CAAW,KAAA,CAAA,CAAOY,QAAQ,CAACF,GAAAA,CAAAA;AAE/C,YAAA,IAAIC,KAAAA,EAAO;AACT,gBAAA,MAAM,EAAEE,EAAE,EAAEC,SAAS,EAAE,GAAGH,KAAAA;;AAG1B,gBAAA,IAAIE,OAAOE,SAAAA,EAAW;oBACpB,OAAO;wBAAEC,aAAAA,EAAe;;AAChC,gBAAA;AAEM,gBAAA,MAAMC,IAAAA,GAAO,MAAMjB,UAAAA,CAAW,MAAA,CAAA,CAAQkB,sBAAsB,CAACL,EAAAA,CAAAA;;AAG7D,gBAAA,IAAI,CAACI,IAAAA,EAAM;oBACT,OAAO;wBAAEE,KAAAA,EAAO;;AACxB,gBAAA;AAEM,gBAAA,MAAMC,mBAAmB,MAAMlB,mBAAAA,EAAAA;;AAG/B,gBAAA,IAAIkB,iBAAiBC,kBAAkB,IAAI,CAACJ,IAAAA,CAAKK,SAAS,EAAE;oBAC1D,OAAO;wBAAEH,KAAAA,EAAO;;AACxB,gBAAA;;gBAGM,IAAIF,IAAAA,CAAKM,OAAO,EAAE;oBAChB,OAAO;wBAAEJ,KAAAA,EAAO;;AACxB,gBAAA;;gBAGM,MAAMK,WAAAA,GAAc,MAAMC,OAAAA,CAAQC,OAAO,CAACT,IAAAA,CAAKU,IAAI,CAACd,EAAE,CAAA,CACnDe,IAAI,CAAC5B,UAAAA,CAAW,cAAc6B,mBAAmB,CAAA,CACjDD,IAAI,CAACpC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc8B,sBAAsB,CAAA,CAAA;;gBAG3D,MAAMC,OAAAA,GAAU,MAAM5B,MAAAA,CAAO6B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACV,WAAAA,CAAAA;gBAE3Ed,GAAAA,CAAIyB,KAAK,CAAClB,IAAI,GAAGA,IAAAA;;;AAGjB,gBAAA,IAAIH,SAAAA,EAAW;oBACbJ,GAAAA,CAAIyB,KAAK,CAACC,OAAO,GAAG;wBAAEvB,EAAAA,EAAIC;AAAS,qBAAA;AAC3C,gBAAA;gBAEM,OAAO;oBACLE,aAAAA,EAAe,IAAA;oBACfqB,WAAAA,EAAapB,IAAAA;AACbc,oBAAAA;AACR,iBAAA;AACA,YAAA;YAEI,MAAMO,iBAAAA,GAAoB,MAAMtC,UAAAA,CAAW,YAAA,CAAA,CACxCuC,qBAAqB,EAAA,CACrBX,IAAI,CAACpC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc8B,sBAAsB,CAAA,CAAA;YAE3D,IAAIQ,iBAAAA,CAAkBE,MAAM,KAAK,CAAA,EAAG;gBAClC,OAAO;oBAAExB,aAAAA,EAAe;;AAC9B,YAAA;YAEI,MAAMe,OAAAA,GAAU,MAAM5B,MAAAA,CAAO6B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACI,iBAAAA,CAAAA;YAE3E,OAAO;gBACLtB,aAAAA,EAAe,IAAA;gBACfqB,WAAAA,EAAa,IAAA;AACbN,gBAAAA;AACN,aAAA;AACA,QAAA,CAAA,CAAI,OAAOU,GAAAA,EAAK;YACZ,OAAO;gBAAEzB,aAAAA,EAAe;;AAC5B,QAAA;AACA,IAAA,CAAA;IAEA,MAAM0B,MAAAA,GAAS,OAAOC,IAAAA,EAAMC,MAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEP,WAAAA,EAAapB,IAAI,EAAEc,OAAO,EAAE,GAAGY,IAAAA;QAEvC,IAAI,CAACC,MAAAA,CAAOC,KAAK,EAAE;AACjB,YAAA,IAAI,CAAC5B,IAAAA,EAAM;;AAET,gBAAA,MAAM,IAAIpB,iBAAAA,EAAAA;YAChB,CAAA,MAAW;;AAEL,gBAAA;AACN,YAAA;AACA,QAAA;;AAGE,QAAA,IAAI,CAACkC,OAAAA,EAAS;AACZ,YAAA,MAAM,IAAIlC,iBAAAA,EAAAA;AACd,QAAA;QAEE,MAAMiD,SAAAA,GAAYpD;AAEhBH,QAAAA,SAAAA;AAEAE,QAAAA,KAAAA,CAAM,CAACoD,KAAAA,GAAUd,OAAAA,CAAQgB,GAAG,CAACF,KAAAA,CAAAA,CAAAA,CAAAA,CAC7BD,OAAOC,KAAK,CAAA;AAEd,QAAA,IAAI,CAACC,SAAAA,EAAW;AACd,YAAA,MAAM,IAAIlD,cAAAA,EAAAA;AACd,QAAA;AACA,IAAA,CAAA;IAEAoD,gBAAAA,GAAiB;QACf1C,IAAAA,EAAM,mBAAA;AACNG,QAAAA,YAAAA;AACAiC,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/strategies/users-permissions.mjs

@@ -22,7 +22,7 @@ function requireUsersPermissions() {
         try {
             const token = await getService('jwt').getToken(ctx);
             if (token) {
-                const { id } = token;
+                const { id, sessionId } = token;
                 // Invalid token
                 if (id === undefined) {
                     return {
@@ -54,6 +54,13 @@ function requireUsersPermissions() {
                 // Generate an ability (content API engine) based on the given permissions
                 const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);
                 ctx.state.user = user;
+                // Expose the session backing this request (refresh mode only) so endpoints
+                // can flag the "current" session when listing active sessions.
+                if (sessionId) {
+                    ctx.state.session = {
+                        id: sessionId
+                    };
+                }
                 return {
                     authenticated: true,
                     credentials: user,

package/dist/server/strategies/users-permissions.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"users-permissions.mjs","sources":["../../../server/strategies/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst { castArray, map, every, pipe } = require('lodash/fp');\nconst { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;\n\nconst { getService } = require('../utils');\n\nconst getAdvancedSettings = () => {\n  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });\n};\n\nconst authenticate = async (ctx) => {\n  try {\n    const token = await getService('jwt').getToken(ctx);\n\n    if (token) {\n      const { id } = token;\n\n      // Invalid token\n      if (id === undefined) {\n        return { authenticated: false };\n      }\n\n      const user = await getService('user').fetchAuthenticatedUser(id);\n\n      // No user associated to the token\n      if (!user) {\n        return { error: 'Invalid credentials' };\n      }\n\n      const advancedSettings = await getAdvancedSettings();\n\n      // User not confirmed\n      if (advancedSettings.email_confirmation && !user.confirmed) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // User blocked\n      if (user.blocked) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // Fetch user's permissions\n      const permissions = await Promise.resolve(user.role.id)\n        .then(getService('permission').findRolePermissions)\n        .then(map(getService('permission').toContentAPIPermission));\n\n      // Generate an ability (content API engine) based on the given permissions\n      const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);\n\n      ctx.state.user = user;\n\n      return {\n        authenticated: true,\n        credentials: user,\n        ability,\n      };\n    }\n\n    const publicPermissions = await getService('permission')\n      .findPublicPermissions()\n      .then(map(getService('permission').toContentAPIPermission));\n\n    if (publicPermissions.length === 0) {\n      return { authenticated: false };\n    }\n\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(publicPermissions);\n\n    return {\n      authenticated: true,\n      credentials: null,\n      ability,\n    };\n  } catch (err) {\n    return { authenticated: false };\n  }\n};\n\nconst verify = async (auth, config) => {\n  const { credentials: user, ability } = auth;\n\n  if (!config.scope) {\n    if (!user) {\n      // A non authenticated user cannot access routes that do not have a scope\n      throw new UnauthorizedError();\n    } else {\n      // An authenticated user can access non scoped routes\n      return;\n    }\n  }\n\n  // If no ability have been generated, then consider auth is missing\n  if (!ability) {\n    throw new UnauthorizedError();\n  }\n\n  const isAllowed = pipe(\n    // Make sure we're dealing with an array\n    castArray,\n    // Transform the scope array into an action array\n    every((scope) => ability.can(scope))\n  )(config.scope);\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nmodule.exports = {\n  name: 'users-permissions',\n  authenticate,\n  verify,\n};\n"],"names":["castArray","map","every","pipe","require$$0","ForbiddenError","UnauthorizedError","require$$1","errors","getService","require$$2","getAdvancedSettings","strapi","store","type","name","get","key","authenticate","ctx","token","getToken","id","undefined","authenticated","user","fetchAuthenticatedUser","error","advancedSettings","email_confirmation","confirmed","blocked","permissions","Promise","resolve","role","then","findRolePermissions","toContentAPIPermission","ability","contentAPI","engine","generateAbility","state","credentials","publicPermissions","findPublicPermissions","length","err","verify","auth","config","scope","isAllowed","can","usersPermissions"],"mappings":";;;;;;;;;IAEA,MAAM,EAAEA,SAAS,EAAEC,GAAG,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,UAAAA;AACxC,IAAA,MAAM,EAAEC,cAAc,EAAEC,iBAAiB,EAAE,GAAGC,WAAyBC,MAAM;IAE7E,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB,IAAA;QAC1B,OAAOC,MAAAA,CAAOC,KAAK,CAAC;YAAEC,IAAAA,EAAM,QAAA;YAAUC,IAAAA,EAAM;AAAmB,SAAA,CAAA,CAAIC,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAU,SAAA,CAAA;AAC1F,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,OAAOC,GAAAA,GAAAA;QAC1B,IAAI;AACF,YAAA,MAAMC,KAAAA,GAAQ,MAAMX,UAAAA,CAAW,KAAA,CAAA,CAAOY,QAAQ,CAACF,GAAAA,CAAAA;AAE/C,YAAA,IAAIC,KAAAA,EAAO;gBACT,MAAM,EAAEE,EAAE,EAAE,GAAGF,KAAAA;;AAGf,gBAAA,IAAIE,OAAOC,SAAAA,EAAW;oBACpB,OAAO;wBAAEC,aAAAA,EAAe;;AAChC,gBAAA;AAEM,gBAAA,MAAMC,IAAAA,GAAO,MAAMhB,UAAAA,CAAW,MAAA,CAAA,CAAQiB,sBAAsB,CAACJ,EAAAA,CAAAA;;AAG7D,gBAAA,IAAI,CAACG,IAAAA,EAAM;oBACT,OAAO;wBAAEE,KAAAA,EAAO;;AACxB,gBAAA;AAEM,gBAAA,MAAMC,mBAAmB,MAAMjB,mBAAAA,EAAAA;;AAG/B,gBAAA,IAAIiB,iBAAiBC,kBAAkB,IAAI,CAACJ,IAAAA,CAAKK,SAAS,EAAE;oBAC1D,OAAO;wBAAEH,KAAAA,EAAO;;AACxB,gBAAA;;gBAGM,IAAIF,IAAAA,CAAKM,OAAO,EAAE;oBAChB,OAAO;wBAAEJ,KAAAA,EAAO;;AACxB,gBAAA;;gBAGM,MAAMK,WAAAA,GAAc,MAAMC,OAAAA,CAAQC,OAAO,CAACT,IAAAA,CAAKU,IAAI,CAACb,EAAE,CAAA,CACnDc,IAAI,CAAC3B,UAAAA,CAAW,cAAc4B,mBAAmB,CAAA,CACjDD,IAAI,CAACnC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc6B,sBAAsB,CAAA,CAAA;;gBAG3D,MAAMC,OAAAA,GAAU,MAAM3B,MAAAA,CAAO4B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACV,WAAAA,CAAAA;gBAE3Eb,GAAAA,CAAIwB,KAAK,CAAClB,IAAI,GAAGA,IAAAA;gBAEjB,OAAO;oBACLD,aAAAA,EAAe,IAAA;oBACfoB,WAAAA,EAAanB,IAAAA;AACbc,oBAAAA;AACR,iBAAA;AACA,YAAA;YAEI,MAAMM,iBAAAA,GAAoB,MAAMpC,UAAAA,CAAW,YAAA,CAAA,CACxCqC,qBAAqB,EAAA,CACrBV,IAAI,CAACnC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc6B,sBAAsB,CAAA,CAAA;YAE3D,IAAIO,iBAAAA,CAAkBE,MAAM,KAAK,CAAA,EAAG;gBAClC,OAAO;oBAAEvB,aAAAA,EAAe;;AAC9B,YAAA;YAEI,MAAMe,OAAAA,GAAU,MAAM3B,MAAAA,CAAO4B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACG,iBAAAA,CAAAA;YAE3E,OAAO;gBACLrB,aAAAA,EAAe,IAAA;gBACfoB,WAAAA,EAAa,IAAA;AACbL,gBAAAA;AACN,aAAA;AACA,QAAA,CAAA,CAAI,OAAOS,GAAAA,EAAK;YACZ,OAAO;gBAAExB,aAAAA,EAAe;;AAC5B,QAAA;AACA,IAAA,CAAA;IAEA,MAAMyB,MAAAA,GAAS,OAAOC,IAAAA,EAAMC,MAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEP,WAAAA,EAAanB,IAAI,EAAEc,OAAO,EAAE,GAAGW,IAAAA;QAEvC,IAAI,CAACC,MAAAA,CAAOC,KAAK,EAAE;AACjB,YAAA,IAAI,CAAC3B,IAAAA,EAAM;;AAET,gBAAA,MAAM,IAAInB,iBAAAA,EAAAA;YAChB,CAAA,MAAW;;AAEL,gBAAA;AACN,YAAA;AACA,QAAA;;AAGE,QAAA,IAAI,CAACiC,OAAAA,EAAS;AACZ,YAAA,MAAM,IAAIjC,iBAAAA,EAAAA;AACd,QAAA;QAEE,MAAM+C,SAAAA,GAAYlD;AAEhBH,QAAAA,SAAAA;AAEAE,QAAAA,KAAAA,CAAM,CAACkD,KAAAA,GAAUb,OAAAA,CAAQe,GAAG,CAACF,KAAAA,CAAAA,CAAAA,CAAAA,CAC7BD,OAAOC,KAAK,CAAA;AAEd,QAAA,IAAI,CAACC,SAAAA,EAAW;AACd,YAAA,MAAM,IAAIhD,cAAAA,EAAAA;AACd,QAAA;AACA,IAAA,CAAA;IAEAkD,gBAAAA,GAAiB;QACfxC,IAAAA,EAAM,mBAAA;AACNG,QAAAA,YAAAA;AACA+B,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"users-permissions.mjs","sources":["../../../server/strategies/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst { castArray, map, every, pipe } = require('lodash/fp');\nconst { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;\n\nconst { getService } = require('../utils');\n\nconst getAdvancedSettings = () => {\n  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });\n};\n\nconst authenticate = async (ctx) => {\n  try {\n    const token = await getService('jwt').getToken(ctx);\n\n    if (token) {\n      const { id, sessionId } = token;\n\n      // Invalid token\n      if (id === undefined) {\n        return { authenticated: false };\n      }\n\n      const user = await getService('user').fetchAuthenticatedUser(id);\n\n      // No user associated to the token\n      if (!user) {\n        return { error: 'Invalid credentials' };\n      }\n\n      const advancedSettings = await getAdvancedSettings();\n\n      // User not confirmed\n      if (advancedSettings.email_confirmation && !user.confirmed) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // User blocked\n      if (user.blocked) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // Fetch user's permissions\n      const permissions = await Promise.resolve(user.role.id)\n        .then(getService('permission').findRolePermissions)\n        .then(map(getService('permission').toContentAPIPermission));\n\n      // Generate an ability (content API engine) based on the given permissions\n      const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);\n\n      ctx.state.user = user;\n      // Expose the session backing this request (refresh mode only) so endpoints\n      // can flag the \"current\" session when listing active sessions.\n      if (sessionId) {\n        ctx.state.session = { id: sessionId };\n      }\n\n      return {\n        authenticated: true,\n        credentials: user,\n        ability,\n      };\n    }\n\n    const publicPermissions = await getService('permission')\n      .findPublicPermissions()\n      .then(map(getService('permission').toContentAPIPermission));\n\n    if (publicPermissions.length === 0) {\n      return { authenticated: false };\n    }\n\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(publicPermissions);\n\n    return {\n      authenticated: true,\n      credentials: null,\n      ability,\n    };\n  } catch (err) {\n    return { authenticated: false };\n  }\n};\n\nconst verify = async (auth, config) => {\n  const { credentials: user, ability } = auth;\n\n  if (!config.scope) {\n    if (!user) {\n      // A non authenticated user cannot access routes that do not have a scope\n      throw new UnauthorizedError();\n    } else {\n      // An authenticated user can access non scoped routes\n      return;\n    }\n  }\n\n  // If no ability have been generated, then consider auth is missing\n  if (!ability) {\n    throw new UnauthorizedError();\n  }\n\n  const isAllowed = pipe(\n    // Make sure we're dealing with an array\n    castArray,\n    // Transform the scope array into an action array\n    every((scope) => ability.can(scope))\n  )(config.scope);\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nmodule.exports = {\n  name: 'users-permissions',\n  authenticate,\n  verify,\n};\n"],"names":["castArray","map","every","pipe","require$$0","ForbiddenError","UnauthorizedError","require$$1","errors","getService","require$$2","getAdvancedSettings","strapi","store","type","name","get","key","authenticate","ctx","token","getToken","id","sessionId","undefined","authenticated","user","fetchAuthenticatedUser","error","advancedSettings","email_confirmation","confirmed","blocked","permissions","Promise","resolve","role","then","findRolePermissions","toContentAPIPermission","ability","contentAPI","engine","generateAbility","state","session","credentials","publicPermissions","findPublicPermissions","length","err","verify","auth","config","scope","isAllowed","can","usersPermissions"],"mappings":";;;;;;;;;IAEA,MAAM,EAAEA,SAAS,EAAEC,GAAG,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,UAAAA;AACxC,IAAA,MAAM,EAAEC,cAAc,EAAEC,iBAAiB,EAAE,GAAGC,WAAyBC,MAAM;IAE7E,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB,IAAA;QAC1B,OAAOC,MAAAA,CAAOC,KAAK,CAAC;YAAEC,IAAAA,EAAM,QAAA;YAAUC,IAAAA,EAAM;AAAmB,SAAA,CAAA,CAAIC,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAU,SAAA,CAAA;AAC1F,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,OAAOC,GAAAA,GAAAA;QAC1B,IAAI;AACF,YAAA,MAAMC,KAAAA,GAAQ,MAAMX,UAAAA,CAAW,KAAA,CAAA,CAAOY,QAAQ,CAACF,GAAAA,CAAAA;AAE/C,YAAA,IAAIC,KAAAA,EAAO;AACT,gBAAA,MAAM,EAAEE,EAAE,EAAEC,SAAS,EAAE,GAAGH,KAAAA;;AAG1B,gBAAA,IAAIE,OAAOE,SAAAA,EAAW;oBACpB,OAAO;wBAAEC,aAAAA,EAAe;;AAChC,gBAAA;AAEM,gBAAA,MAAMC,IAAAA,GAAO,MAAMjB,UAAAA,CAAW,MAAA,CAAA,CAAQkB,sBAAsB,CAACL,EAAAA,CAAAA;;AAG7D,gBAAA,IAAI,CAACI,IAAAA,EAAM;oBACT,OAAO;wBAAEE,KAAAA,EAAO;;AACxB,gBAAA;AAEM,gBAAA,MAAMC,mBAAmB,MAAMlB,mBAAAA,EAAAA;;AAG/B,gBAAA,IAAIkB,iBAAiBC,kBAAkB,IAAI,CAACJ,IAAAA,CAAKK,SAAS,EAAE;oBAC1D,OAAO;wBAAEH,KAAAA,EAAO;;AACxB,gBAAA;;gBAGM,IAAIF,IAAAA,CAAKM,OAAO,EAAE;oBAChB,OAAO;wBAAEJ,KAAAA,EAAO;;AACxB,gBAAA;;gBAGM,MAAMK,WAAAA,GAAc,MAAMC,OAAAA,CAAQC,OAAO,CAACT,IAAAA,CAAKU,IAAI,CAACd,EAAE,CAAA,CACnDe,IAAI,CAAC5B,UAAAA,CAAW,cAAc6B,mBAAmB,CAAA,CACjDD,IAAI,CAACpC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc8B,sBAAsB,CAAA,CAAA;;gBAG3D,MAAMC,OAAAA,GAAU,MAAM5B,MAAAA,CAAO6B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACV,WAAAA,CAAAA;gBAE3Ed,GAAAA,CAAIyB,KAAK,CAAClB,IAAI,GAAGA,IAAAA;;;AAGjB,gBAAA,IAAIH,SAAAA,EAAW;oBACbJ,GAAAA,CAAIyB,KAAK,CAACC,OAAO,GAAG;wBAAEvB,EAAAA,EAAIC;AAAS,qBAAA;AAC3C,gBAAA;gBAEM,OAAO;oBACLE,aAAAA,EAAe,IAAA;oBACfqB,WAAAA,EAAapB,IAAAA;AACbc,oBAAAA;AACR,iBAAA;AACA,YAAA;YAEI,MAAMO,iBAAAA,GAAoB,MAAMtC,UAAAA,CAAW,YAAA,CAAA,CACxCuC,qBAAqB,EAAA,CACrBX,IAAI,CAACpC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc8B,sBAAsB,CAAA,CAAA;YAE3D,IAAIQ,iBAAAA,CAAkBE,MAAM,KAAK,CAAA,EAAG;gBAClC,OAAO;oBAAExB,aAAAA,EAAe;;AAC9B,YAAA;YAEI,MAAMe,OAAAA,GAAU,MAAM5B,MAAAA,CAAO6B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACI,iBAAAA,CAAAA;YAE3E,OAAO;gBACLtB,aAAAA,EAAe,IAAA;gBACfqB,WAAAA,EAAa,IAAA;AACbN,gBAAAA;AACN,aAAA;AACA,QAAA,CAAA,CAAI,OAAOU,GAAAA,EAAK;YACZ,OAAO;gBAAEzB,aAAAA,EAAe;;AAC5B,QAAA;AACA,IAAA,CAAA;IAEA,MAAM0B,MAAAA,GAAS,OAAOC,IAAAA,EAAMC,MAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEP,WAAAA,EAAapB,IAAI,EAAEc,OAAO,EAAE,GAAGY,IAAAA;QAEvC,IAAI,CAACC,MAAAA,CAAOC,KAAK,EAAE;AACjB,YAAA,IAAI,CAAC5B,IAAAA,EAAM;;AAET,gBAAA,MAAM,IAAIpB,iBAAAA,EAAAA;YAChB,CAAA,MAAW;;AAEL,gBAAA;AACN,YAAA;AACA,QAAA;;AAGE,QAAA,IAAI,CAACkC,OAAAA,EAAS;AACZ,YAAA,MAAM,IAAIlC,iBAAAA,EAAAA;AACd,QAAA;QAEE,MAAMiD,SAAAA,GAAYpD;AAEhBH,QAAAA,SAAAA;AAEAE,QAAAA,KAAAA,CAAM,CAACoD,KAAAA,GAAUd,OAAAA,CAAQgB,GAAG,CAACF,KAAAA,CAAAA,CAAAA,CAAAA,CAC7BD,OAAOC,KAAK,CAAA;AAEd,QAAA,IAAI,CAACC,SAAAA,EAAW;AACd,YAAA,MAAM,IAAIlD,cAAAA,EAAAA;AACd,QAAA;AACA,IAAA,CAAA;IAEAoD,gBAAAA,GAAiB;QACf1C,IAAAA,EAAM,mBAAA;AACNG,QAAAA,YAAAA;AACAiC,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/refresh-cookie-options.js

@@ -0,0 +1,27 @@
+'use strict';
+
+var refreshCookieOptions;
+var hasRequiredRefreshCookieOptions;
+function requireRefreshCookieOptions() {
+    if (hasRequiredRefreshCookieOptions) return refreshCookieOptions;
+    hasRequiredRefreshCookieOptions = 1;
+    const buildRefreshCookieOptions = (upSessions, isProduction)=>{
+        const isSecure = typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;
+        return {
+            httpOnly: true,
+            secure: isSecure,
+            sameSite: upSessions.cookie?.sameSite ?? 'lax',
+            path: upSessions.cookie?.path ?? '/',
+            domain: upSessions.cookie?.domain,
+            maxAge: upSessions.cookie?.maxAge,
+            overwrite: true
+        };
+    };
+    refreshCookieOptions = {
+        buildRefreshCookieOptions
+    };
+    return refreshCookieOptions;
+}
+
+exports.__require = requireRefreshCookieOptions;
+//# sourceMappingURL=refresh-cookie-options.js.map

package/dist/server/utils/refresh-cookie-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-cookie-options.js","sources":["../../../server/utils/refresh-cookie-options.js"],"sourcesContent":["'use strict';\n\nconst buildRefreshCookieOptions = (upSessions, isProduction) => {\n  const isSecure =\n    typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    sameSite: upSessions.cookie?.sameSite ?? 'lax',\n    path: upSessions.cookie?.path ?? '/',\n    domain: upSessions.cookie?.domain,\n    maxAge: upSessions.cookie?.maxAge,\n    overwrite: true,\n  };\n};\n\nmodule.exports = {\n  buildRefreshCookieOptions,\n};\n"],"names":["buildRefreshCookieOptions","upSessions","isProduction","isSecure","cookie","secure","httpOnly","sameSite","path","domain","maxAge","overwrite","refreshCookieOptions"],"mappings":";;;;;;;IAEA,MAAMA,yBAAAA,GAA4B,CAACC,UAAAA,EAAYC,YAAAA,GAAAA;QAC7C,MAAMC,QAAAA,GACJ,OAAOF,UAAAA,CAAWG,MAAM,EAAEC,WAAW,SAAA,GAAYJ,UAAAA,CAAWG,MAAM,EAAEC,MAAAA,GAASH,YAAAA;QAE/E,OAAO;YACLI,QAAAA,EAAU,IAAA;YACVD,MAAAA,EAAQF,QAAAA;YACRI,QAAAA,EAAUN,UAAAA,CAAWG,MAAM,EAAEG,QAAAA,IAAY,KAAA;YACzCC,IAAAA,EAAMP,UAAAA,CAAWG,MAAM,EAAEI,IAAAA,IAAQ,GAAA;YACjCC,MAAAA,EAAQR,UAAAA,CAAWG,MAAM,EAAEK,MAAAA;YAC3BC,MAAAA,EAAQT,UAAAA,CAAWG,MAAM,EAAEM,MAAAA;YAC3BC,SAAAA,EAAW;AACf,SAAA;AACA,IAAA,CAAA;IAEAC,oBAAAA,GAAiB;AACfZ,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/refresh-cookie-options.mjs

@@ -0,0 +1,25 @@
+var refreshCookieOptions;
+var hasRequiredRefreshCookieOptions;
+function requireRefreshCookieOptions() {
+    if (hasRequiredRefreshCookieOptions) return refreshCookieOptions;
+    hasRequiredRefreshCookieOptions = 1;
+    const buildRefreshCookieOptions = (upSessions, isProduction)=>{
+        const isSecure = typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;
+        return {
+            httpOnly: true,
+            secure: isSecure,
+            sameSite: upSessions.cookie?.sameSite ?? 'lax',
+            path: upSessions.cookie?.path ?? '/',
+            domain: upSessions.cookie?.domain,
+            maxAge: upSessions.cookie?.maxAge,
+            overwrite: true
+        };
+    };
+    refreshCookieOptions = {
+        buildRefreshCookieOptions
+    };
+    return refreshCookieOptions;
+}
+
+export { requireRefreshCookieOptions as __require };
+//# sourceMappingURL=refresh-cookie-options.mjs.map

package/dist/server/utils/refresh-cookie-options.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-cookie-options.mjs","sources":["../../../server/utils/refresh-cookie-options.js"],"sourcesContent":["'use strict';\n\nconst buildRefreshCookieOptions = (upSessions, isProduction) => {\n  const isSecure =\n    typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    sameSite: upSessions.cookie?.sameSite ?? 'lax',\n    path: upSessions.cookie?.path ?? '/',\n    domain: upSessions.cookie?.domain,\n    maxAge: upSessions.cookie?.maxAge,\n    overwrite: true,\n  };\n};\n\nmodule.exports = {\n  buildRefreshCookieOptions,\n};\n"],"names":["buildRefreshCookieOptions","upSessions","isProduction","isSecure","cookie","secure","httpOnly","sameSite","path","domain","maxAge","overwrite","refreshCookieOptions"],"mappings":";;;;;IAEA,MAAMA,yBAAAA,GAA4B,CAACC,UAAAA,EAAYC,YAAAA,GAAAA;QAC7C,MAAMC,QAAAA,GACJ,OAAOF,UAAAA,CAAWG,MAAM,EAAEC,WAAW,SAAA,GAAYJ,UAAAA,CAAWG,MAAM,EAAEC,MAAAA,GAASH,YAAAA;QAE/E,OAAO;YACLI,QAAAA,EAAU,IAAA;YACVD,MAAAA,EAAQF,QAAAA;YACRI,QAAAA,EAAUN,UAAAA,CAAWG,MAAM,EAAEG,QAAAA,IAAY,KAAA;YACzCC,IAAAA,EAAMP,UAAAA,CAAWG,MAAM,EAAEI,IAAAA,IAAQ,GAAA;YACjCC,MAAAA,EAAQR,UAAAA,CAAWG,MAAM,EAAEK,MAAAA;YAC3BC,MAAAA,EAAQT,UAAAA,CAAWG,MAAM,EAAEM,MAAAA;YAC3BC,SAAAA,EAAW;AACf,SAAA;AACA,IAAA,CAAA;IAEAC,oBAAAA,GAAiB;AACfZ,QAAAA;AACF,KAAA;;;;;;"}

package/lint-staged.config.mjs

@@ -0,0 +1 @@
+export { default } from '../../../lint-staged.shared.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/plugin-users-permissions",
-  "version": "5.49.0",
+  "version": "5.50.0",
   "description": "Protect your API with a full-authentication process based on JWT",
   "homepage": "https://strapi.io",
   "bugs": {
@@ -53,9 +53,9 @@
     "watch": "run -T rollup -c -w"
   },
   "dependencies": {
-    "@strapi/design-system": "2.2.0",
-    "@strapi/icons": "2.2.0",
-    "@strapi/utils": "5.49.0",
+    "@strapi/design-system": "2.2.1",
+    "@strapi/icons": "2.2.1",
+    "@strapi/utils": "5.50.0",
     "bcryptjs": "2.4.3",
     "formik": "2.4.5",
     "grant": "5.4.24",
@@ -75,7 +75,7 @@
     "zod": "3.25.67"
   },
   "devDependencies": {
-    "@strapi/strapi": "5.49.0",
+    "@strapi/strapi": "5.50.0",
     "@testing-library/dom": "10.4.1",
     "@testing-library/react": "16.3.2",
     "@testing-library/user-event": "14.6.1",

package/rollup.config.mjs

@@ -1,5 +1,5 @@
 import { defineConfig } from 'rollup';
-import {  baseConfig } from '../../../rollup.utils.mjs';
+import { baseConfig } from '../../../rollup.utils.mjs';
 
 export default defineConfig([
   baseConfig({
@@ -11,9 +11,9 @@ export default defineConfig([
   }),
   baseConfig({
     input: {
-      index: './server/index.js'
+      index: './server/index.js',
     },
     rootDir: './server',
     outDir: './dist/server',
-  })
+  }),
 ]);

package/server/controllers/auth.js

@@ -12,6 +12,7 @@ const _ = require('lodash');
 const { concat, compact, isArray } = require('lodash/fp');
 const utils = require('@strapi/utils');
 const { getService } = require('../utils');
+const { buildRefreshCookieOptions } = require('../utils/refresh-cookie-options');
 const {
   validateCallbackBody,
   validateRegisterBody,
@@ -23,6 +24,7 @@ const {
 } = require('./validation/auth');
 
 const { ApplicationError, ValidationError, ForbiddenError } = utils.errors;
+const { buildSessionMetadata, sanitizeSessionEntry, sortSessionsForDisplay } = utils;
 
 const sanitizeUser = (user, ctx) => {
   const { auth } = ctx.state;
@@ -37,6 +39,102 @@ const extractDeviceId = (requestBody) => {
   return typeof deviceId === 'string' && deviceId.length > 0 ? deviceId : undefined;
 };
 
+const buildSessionMetadataFromContext = (ctx) =>
+  buildSessionMetadata({
+    userAgent: ctx.request.headers['user-agent'],
+  });
+
+const sendRefreshAuthResponse = async (strapi, ctx, user, { metadata } = {}) => {
+  const deviceId = extractDeviceId(ctx.request.body);
+  const tokenOptions = { type: 'refresh', ...(metadata ? { metadata } : {}) };
+
+  const refresh = await strapi
+    .sessionManager('users-permissions')
+    .generateRefreshToken(String(user.id), deviceId, tokenOptions);
+
+  const access = await strapi
+    .sessionManager('users-permissions')
+    .generateAccessToken(refresh.token);
+  if ('error' in access) {
+    throw new ApplicationError('Invalid credentials');
+  }
+
+  const upSessions = strapi.config.get('plugin::users-permissions.sessions');
+  const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
+
+  if (upSessions?.httpOnly || requestHttpOnly) {
+    const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
+    const isProduction = process.env.NODE_ENV === 'production';
+    ctx.cookies.set(cookieName, refresh.token, buildRefreshCookieOptions(upSessions, isProduction));
+    return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });
+  }
+
+  return ctx.send({
+    jwt: access.token,
+    refreshToken: refresh.token,
+    user: await sanitizeUser(user, ctx),
+  });
+};
+
+const reissueTokensAfterPasswordChange = async (strapi, ctx, user) => {
+  const deviceId = extractDeviceId(ctx.request.body);
+
+  await strapi.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));
+
+  const newDeviceId = deviceId || crypto.randomUUID();
+  const refresh = await strapi
+    .sessionManager('users-permissions')
+    .generateRefreshToken(String(user.id), newDeviceId, { type: 'refresh' });
+
+  const access = await strapi
+    .sessionManager('users-permissions')
+    .generateAccessToken(refresh.token);
+  if ('error' in access) {
+    throw new ApplicationError('Invalid credentials');
+  }
+
+  return ctx.send({
+    jwt: access.token,
+    refreshToken: refresh.token,
+    user: await sanitizeUser(user, ctx),
+  });
+};
+
+const revokeLogoutSessions = async (strapi, ctx, userId, { scope, deviceId, body }) => {
+  const sessionManager = strapi.sessionManager('users-permissions');
+  const upSessions = strapi.config.get('plugin::users-permissions.sessions');
+
+  if (scope === 'all') {
+    await sessionManager.invalidateRefreshToken(userId);
+    return;
+  }
+
+  if (deviceId) {
+    await sessionManager.invalidateRefreshToken(userId, deviceId);
+    return;
+  }
+
+  let currentSessionId = ctx.state.session?.id;
+  const cookieName = upSessions?.cookie?.name || 'strapi_up_refresh';
+  const refreshToken =
+    ctx.cookies.get(cookieName) ||
+    (typeof body.refreshToken === 'string' ? body.refreshToken : undefined);
+
+  if (refreshToken) {
+    const validation = await sessionManager.validateRefreshToken(refreshToken);
+    if (validation.isValid) {
+      currentSessionId = validation.sessionId;
+    }
+  }
+
+  if (currentSessionId) {
+    await sessionManager.revokeSessionById(userId, currentSessionId);
+    return;
+  }
+
+  await sessionManager.invalidateRefreshToken(userId);
+};
+
 module.exports = ({ strapi }) => ({
   async callback(ctx) {
     const provider = ctx.params.provider || 'local';
@@ -94,46 +192,8 @@ module.exports = ({ strapi }) => ({
 
       const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
       if (mode === 'refresh') {
-        const deviceId = extractDeviceId(ctx.request.body);
-
-        const refresh = await strapi
-          .sessionManager('users-permissions')
-          .generateRefreshToken(String(user.id), deviceId, { type: 'refresh' });
-
-        const access = await strapi
-          .sessionManager('users-permissions')
-          .generateAccessToken(refresh.token);
-        if ('error' in access) {
-          throw new ApplicationError('Invalid credentials');
-        }
-
-        const upSessions = strapi.config.get('plugin::users-permissions.sessions');
-        const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
-        if (upSessions?.httpOnly || requestHttpOnly) {
-          const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
-          const isProduction = process.env.NODE_ENV === 'production';
-          const isSecure =
-            typeof upSessions.cookie?.secure === 'boolean'
-              ? upSessions.cookie?.secure
-              : isProduction;
-
-          const cookieOptions = {
-            httpOnly: true,
-            secure: isSecure,
-            sameSite: upSessions.cookie?.sameSite ?? 'lax',
-            path: upSessions.cookie?.path ?? '/',
-            domain: upSessions.cookie?.domain,
-            overwrite: true,
-          };
-
-          ctx.cookies.set(cookieName, refresh.token, cookieOptions);
-          return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });
-        }
-
-        return ctx.send({
-          jwt: access.token,
-          refreshToken: refresh.token,
-          user: await sanitizeUser(user, ctx),
+        return sendRefreshAuthResponse(strapi, ctx, user, {
+          metadata: buildSessionMetadataFromContext(ctx),
         });
       }
 
@@ -153,44 +213,8 @@ module.exports = ({ strapi }) => ({
 
       const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
       if (mode === 'refresh') {
-        const deviceId = extractDeviceId(ctx.request.body);
-
-        const refresh = await strapi
-          .sessionManager('users-permissions')
-          .generateRefreshToken(String(user.id), deviceId, { type: 'refresh' });
-
-        const access = await strapi
-          .sessionManager('users-permissions')
-          .generateAccessToken(refresh.token);
-        if ('error' in access) {
-          throw new ApplicationError('Invalid credentials');
-        }
-
-        const upSessions = strapi.config.get('plugin::users-permissions.sessions');
-        const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
-        if (upSessions?.httpOnly || requestHttpOnly) {
-          const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
-          const isProduction = process.env.NODE_ENV === 'production';
-          const isSecure =
-            typeof upSessions.cookie?.secure === 'boolean'
-              ? upSessions.cookie?.secure
-              : isProduction;
-
-          const cookieOptions = {
-            httpOnly: true,
-            secure: isSecure,
-            sameSite: upSessions.cookie?.sameSite ?? 'lax',
-            path: upSessions.cookie?.path ?? '/',
-            domain: upSessions.cookie?.domain,
-            overwrite: true,
-          };
-          ctx.cookies.set(cookieName, refresh.token, cookieOptions);
-          return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });
-        }
-        return ctx.send({
-          jwt: access.token,
-          refreshToken: refresh.token,
-          user: await sanitizeUser(user, ctx),
+        return sendRefreshAuthResponse(strapi, ctx, user, {
+          metadata: buildSessionMetadataFromContext(ctx),
         });
       }
 
@@ -233,28 +257,7 @@ module.exports = ({ strapi }) => ({
 
     const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
     if (mode === 'refresh') {
-      const deviceId = extractDeviceId(ctx.request.body);
-
-      // Invalidate all sessions when password changes for security
-      await strapi.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));
-
-      const newDeviceId = deviceId || crypto.randomUUID();
-      const refresh = await strapi
-        .sessionManager('users-permissions')
-        .generateRefreshToken(String(user.id), newDeviceId, { type: 'refresh' });
-
-      const access = await strapi
-        .sessionManager('users-permissions')
-        .generateAccessToken(refresh.token);
-      if ('error' in access) {
-        throw new ApplicationError('Invalid credentials');
-      }
-
-      return ctx.send({
-        jwt: access.token,
-        refreshToken: refresh.token,
-        user: await sanitizeUser(user, ctx),
-      });
+      return reissueTokensAfterPasswordChange(strapi, ctx, user);
     }
 
     return ctx.send({
@@ -290,28 +293,7 @@ module.exports = ({ strapi }) => ({
 
     const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
     if (mode === 'refresh') {
-      const deviceId = extractDeviceId(ctx.request.body);
-
-      // Invalidate all sessions when password is reset for security
-      await strapi.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));
-
-      const newDeviceId = deviceId || crypto.randomUUID();
-      const refresh = await strapi
-        .sessionManager('users-permissions')
-        .generateRefreshToken(String(user.id), newDeviceId, { type: 'refresh' });
-
-      const access = await strapi
-        .sessionManager('users-permissions')
-        .generateAccessToken(refresh.token);
-      if ('error' in access) {
-        throw new ApplicationError('Invalid credentials');
-      }
-
-      return ctx.send({
-        jwt: access.token,
-        refreshToken: refresh.token,
-        user: await sanitizeUser(user, ctx),
-      });
+      return reissueTokensAfterPasswordChange(strapi, ctx, user);
     }
 
     return ctx.send({
@@ -355,18 +337,11 @@ module.exports = ({ strapi }) => ({
     const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
     if (upSessions?.httpOnly || requestHttpOnly) {
       const isProduction = process.env.NODE_ENV === 'production';
-      const isSecure =
-        typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;
-
-      const cookieOptions = {
-        httpOnly: true,
-        secure: isSecure,
-        sameSite: upSessions.cookie?.sameSite ?? 'lax',
-        path: upSessions.cookie?.path ?? '/',
-        domain: upSessions.cookie?.domain,
-        overwrite: true,
-      };
-      ctx.cookies.set(cookieName, rotation.token, cookieOptions);
+      ctx.cookies.set(
+        cookieName,
+        rotation.token,
+        buildRefreshCookieOptions(upSessions, isProduction)
+      );
       return ctx.send({ jwt: result.token });
     }
     return ctx.send({ jwt: result.token, refreshToken: rotation.token });
@@ -377,21 +352,22 @@ module.exports = ({ strapi }) => ({
       return ctx.notFound();
     }
 
-    // Invalidate all sessions for the authenticated user, or by deviceId if provided
     if (!ctx.state.user) {
       return ctx.unauthorized('Missing authentication');
     }
 
-    const deviceId = extractDeviceId(ctx.request.body);
+    const userId = String(ctx.state.user.id);
+    const upSessions = strapi.config.get('plugin::users-permissions.sessions');
+    const body = ctx.request.body || {};
+    const scope = typeof body.scope === 'string' ? body.scope : undefined;
+    const deviceId = extractDeviceId(body);
+
     try {
-      await strapi
-        .sessionManager('users-permissions')
-        .invalidateRefreshToken(String(ctx.state.user.id), deviceId);
+      await revokeLogoutSessions(strapi, ctx, userId, { scope, deviceId, body });
     } catch (err) {
       strapi.log.error('UP logout failed', err);
     }
 
-    const upSessions = strapi.config.get('plugin::users-permissions.sessions');
     const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
     if (upSessions?.httpOnly || requestHttpOnly) {
       const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
@@ -399,6 +375,48 @@ module.exports = ({ strapi }) => ({
     }
     return ctx.send({ ok: true });
   },
+  async getSessions(ctx) {
+    const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+    if (mode !== 'refresh') {
+      return ctx.notFound();
+    }
+
+    if (!ctx.state.user) {
+      return ctx.unauthorized('Missing authentication');
+    }
+
+    const currentSessionId = ctx.state.session?.id;
+    const sessions = await strapi
+      .sessionManager('users-permissions')
+      .listSessions(String(ctx.state.user.id));
+
+    const data = sortSessionsForDisplay(
+      sessions.map((session) => sanitizeSessionEntry(session, currentSessionId))
+    );
+
+    return ctx.send({ data });
+  },
+  async revokeSession(ctx) {
+    const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+    if (mode !== 'refresh') {
+      return ctx.notFound();
+    }
+
+    if (!ctx.state.user) {
+      return ctx.unauthorized('Missing authentication');
+    }
+
+    const { sessionId } = ctx.params;
+    const revoked = await strapi
+      .sessionManager('users-permissions')
+      .revokeSessionById(String(ctx.state.user.id), sessionId);
+
+    if (!revoked) {
+      return ctx.notFound('Session not found');
+    }
+
+    return ctx.send({ data: {} });
+  },
   async connect(ctx, next) {
     const grant = require('grant').koa();
 
@@ -617,7 +635,10 @@ module.exports = ({ strapi }) => ({
 
       const refresh = await strapi
         .sessionManager('users-permissions')
-        .generateRefreshToken(String(user.id), deviceId, { type: 'refresh' });
+        .generateRefreshToken(String(user.id), deviceId, {
+          type: 'refresh',
+          metadata: buildSessionMetadataFromContext(ctx),
+        });
 
       const access = await strapi
         .sessionManager('users-permissions')