@strapi/plugin-users-permissions 5.52.2 → 5.53.0

package/dist/server/services/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sources":["../../../server/src/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize } = require('@strapi/utils');\nconst { toNumber, getOr } = require('lodash/fp');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    return strapi.db.query(USER_MODEL_UID).count({ where: params });\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","require$$3","toNumber","getOr","require$$4","getService","require$$5","USER_MODEL_UID","getSessionManager","manager","strapi","sessionManager","user","count","params","db","query","where","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","id","select","update","documentId","fetch","get","transform","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,2BAAAA;IAEhB,MAAM,EAAEC,QAAQ,EAAE,GAAGC,2BAAAA;AACrB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,KAAK,EAAE,GAAGC,2BAAAA;IAC5B,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMC,MAAM,EAAA;AACV,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgBM,KAAK,CAAC;oBAAEI,KAAAA,EAAOH;;AAC1D,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMI,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaV,OAAAA,CAAOW,QAAQ,CAACd,gBAAgBa,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAAStB,QAAAA,CAASC,KAAAA,CAAM,IAAI,mBAAA,EAAqBiB,UAAU,CAACE,GAAAA,CAAI,CAAA,CAAA;wBACtEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM1B,MAAAA,CAAO6B,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOT,OAAAA,CAAOiB,SAAS,CAACpB,cAAAA,CAAAA,CAAgBqB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAElB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMmB,KAAAA,GAAQ,MAAMvB,OAAAA,CAAOK,EAAA,CACxBC,KAAK,CAACT,cAAAA,CAAAA,CACN2B,OAAO,CAAC;oBAAEjB,KAAAA,EAAO;wBAAEkB,EAAAA,EAAIH;AAAM,qBAAA;oBAAII,MAAAA,EAAQ;AAAC,wBAAA;AAAa;;AAE1D,gBAAA,IAAI,CAACH,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOvB,OAAAA,CAAOiB,SAAS,CAACpB,cAAAA,CAAAA,CAAgB8B,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYL,MAAMK,UAAU;oBAC5BT,IAAAA,EAAMf,MAAAA;oBACNgB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIES,KAAAA,CAAAA,CAAMJ,EAAE,EAAErB,MAAM,EAAA;gBACd,MAAME,KAAAA,GAAQN,QAAO8B,GAAG,CAAC,gBAAgBC,SAAS,CAAClC,cAAAA,EAAgBO,MAAAA,IAAU;AAE7E,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2B,OAAO,CAAC;AAC7C,oBAAA,GAAGlB,KAAK;oBACRC,KAAAA,EAAO;wBACLyB,IAAAA,EAAM;AAAC,4BAAA;AAAEP,gCAAAA;AAAE,6BAAA;4BAAInB,KAAAA,CAAMC,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACE0B,wBAAuBR,EAAE,EAAA;AACvB,gBAAA,OAAOzB,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2B,OAAO,CAAC;oBAAEjB,KAAAA,EAAO;AAAEkB,wBAAAA;AAAE,qBAAA;oBAAIL,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEc,UAAS9B,MAAM,EAAA;gBACb,MAAME,KAAAA,GAAQN,QAAO8B,GAAG,CAAC,gBAAgBC,SAAS,CAAClC,cAAAA,EAAgBO,MAAAA,IAAU;AAE7E,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgBsC,QAAQ,CAAC7B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM8B,QAAOhC,MAAM,EAAA;;AAEjB,gBAAA,MAAMH,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAeoC,SAAS,CAAC,mBAAA,CAAA,IAAwBjC,MAAAA,CAAOqB,EAAE,EAAE;AAChF,oBAAA,MAAMxB,eAAe,mBAAA,CAAA,CAAqBqC,sBAAsB,CAACC,MAAAA,CAAOnC,OAAOqB,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAOzB,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2C,MAAM,CAAC;oBAAEjC,KAAAA,EAAOH;;AAC3D,YAAA,CAAA;YAEEqC,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE3B,IAAI,EAAA;gBAC7B,OAAO7B,MAAAA,CAAOyD,OAAO,CAACD,QAAAA,EAAU3B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM6B,uBAAsB1C,IAAI,EAAA;AAC9B,gBAAA,MAAM2C,wBAAwBlD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMmD,WAAAA,GAAc,MAAM9C,OAAAA,CAAO+C,KAAK,CAAC;oBAAElC,IAAAA,EAAM,QAAA;oBAAUmC,IAAAA,EAAM;;gBAC/D,MAAMC,UAAAA,GAAajD,OAAAA,CAAOW,QAAQ,CAACd,cAAAA,CAAAA;AAEnC,gBAAA,MAAMqD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBhB,GAAG,CAAC;oBAAElB,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAClBuC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMjE,QAAAA,CAASkE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRtC,oBAAAA,QAAAA,EAAUX,OAAAA,CAAOW,QAAQ,CAACgD,IAAI,CAAC3D,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAM0D,oBAAoB5E,MAAAA,CAAO6E,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACzC,IAAI,CAACnB,IAAAA,CAAKuB,EAAE,EAAE;AAAEmC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY/D,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACFoB,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAK/E,QACHY,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,uBAClBiC,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYpE,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,oBAAA,CAAA;AAC9BuC,wBAAAA,SAAAA,EAAWrE,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,mBAAA,CAAA;wBAC7BwC,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNvD,OAAAA,CAAOyE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAM1E,OAAAA,CACH2E,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI5E,KAAK6E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAA,GACjC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAA,GAC/CE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}
+{"version":3,"file":"user.js","sources":["../../../server/src/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require('@strapi/utils');\nconst { toNumber, getOr, pick } = require('lodash/fp');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst pickAllowedQueryParams = pick(ALLOWED_QUERY_PARAM_KEYS);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).count(query);\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","ALLOWED_QUERY_PARAM_KEYS","require$$3","toNumber","getOr","pick","require$$4","getService","require$$5","USER_MODEL_UID","pickAllowedQueryParams","getSessionManager","manager","strapi","sessionManager","user","count","params","query","get","transform","db","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","where","id","select","update","documentId","fetch","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,2BAAAA;AAEhB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,wBAAwB,EAAE,GAAGC,2BAAAA;AAC/C,IAAA,MAAM,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,2BAAAA;IAClC,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,yBAAyBL,IAAAA,CAAKJ,wBAAAA,CAAAA;AAEpC,IAAA,MAAMU,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMC,MAAM,EAAA;gBACV,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgBO,KAAK,CAACE,KAAAA,CAAAA;AACjD,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMI,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaX,OAAAA,CAAOY,QAAQ,CAAChB,gBAAgBe,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAASzB,QAAAA,CAASC,KAAAA,CAAM,IAAI,mBAAA,EAAqBoB,UAAU,CAACE,GAAAA,CAAI,CAAA,CAAA;wBACtEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM9B,MAAAA,CAAOiC,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOV,OAAAA,CAAOkB,SAAS,CAACtB,cAAAA,CAAAA,CAAgBuB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAEnB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMoB,KAAAA,GAAQ,MAAMxB,OAAAA,CAAOQ,EAAA,CACxBH,KAAK,CAACT,cAAAA,CAAAA,CACN6B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEC,EAAAA,EAAIJ;AAAM,qBAAA;oBAAIK,MAAAA,EAAQ;AAAC,wBAAA;AAAa;;AAE1D,gBAAA,IAAI,CAACJ,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOxB,OAAAA,CAAOkB,SAAS,CAACtB,cAAAA,CAAAA,CAAgBiC,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYN,MAAMM,UAAU;oBAC5BV,IAAAA,EAAMhB,MAAAA;oBACNiB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIEU,KAAAA,CAAAA,CAAMJ,EAAE,EAAEvB,MAAM,EAAA;gBACd,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB6B,OAAO,CAAC;AAC7C,oBAAA,GAAGpB,KAAK;oBACRqB,KAAAA,EAAO;wBACLM,IAAAA,EAAM;AAAC,4BAAA;AAAEL,gCAAAA;AAAE,6BAAA;4BAAItB,KAAAA,CAAMqB,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACEO,wBAAuBN,EAAE,EAAA;AACvB,gBAAA,OAAO3B,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB6B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEC,wBAAAA;AAAE,qBAAA;oBAAIN,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEa,UAAS9B,MAAM,EAAA;gBACb,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgBuC,QAAQ,CAAC9B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM+B,QAAOhC,MAAM,EAAA;;AAEjB,gBAAA,MAAMH,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAeoC,SAAS,CAAC,mBAAA,CAAA,IAAwBjC,MAAAA,CAAOuB,EAAE,EAAE;AAChF,oBAAA,MAAM1B,eAAe,mBAAA,CAAA,CAAqBqC,sBAAsB,CAACC,MAAAA,CAAOnC,OAAOuB,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAO3B,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB4C,MAAM,CAAC;oBAAEd,KAAAA,EAAOtB;;AAC3D,YAAA,CAAA;YAEEqC,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE1B,IAAI,EAAA;gBAC7B,OAAOjC,MAAAA,CAAO4D,OAAO,CAACD,QAAAA,EAAU1B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM4B,uBAAsB1C,IAAI,EAAA;AAC9B,gBAAA,MAAM2C,wBAAwBnD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMoD,WAAAA,GAAc,MAAM9C,OAAAA,CAAO+C,KAAK,CAAC;oBAAEjC,IAAAA,EAAM,QAAA;oBAAUkC,IAAAA,EAAM;;gBAC/D,MAAMC,UAAAA,GAAajD,OAAAA,CAAOY,QAAQ,CAAChB,cAAAA,CAAAA;AAEnC,gBAAA,MAAMsD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBxC,GAAG,CAAC;oBAAEO,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAClBsC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMpE,QAAAA,CAASqE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRrC,oBAAAA,QAAAA,EAAUZ,OAAAA,CAAOY,QAAQ,CAAC+C,IAAI,CAAC3D,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAM0D,oBAAoB/E,MAAAA,CAAOgF,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACxC,IAAI,CAACpB,IAAAA,CAAKyB,EAAE,EAAE;AAAEiC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY/D,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACF4C,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAKlF,QACHe,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,uBAClByD,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYpE,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,oBAAA,CAAA;AAC9B+D,wBAAAA,SAAAA,EAAWrE,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,mBAAA,CAAA;wBAC7BgE,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNvD,OAAAA,CAAOyE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAM1E,OAAAA,CACH2E,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI5E,KAAK6E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAA,GACjC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAA,GAC/CE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}

package/dist/server/services/user.mjs

@@ -17,10 +17,11 @@ function requireUser() {
 	 */ const crypto = require$$0$1;
     const bcrypt = require$$1$1;
     const urlJoin = require$$2;
-    const { sanitize } = require$$1;
-    const { toNumber, getOr } = require$$0;
+    const { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require$$1;
+    const { toNumber, getOr, pick } = require$$0;
     const { getService } = requireUtils();
     const USER_MODEL_UID = 'plugin::users-permissions.user';
+    const pickAllowedQueryParams = pick(ALLOWED_QUERY_PARAM_KEYS);
     const getSessionManager = ()=>{
         const manager = strapi.sessionManager;
         return manager ?? null;
@@ -31,9 +32,8 @@ function requireUser() {
 	   *
 	   * @return {Promise}
 	   */ count (params) {
-                return strapi1.db.query(USER_MODEL_UID).count({
-                    where: params
-                });
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
+                return strapi1.db.query(USER_MODEL_UID).count(query);
             },
             /**
 	   * Hashes password fields in the provided values object if they are present.
@@ -102,7 +102,7 @@ function requireUser() {
 	   * Promise to fetch a/an user.
 	   * @return {Promise}
 	   */ fetch (id, params) {
-                const query = strapi1.get('query-params').transform(USER_MODEL_UID, params ?? {});
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
                 return strapi1.db.query(USER_MODEL_UID).findOne({
                     ...query,
                     where: {
@@ -132,7 +132,7 @@ function requireUser() {
 	   * Promise to fetch all users.
 	   * @return {Promise}
 	   */ fetchAll (params) {
-                const query = strapi1.get('query-params').transform(USER_MODEL_UID, params ?? {});
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
                 return strapi1.db.query(USER_MODEL_UID).findMany(query);
             },
             /**

package/dist/server/services/user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"user.mjs","sources":["../../../server/src/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize } = require('@strapi/utils');\nconst { toNumber, getOr } = require('lodash/fp');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    return strapi.db.query(USER_MODEL_UID).count({ where: params });\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","require$$3","toNumber","getOr","require$$4","getService","require$$5","USER_MODEL_UID","getSessionManager","manager","strapi","sessionManager","user","count","params","db","query","where","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","id","select","update","documentId","fetch","get","transform","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,UAAAA;IAEhB,MAAM,EAAEC,QAAQ,EAAE,GAAGC,UAAAA;AACrB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,KAAK,EAAE,GAAGC,UAAAA;IAC5B,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMC,MAAM,EAAA;AACV,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgBM,KAAK,CAAC;oBAAEI,KAAAA,EAAOH;;AAC1D,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMI,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaV,OAAAA,CAAOW,QAAQ,CAACd,gBAAgBa,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAAStB,QAAAA,CAASC,KAAAA,CAAM,IAAI,mBAAA,EAAqBiB,UAAU,CAACE,GAAAA,CAAI,CAAA,CAAA;wBACtEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM1B,MAAAA,CAAO6B,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOT,OAAAA,CAAOiB,SAAS,CAACpB,cAAAA,CAAAA,CAAgBqB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAElB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMmB,KAAAA,GAAQ,MAAMvB,OAAAA,CAAOK,EAAA,CACxBC,KAAK,CAACT,cAAAA,CAAAA,CACN2B,OAAO,CAAC;oBAAEjB,KAAAA,EAAO;wBAAEkB,EAAAA,EAAIH;AAAM,qBAAA;oBAAII,MAAAA,EAAQ;AAAC,wBAAA;AAAa;;AAE1D,gBAAA,IAAI,CAACH,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOvB,OAAAA,CAAOiB,SAAS,CAACpB,cAAAA,CAAAA,CAAgB8B,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYL,MAAMK,UAAU;oBAC5BT,IAAAA,EAAMf,MAAAA;oBACNgB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIES,KAAAA,CAAAA,CAAMJ,EAAE,EAAErB,MAAM,EAAA;gBACd,MAAME,KAAAA,GAAQN,QAAO8B,GAAG,CAAC,gBAAgBC,SAAS,CAAClC,cAAAA,EAAgBO,MAAAA,IAAU;AAE7E,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2B,OAAO,CAAC;AAC7C,oBAAA,GAAGlB,KAAK;oBACRC,KAAAA,EAAO;wBACLyB,IAAAA,EAAM;AAAC,4BAAA;AAAEP,gCAAAA;AAAE,6BAAA;4BAAInB,KAAAA,CAAMC,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACE0B,wBAAuBR,EAAE,EAAA;AACvB,gBAAA,OAAOzB,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2B,OAAO,CAAC;oBAAEjB,KAAAA,EAAO;AAAEkB,wBAAAA;AAAE,qBAAA;oBAAIL,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEc,UAAS9B,MAAM,EAAA;gBACb,MAAME,KAAAA,GAAQN,QAAO8B,GAAG,CAAC,gBAAgBC,SAAS,CAAClC,cAAAA,EAAgBO,MAAAA,IAAU;AAE7E,gBAAA,OAAOJ,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgBsC,QAAQ,CAAC7B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM8B,QAAOhC,MAAM,EAAA;;AAEjB,gBAAA,MAAMH,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAeoC,SAAS,CAAC,mBAAA,CAAA,IAAwBjC,MAAAA,CAAOqB,EAAE,EAAE;AAChF,oBAAA,MAAMxB,eAAe,mBAAA,CAAA,CAAqBqC,sBAAsB,CAACC,MAAAA,CAAOnC,OAAOqB,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAOzB,QAAOK,EAAE,CAACC,KAAK,CAACT,cAAAA,CAAAA,CAAgB2C,MAAM,CAAC;oBAAEjC,KAAAA,EAAOH;;AAC3D,YAAA,CAAA;YAEEqC,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE3B,IAAI,EAAA;gBAC7B,OAAO7B,MAAAA,CAAOyD,OAAO,CAACD,QAAAA,EAAU3B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM6B,uBAAsB1C,IAAI,EAAA;AAC9B,gBAAA,MAAM2C,wBAAwBlD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMmD,WAAAA,GAAc,MAAM9C,OAAAA,CAAO+C,KAAK,CAAC;oBAAElC,IAAAA,EAAM,QAAA;oBAAUmC,IAAAA,EAAM;;gBAC/D,MAAMC,UAAAA,GAAajD,OAAAA,CAAOW,QAAQ,CAACd,cAAAA,CAAAA;AAEnC,gBAAA,MAAMqD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBhB,GAAG,CAAC;oBAAElB,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAClBuC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMjE,QAAAA,CAASkE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRtC,oBAAAA,QAAAA,EAAUX,OAAAA,CAAOW,QAAQ,CAACgD,IAAI,CAAC3D,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAM0D,oBAAoB5E,MAAAA,CAAO6E,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACzC,IAAI,CAACnB,IAAAA,CAAKuB,EAAE,EAAE;AAAEmC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY/D,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACFoB,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAK/E,QACHY,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,uBAClBiC,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYpE,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,oBAAA,CAAA;AAC9BuC,wBAAAA,SAAAA,EAAWrE,OAAAA,CAAOgE,MAAM,CAAClC,GAAG,CAAC,mBAAA,CAAA;wBAC7BwC,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNvD,OAAAA,CAAOyE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAM1E,OAAAA,CACH2E,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI5E,KAAK6E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAA,GACjC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAA,GAC/CE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}
+{"version":3,"file":"user.mjs","sources":["../../../server/src/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require('@strapi/utils');\nconst { toNumber, getOr, pick } = require('lodash/fp');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst pickAllowedQueryParams = pick(ALLOWED_QUERY_PARAM_KEYS);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).count(query);\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","ALLOWED_QUERY_PARAM_KEYS","require$$3","toNumber","getOr","pick","require$$4","getService","require$$5","USER_MODEL_UID","pickAllowedQueryParams","getSessionManager","manager","strapi","sessionManager","user","count","params","query","get","transform","db","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","where","id","select","update","documentId","fetch","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,UAAAA;AAEhB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,wBAAwB,EAAE,GAAGC,UAAAA;AAC/C,IAAA,MAAM,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,UAAAA;IAClC,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,yBAAyBL,IAAAA,CAAKJ,wBAAAA,CAAAA;AAEpC,IAAA,MAAMU,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMC,MAAM,EAAA;gBACV,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgBO,KAAK,CAACE,KAAAA,CAAAA;AACjD,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMI,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaX,OAAAA,CAAOY,QAAQ,CAAChB,gBAAgBe,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAASzB,QAAAA,CAASC,KAAAA,CAAM,IAAI,mBAAA,EAAqBoB,UAAU,CAACE,GAAAA,CAAI,CAAA,CAAA;wBACtEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM9B,MAAAA,CAAOiC,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOV,OAAAA,CAAOkB,SAAS,CAACtB,cAAAA,CAAAA,CAAgBuB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAEnB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMoB,KAAAA,GAAQ,MAAMxB,OAAAA,CAAOQ,EAAA,CACxBH,KAAK,CAACT,cAAAA,CAAAA,CACN6B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEC,EAAAA,EAAIJ;AAAM,qBAAA;oBAAIK,MAAAA,EAAQ;AAAC,wBAAA;AAAa;;AAE1D,gBAAA,IAAI,CAACJ,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOxB,OAAAA,CAAOkB,SAAS,CAACtB,cAAAA,CAAAA,CAAgBiC,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYN,MAAMM,UAAU;oBAC5BV,IAAAA,EAAMhB,MAAAA;oBACNiB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIEU,KAAAA,CAAAA,CAAMJ,EAAE,EAAEvB,MAAM,EAAA;gBACd,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB6B,OAAO,CAAC;AAC7C,oBAAA,GAAGpB,KAAK;oBACRqB,KAAAA,EAAO;wBACLM,IAAAA,EAAM;AAAC,4BAAA;AAAEL,gCAAAA;AAAE,6BAAA;4BAAItB,KAAAA,CAAMqB,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACEO,wBAAuBN,EAAE,EAAA;AACvB,gBAAA,OAAO3B,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB6B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEC,wBAAAA;AAAE,qBAAA;oBAAIN,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEa,UAAS9B,MAAM,EAAA;gBACb,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgBuC,QAAQ,CAAC9B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM+B,QAAOhC,MAAM,EAAA;;AAEjB,gBAAA,MAAMH,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAeoC,SAAS,CAAC,mBAAA,CAAA,IAAwBjC,MAAAA,CAAOuB,EAAE,EAAE;AAChF,oBAAA,MAAM1B,eAAe,mBAAA,CAAA,CAAqBqC,sBAAsB,CAACC,MAAAA,CAAOnC,OAAOuB,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAO3B,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB4C,MAAM,CAAC;oBAAEd,KAAAA,EAAOtB;;AAC3D,YAAA,CAAA;YAEEqC,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE1B,IAAI,EAAA;gBAC7B,OAAOjC,MAAAA,CAAO4D,OAAO,CAACD,QAAAA,EAAU1B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM4B,uBAAsB1C,IAAI,EAAA;AAC9B,gBAAA,MAAM2C,wBAAwBnD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMoD,WAAAA,GAAc,MAAM9C,OAAAA,CAAO+C,KAAK,CAAC;oBAAEjC,IAAAA,EAAM,QAAA;oBAAUkC,IAAAA,EAAM;;gBAC/D,MAAMC,UAAAA,GAAajD,OAAAA,CAAOY,QAAQ,CAAChB,cAAAA,CAAAA;AAEnC,gBAAA,MAAMsD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBxC,GAAG,CAAC;oBAAEO,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAClBsC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMpE,QAAAA,CAASqE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRrC,oBAAAA,QAAAA,EAAUZ,OAAAA,CAAOY,QAAQ,CAAC+C,IAAI,CAAC3D,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAM0D,oBAAoB/E,MAAAA,CAAOgF,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACxC,IAAI,CAACpB,IAAAA,CAAKyB,EAAE,EAAE;AAAEiC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY/D,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACF4C,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAKlF,QACHe,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,uBAClByD,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYpE,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,oBAAA,CAAA;AAC9B+D,wBAAAA,SAAAA,EAAWrE,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,mBAAA,CAAA;wBAC7BgE,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNvD,OAAAA,CAAOyE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAM1E,OAAAA,CACH2E,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI5E,KAAK6E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAA,GACjC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAA,GAC/CE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}

package/dist/server/utils/oauth-connect/index.js

@@ -4,6 +4,7 @@ var require$$1 = require('@strapi/utils');
 var providers = require('./providers.js');
 var oauth1 = require('./oauth1.js');
 var oauth2 = require('./oauth2.js');
+var trimGrantSessionResponse = require('../trim-grant-session-response.js');
 var index = require('../index.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -19,6 +20,7 @@ function requireOauthConnect() {
     const builtinProviderEndpoints = providers.__require();
     const oauth1$1 = oauth1.__require();
     const oauth2$1 = oauth2.__require();
+    const { trimGrantSessionResponse: trimGrantSessionResponse$1 } = trimGrantSessionResponse.__require();
     const CONNECT_PREFIX = '/connect';
     const parseConnectPath = (requestPath, apiPrefix)=>{
         const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;
@@ -89,6 +91,13 @@ function requireOauthConnect() {
             dynamic
         } : {};
     };
+    const redirectWithSessionResponse = (ctx, callbackUrl, provider, tokenResponse)=>{
+        const grantResponse = oauth2$1.tokensToQueryPayload(provider, tokenResponse);
+        ctx.session.grant = {
+            response: trimGrantSessionResponse$1(grantResponse, provider.name)
+        };
+        return redirectWithPayload(ctx, callbackUrl, {});
+    };
     const startOAuth1Flow = async (ctx, provider, parsed, redirectUri)=>{
         const requestToken = await oauth1$1.requestToken({
             requestUrl: provider.request_url,
@@ -135,9 +144,7 @@ function requireOauthConnect() {
             oauthVerifier,
             oauthTokenCredential: requestToken.oauth_token_secret
         });
-        const payload = oauth2$1.tokensToQueryPayload(provider, tokenResponse);
-        ctx.session.grant = {};
-        return redirectWithPayload(ctx, callbackUrl, payload);
+        return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
     };
     const handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri)=>{
         const session = ctx.session.grant || {};
@@ -163,9 +170,7 @@ function requireOauthConnect() {
             code,
             subdomain: provider.subdomain
         });
-        const payload = oauth2$1.tokensToQueryPayload(provider, tokenResponse);
-        ctx.session.grant = {};
-        return redirectWithPayload(ctx, callbackUrl, payload);
+        return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
     };
     const createOAuthConnectMiddleware = ()=>{
         return async (ctx, next)=>{

package/dist/server/utils/oauth-connect/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../../server/src/utils/oauth-connect/index.js"],"sourcesContent":["'use strict';\n\nconst { errors } = require('@strapi/utils');\n\nconst builtinProviderEndpoints = require('./providers');\nconst oauth1 = require('./oauth1');\nconst oauth2 = require('./oauth2');\n\nconst CONNECT_PREFIX = '/connect';\n\nconst parseConnectPath = (requestPath, apiPrefix) => {\n  const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;\n  if (!requestPath.startsWith(prefix)) {\n    return null;\n  }\n\n  const remainder = requestPath.slice(prefix.length);\n  const [provider, segment] = remainder.split('/').filter(Boolean);\n\n  if (!provider) {\n    return null;\n  }\n\n  return {\n    provider,\n    isCallback: segment === 'callback',\n  };\n};\n\n/**\n * Resolve OAuth endpoint config from built-ins, falling back to store-defined\n * endpoints so custom providers registered via providers-registry still work.\n */\nconst buildProviderConfig = (providerName, storedConfig, redirectUri) => {\n  const defaults = builtinProviderEndpoints[providerName];\n  const endpoints = defaults || {\n    oauth: storedConfig.oauth,\n    authorize_url: storedConfig.authorize_url,\n    access_url: storedConfig.access_url,\n    request_url: storedConfig.request_url,\n    scope_delimiter: storedConfig.scope_delimiter,\n    token_endpoint_auth_method: storedConfig.token_endpoint_auth_method,\n  };\n\n  if (endpoints.oauth === 1) {\n    if (!endpoints.request_url || !endpoints.authorize_url || !endpoints.access_url) {\n      return null;\n    }\n  } else if (!endpoints.authorize_url || !endpoints.access_url) {\n    return null;\n  }\n\n  return {\n    name: providerName,\n    ...endpoints,\n    key: storedConfig.key,\n    secret: storedConfig.secret,\n    scope: storedConfig.scope,\n    subdomain: storedConfig.subdomain,\n    callback: storedConfig.callback,\n    redirect_uri: redirectUri,\n  };\n};\n\nconst redirectWithPayload = (ctx, callbackUrl, payload) => {\n  const url = new URL(callbackUrl);\n  const params = new URLSearchParams();\n\n  Object.entries(payload).forEach(([key, value]) => {\n    if (key === 'raw') {\n      Object.entries(value).forEach(([rawKey, rawValue]) => {\n        params.set(`raw[${rawKey}]`, String(rawValue));\n      });\n      return;\n    }\n    if (value !== undefined && value !== null) {\n      params.set(key, String(value));\n    }\n  });\n\n  url.search = params.toString();\n  ctx.redirect(url.toString());\n};\n\nconst preserveGrantDynamic = (ctx) => {\n  const dynamic = ctx.session.grant?.dynamic;\n  return dynamic ? { dynamic } : {};\n};\n\nconst startOAuth1Flow = async (ctx, provider, parsed, redirectUri) => {\n  const requestToken = await oauth1.requestToken({\n    requestUrl: provider.request_url,\n    redirectUri,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n  });\n\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    request: requestToken,\n  };\n\n  const authorizeUrl = `${provider.authorize_url}?oauth_token=${encodeURIComponent(requestToken.oauth_token)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst startOAuth2Flow = (ctx, provider, parsed, redirectUri) => {\n  const state = oauth2.generateState();\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    state,\n  };\n\n  let authorizeUrl = oauth2.buildAuthorizeUrl(provider, {\n    key: provider.key,\n    redirectUri,\n    scope: provider.scope,\n    subdomain: provider.subdomain,\n  });\n\n  authorizeUrl += `&state=${encodeURIComponent(state)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst handleOAuth1Callback = async (ctx, provider, callbackUrl) => {\n  const session = ctx.session.grant || {};\n  const { oauth_token: oauthToken, oauth_verifier: oauthVerifier } = ctx.query;\n  const requestToken = session.request;\n\n  if (!requestToken?.oauth_token || oauthToken !== requestToken.oauth_token) {\n    throw new Error('OAuth1 token mismatch');\n  }\n\n  const tokenResponse = await oauth1.accessToken({\n    accessUrl: provider.access_url,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n    oauthToken,\n    oauthVerifier,\n    oauthTokenCredential: requestToken.oauth_token_secret,\n  });\n\n  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);\n  ctx.session.grant = {};\n  return redirectWithPayload(ctx, callbackUrl, payload);\n};\n\nconst handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) => {\n  const session = ctx.session.grant || {};\n  const { code, state: queryState, error, error_description: errorDescription } = ctx.query;\n\n  if (error) {\n    ctx.session.grant = {};\n    return redirectWithPayload(ctx, callbackUrl, {\n      error,\n      error_description: errorDescription,\n    });\n  }\n\n  if (!code) {\n    throw new Error('OAuth2 missing code parameter');\n  }\n\n  // Reject when session state is missing (not only on mismatch) to close login-CSRF.\n  if (!session.state || queryState !== session.state) {\n    throw new Error('OAuth2 state mismatch');\n  }\n\n  const tokenResponse = await oauth2.exchangeAuthorizationCode(provider, {\n    key: provider.key,\n    secret: provider.secret,\n    redirectUri,\n    code,\n    subdomain: provider.subdomain,\n  });\n\n  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);\n  ctx.session.grant = {};\n  return redirectWithPayload(ctx, callbackUrl, payload);\n};\n\nconst createOAuthConnectMiddleware = () => {\n  return async (ctx, next) => {\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n    const [requestPath] = ctx.request.url.split('?');\n    const parsed = parseConnectPath(requestPath, apiPrefix);\n\n    if (!parsed) {\n      return next();\n    }\n\n    if (!ctx.session) {\n      ctx.throw(400, 'OAuth connect requires session middleware');\n    }\n\n    const storedProviders = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n      .get();\n\n    const storedConfig = storedProviders?.[parsed.provider];\n    if (!storedConfig?.enabled) {\n      throw new errors.ApplicationError('This provider is disabled');\n    }\n\n    const { getService } = require('..');\n    const redirectUri = getService('providers').buildRedirectUri(parsed.provider);\n\n    const callbackOverride =\n      ctx.state.oauthConnect?.callback ?? ctx.session.grant?.dynamic?.callback;\n    const effectiveConfig = callbackOverride\n      ? { ...storedConfig, callback: callbackOverride }\n      : storedConfig;\n\n    const provider = buildProviderConfig(parsed.provider, effectiveConfig, redirectUri);\n\n    if (!provider) {\n      throw new errors.ApplicationError('Unknown OAuth provider');\n    }\n\n    ctx.session.grant = ctx.session.grant || {};\n\n    if (!parsed.isCallback) {\n      if (provider.oauth === 1) {\n        return startOAuth1Flow(ctx, provider, parsed, redirectUri);\n      }\n      return startOAuth2Flow(ctx, provider, parsed, redirectUri);\n    }\n\n    const callbackUrl = effectiveConfig.callback;\n    if (!callbackUrl) {\n      throw new errors.ApplicationError('Provider callback URL is not configured');\n    }\n\n    try {\n      if (provider.oauth === 1) {\n        return await handleOAuth1Callback(ctx, provider, callbackUrl);\n      }\n      return await handleOAuth2Callback(ctx, provider, callbackUrl, redirectUri);\n    } catch (err) {\n      ctx.session.grant = {};\n      return redirectWithPayload(ctx, callbackUrl, {\n        error: 'oauth_error',\n        error_description: err.message,\n      });\n    }\n  };\n};\n\nmodule.exports = {\n  createOAuthConnectMiddleware,\n  parseConnectPath,\n  buildProviderConfig,\n  redirectWithPayload,\n};\n"],"names":["errors","require$$0","builtinProviderEndpoints","require$$1","oauth1","require$$2","oauth2","require$$3","CONNECT_PREFIX","parseConnectPath","requestPath","apiPrefix","prefix","startsWith","remainder","slice","length","provider","segment","split","filter","Boolean","isCallback","buildProviderConfig","providerName","storedConfig","redirectUri","defaults","endpoints","oauth","authorize_url","access_url","request_url","scope_delimiter","token_endpoint_auth_method","name","key","secret","scope","subdomain","callback","redirect_uri","redirectWithPayload","ctx","callbackUrl","payload","url","URL","params","URLSearchParams","Object","entries","forEach","value","rawKey","rawValue","set","String","undefined","search","toString","redirect","preserveGrantDynamic","dynamic","session","grant","startOAuth1Flow","parsed","requestToken","requestUrl","consumerKey","clientCredential","request","authorizeUrl","encodeURIComponent","oauth_token","startOAuth2Flow","state","generateState","buildAuthorizeUrl","handleOAuth1Callback","oauthToken","oauth_verifier","oauthVerifier","query","Error","tokenResponse","accessToken","accessUrl","oauthTokenCredential","oauth_token_secret","tokensToQueryPayload","handleOAuth2Callback","code","queryState","error","error_description","errorDescription","exchangeAuthorizationCode","createOAuthConnectMiddleware","next","strapi","config","get","throw","storedProviders","store","type","enabled","ApplicationError","getService","require$$4","buildRedirectUri","callbackOverride","oauthConnect","effectiveConfig","err","message"],"mappings":";;;;;;;;;;;;;;;;;IAEA,MAAM,EAAEA,MAAM,EAAE,GAAGC,2BAAAA;AAEnB,IAAA,MAAMC,wBAAAA,GAA2BC,mBAAAA,EAAAA;AACjC,IAAA,MAAMC,QAAAA,GAASC,gBAAAA,EAAAA;AACf,IAAA,MAAMC,QAAAA,GAASC,gBAAAA,EAAAA;AAEf,IAAA,MAAMC,cAAAA,GAAiB,UAAA;IAEvB,MAAMC,gBAAAA,GAAmB,CAACC,WAAAA,EAAaC,SAAAA,GAAAA;AACrC,QAAA,MAAMC,MAAAA,GAAS,CAAA,EAAGD,SAAAA,CAAAA,EAAYH,cAAAA,CAAe,CAAC,CAAC;AAC/C,QAAA,IAAI,CAACE,WAAAA,CAAYG,UAAU,CAACD,MAAAA,CAAAA,EAAS;YACnC,OAAO,IAAA;AACX,QAAA;AAEE,QAAA,MAAME,SAAAA,GAAYJ,WAAAA,CAAYK,KAAK,CAACH,OAAOI,MAAM,CAAA;QACjD,MAAM,CAACC,UAAUC,OAAAA,CAAQ,GAAGJ,UAAUK,KAAK,CAAC,GAAA,CAAA,CAAKC,MAAM,CAACC,OAAAA,CAAAA;AAExD,QAAA,IAAI,CAACJ,QAAAA,EAAU;YACb,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;AACLA,YAAAA,QAAAA;AACAK,YAAAA,UAAAA,EAAYJ,OAAAA,KAAY;AAC5B,SAAA;AACA,IAAA,CAAA;AAEA;;;AAGA,KACA,MAAMK,mBAAAA,GAAsB,CAACC,YAAAA,EAAcC,YAAAA,EAAcC,WAAAA,GAAAA;QACvD,MAAMC,QAAAA,GAAWzB,wBAAwB,CAACsB,YAAAA,CAAa;AACvD,QAAA,MAAMI,YAAYD,QAAAA,IAAY;AAC5BE,YAAAA,KAAAA,EAAOJ,aAAaI,KAAK;AACzBC,YAAAA,aAAAA,EAAeL,aAAaK,aAAa;AACzCC,YAAAA,UAAAA,EAAYN,aAAaM,UAAU;AACnCC,YAAAA,WAAAA,EAAaP,aAAaO,WAAW;AACrCC,YAAAA,eAAAA,EAAiBR,aAAaQ,eAAe;AAC7CC,YAAAA,0BAAAA,EAA4BT,aAAaS;AAC7C,SAAA;QAEE,IAAIN,SAAAA,CAAUC,KAAK,KAAK,CAAA,EAAG;YACzB,IAAI,CAACD,SAAAA,CAAUI,WAAW,IAAI,CAACJ,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;gBAC/E,OAAO,IAAA;AACb,YAAA;QACA,CAAA,MAAS,IAAI,CAACH,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;YAC5D,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;YACLI,IAAAA,EAAMX,YAAAA;AACN,YAAA,GAAGI,SAAS;AACZQ,YAAAA,GAAAA,EAAKX,aAAaW,GAAG;AACrBC,YAAAA,MAAAA,EAAQZ,aAAaY,MAAM;AAC3BC,YAAAA,KAAAA,EAAOb,aAAaa,KAAK;AACzBC,YAAAA,SAAAA,EAAWd,aAAac,SAAS;AACjCC,YAAAA,QAAAA,EAAUf,aAAae,QAAQ;YAC/BC,YAAAA,EAAcf;AAClB,SAAA;AACA,IAAA,CAAA;IAEA,MAAMgB,mBAAAA,GAAsB,CAACC,GAAAA,EAAKC,WAAAA,EAAaC,OAAAA,GAAAA;QAC7C,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAIH,WAAAA,CAAAA;AACpB,QAAA,MAAMI,SAAS,IAAIC,eAAAA,EAAAA;QAEnBC,MAAAA,CAAOC,OAAO,CAACN,OAAAA,CAAAA,CAASO,OAAO,CAAC,CAAC,CAAChB,KAAKiB,KAAAA,CAAM,GAAA;AAC3C,YAAA,IAAIjB,QAAQ,KAAA,EAAO;gBACjBc,MAAAA,CAAOC,OAAO,CAACE,KAAAA,CAAAA,CAAOD,OAAO,CAAC,CAAC,CAACE,QAAQC,QAAAA,CAAS,GAAA;oBAC/CP,MAAAA,CAAOQ,GAAG,CAAC,CAAC,IAAI,EAAEF,MAAAA,CAAO,CAAC,CAAC,EAAEG,MAAAA,CAAOF,QAAAA,CAAAA,CAAAA;AAC5C,gBAAA,CAAA,CAAA;AACM,gBAAA;AACN,YAAA;YACI,IAAIF,KAAAA,KAAUK,SAAAA,IAAaL,KAAAA,KAAU,IAAA,EAAM;gBACzCL,MAAAA,CAAOQ,GAAG,CAACpB,GAAAA,EAAKqB,MAAAA,CAAOJ,KAAAA,CAAAA,CAAAA;AAC7B,YAAA;AACA,QAAA,CAAA,CAAA;QAEEP,GAAAA,CAAIa,MAAM,GAAGX,MAAAA,CAAOY,QAAQ,EAAA;QAC5BjB,GAAAA,CAAIkB,QAAQ,CAACf,GAAAA,CAAIc,QAAQ,EAAA,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAME,uBAAuB,CAACnB,GAAAA,GAAAA;AAC5B,QAAA,MAAMoB,OAAAA,GAAUpB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA;AACnC,QAAA,OAAOA,OAAAA,GAAU;AAAEA,YAAAA;AAAO,SAAA,GAAK,EAAA;AACjC,IAAA,CAAA;AAEA,IAAA,MAAMG,eAAAA,GAAkB,OAAOvB,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,GAAAA;AACpD,QAAA,MAAM0C,YAAAA,GAAe,MAAMhE,QAAAA,CAAOgE,YAAY,CAAC;AAC7CC,YAAAA,UAAAA,EAAYpD,SAASe,WAAW;AAChCN,YAAAA,WAAAA;AACA4C,YAAAA,WAAAA,EAAarD,SAASmB,GAAG;AACzBmC,YAAAA,gBAAAA,EAAkBtD,SAASoB;AAC/B,SAAA,CAAA;QAEEM,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUkD,OAAOlD,QAAQ;YACzBuD,OAAAA,EAASJ;AACb,SAAA;QAEE,MAAMK,YAAAA,GAAe,CAAA,EAAGxD,QAAAA,CAASa,aAAa,CAAC,aAAa,EAAE4C,kBAAAA,CAAmBN,YAAAA,CAAaO,WAAW,CAAA,CAAA,CAAG;QAC5G,OAAOhC,GAAAA,CAAIkB,QAAQ,CAACY,YAAAA,CAAAA;AACtB,IAAA,CAAA;AAEA,IAAA,MAAMG,eAAAA,GAAkB,CAACjC,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,GAAAA;QAC9C,MAAMmD,KAAAA,GAAQvE,SAAOwE,aAAa,EAAA;QAClCnC,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUkD,OAAOlD,QAAQ;AACzB4D,YAAAA;AACJ,SAAA;AAEE,QAAA,IAAIJ,YAAAA,GAAenE,QAAAA,CAAOyE,iBAAiB,CAAC9D,QAAAA,EAAU;AACpDmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBV,YAAAA,WAAAA;AACAY,YAAAA,KAAAA,EAAOrB,SAASqB,KAAK;AACrBC,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;AAEEkC,QAAAA,YAAAA,IAAgB,CAAC,OAAO,EAAEC,kBAAAA,CAAmBG,KAAAA,CAAAA,CAAAA,CAAQ;QACrD,OAAOlC,GAAAA,CAAIkB,QAAQ,CAACY,YAAAA,CAAAA;AACtB,IAAA,CAAA;IAEA,MAAMO,oBAAAA,GAAuB,OAAOrC,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,GAAAA;AACjD,QAAA,MAAMoB,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;QACrC,MAAM,EAAEU,aAAaM,UAAU,EAAEC,gBAAgBC,aAAa,EAAE,GAAGxC,GAAAA,CAAIyC,KAAK;QAC5E,MAAMhB,YAAAA,GAAeJ,QAAQQ,OAAO;AAEpC,QAAA,IAAI,CAACJ,YAAAA,EAAcO,WAAAA,IAAeM,UAAAA,KAAeb,YAAAA,CAAaO,WAAW,EAAE;AACzE,YAAA,MAAM,IAAIU,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMC,aAAAA,GAAgB,MAAMlF,QAAAA,CAAOmF,WAAW,CAAC;AAC7CC,YAAAA,SAAAA,EAAWvE,SAASc,UAAU;AAC9BuC,YAAAA,WAAAA,EAAarD,SAASmB,GAAG;AACzBmC,YAAAA,gBAAAA,EAAkBtD,SAASoB,MAAM;AACjC4C,YAAAA,UAAAA;AACAE,YAAAA,aAAAA;AACAM,YAAAA,oBAAAA,EAAsBrB,aAAasB;AACvC,SAAA,CAAA;AAEE,QAAA,MAAM7C,OAAAA,GAAUvC,QAAAA,CAAOqF,oBAAoB,CAAC1E,QAAAA,EAAUqE,aAAAA,CAAAA;AACtD3C,QAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;QACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAaC,OAAAA,CAAAA;AAC/C,IAAA,CAAA;AAEA,IAAA,MAAM+C,oBAAAA,GAAuB,OAAOjD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,GAAAA;AAC9D,QAAA,MAAMsC,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;AACrC,QAAA,MAAM,EAAE4B,IAAI,EAAEhB,KAAAA,EAAOiB,UAAU,EAAEC,KAAK,EAAEC,iBAAAA,EAAmBC,gBAAgB,EAAE,GAAGtD,IAAIyC,KAAK;AAEzF,QAAA,IAAIW,KAAAA,EAAO;AACTpD,YAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;YACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;AAC3CmD,gBAAAA,KAAAA;gBACAC,iBAAAA,EAAmBC;AACzB,aAAA,CAAA;AACA,QAAA;AAEE,QAAA,IAAI,CAACJ,IAAAA,EAAM;AACT,YAAA,MAAM,IAAIR,KAAAA,CAAM,+BAAA,CAAA;AACpB,QAAA;;AAGE,QAAA,IAAI,CAACrB,OAAAA,CAAQa,KAAK,IAAIiB,UAAAA,KAAe9B,OAAAA,CAAQa,KAAK,EAAE;AAClD,YAAA,MAAM,IAAIQ,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMC,aAAAA,GAAgB,MAAMhF,QAAAA,CAAO4F,yBAAyB,CAACjF,QAAAA,EAAU;AACrEmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBC,YAAAA,MAAAA,EAAQpB,SAASoB,MAAM;AACvBX,YAAAA,WAAAA;AACAmE,YAAAA,IAAAA;AACAtD,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;AAEE,QAAA,MAAMM,OAAAA,GAAUvC,QAAAA,CAAOqF,oBAAoB,CAAC1E,QAAAA,EAAUqE,aAAAA,CAAAA;AACtD3C,QAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;QACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAaC,OAAAA,CAAAA;AAC/C,IAAA,CAAA;AAEA,IAAA,MAAMsD,4BAAAA,GAA+B,IAAA;AACnC,QAAA,OAAO,OAAOxD,GAAAA,EAAKyD,IAAAA,GAAAA;AACjB,YAAA,MAAMzF,SAAAA,GAAY0F,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,iBAAA,CAAA;YACpC,MAAM,CAAC7F,YAAY,GAAGiC,GAAAA,CAAI6B,OAAO,CAAC1B,GAAG,CAAC3B,KAAK,CAAC,GAAA,CAAA;YAC5C,MAAMgD,MAAAA,GAAS1D,iBAAiBC,WAAAA,EAAaC,SAAAA,CAAAA;AAE7C,YAAA,IAAI,CAACwD,MAAAA,EAAQ;gBACX,OAAOiC,IAAAA,EAAAA;AACb,YAAA;YAEI,IAAI,CAACzD,GAAAA,CAAIqB,OAAO,EAAE;gBAChBrB,GAAAA,CAAI6D,KAAK,CAAC,GAAA,EAAK,2CAAA,CAAA;AACrB,YAAA;AAEI,YAAA,MAAMC,eAAAA,GAAkB,MAAMJ,MAAAA,CAC3BK,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAUxE,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAO,aAAA,CAAA,CAC/DmE,GAAG,EAAA;AAEN,YAAA,MAAM9E,YAAAA,GAAegF,eAAAA,GAAkBtC,MAAAA,CAAOlD,QAAQ,CAAC;YACvD,IAAI,CAACQ,cAAcmF,OAAAA,EAAS;gBAC1B,MAAM,IAAI5G,MAAAA,CAAO6G,gBAAgB,CAAC,2BAAA,CAAA;AACxC,YAAA;YAEI,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AACvB,YAAA,MAAMrF,cAAcoF,UAAAA,CAAW,WAAA,CAAA,CAAaE,gBAAgB,CAAC7C,OAAOlD,QAAQ,CAAA;AAE5E,YAAA,MAAMgG,gBAAAA,GACJtE,GAAAA,CAAIkC,KAAK,CAACqC,YAAY,EAAE1E,QAAAA,IAAYG,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA,EAASvB,QAAAA;AAClE,YAAA,MAAM2E,kBAAkBF,gBAAAA,GACpB;AAAE,gBAAA,GAAGxF,YAAY;gBAAEe,QAAAA,EAAUyE;aAAgB,GAC7CxF,YAAAA;AAEJ,YAAA,MAAMR,QAAAA,GAAWM,mBAAAA,CAAoB4C,MAAAA,CAAOlD,QAAQ,EAAEkG,eAAAA,EAAiBzF,WAAAA,CAAAA;AAEvE,YAAA,IAAI,CAACT,QAAAA,EAAU;gBACb,MAAM,IAAIjB,MAAAA,CAAO6G,gBAAgB,CAAC,wBAAA,CAAA;AACxC,YAAA;YAEIlE,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAGtB,IAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;YAEzC,IAAI,CAACE,MAAAA,CAAO7C,UAAU,EAAE;gBACtB,IAAIL,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAOqC,eAAAA,CAAgBvB,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,CAAAA;AACtD,gBAAA;gBACM,OAAOkD,eAAAA,CAAgBjC,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,CAAAA;AACpD,YAAA;YAEI,MAAMkB,WAAAA,GAAcuE,gBAAgB3E,QAAQ;AAC5C,YAAA,IAAI,CAACI,WAAAA,EAAa;gBAChB,MAAM,IAAI5C,MAAAA,CAAO6G,gBAAgB,CAAC,yCAAA,CAAA;AACxC,YAAA;YAEI,IAAI;gBACF,IAAI5F,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAO,MAAMmD,oBAAAA,CAAqBrC,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,CAAAA;AACzD,gBAAA;AACM,gBAAA,OAAO,MAAMgD,oBAAAA,CAAqBjD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,CAAAA;AACpE,YAAA,CAAA,CAAM,OAAO0F,GAAAA,EAAK;AACZzE,gBAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;gBACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;oBAC3CmD,KAAAA,EAAO,aAAA;AACPC,oBAAAA,iBAAAA,EAAmBoB,IAAIC;AAC/B,iBAAA,CAAA;AACA,YAAA;AACA,QAAA,CAAA;AACA,IAAA,CAAA;IAEAH,YAAAA,GAAiB;AACff,QAAAA,4BAAAA;AACA1F,QAAAA,gBAAAA;AACAc,QAAAA,mBAAAA;AACAmB,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"index.js","sources":["../../../../server/src/utils/oauth-connect/index.js"],"sourcesContent":["'use strict';\n\nconst { errors } = require('@strapi/utils');\n\nconst builtinProviderEndpoints = require('./providers');\nconst oauth1 = require('./oauth1');\nconst oauth2 = require('./oauth2');\nconst { trimGrantSessionResponse } = require('../trim-grant-session-response');\n\nconst CONNECT_PREFIX = '/connect';\n\nconst parseConnectPath = (requestPath, apiPrefix) => {\n  const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;\n  if (!requestPath.startsWith(prefix)) {\n    return null;\n  }\n\n  const remainder = requestPath.slice(prefix.length);\n  const [provider, segment] = remainder.split('/').filter(Boolean);\n\n  if (!provider) {\n    return null;\n  }\n\n  return {\n    provider,\n    isCallback: segment === 'callback',\n  };\n};\n\n/**\n * Resolve OAuth endpoint config from built-ins, falling back to store-defined\n * endpoints so custom providers registered via providers-registry still work.\n */\nconst buildProviderConfig = (providerName, storedConfig, redirectUri) => {\n  const defaults = builtinProviderEndpoints[providerName];\n  const endpoints = defaults || {\n    oauth: storedConfig.oauth,\n    authorize_url: storedConfig.authorize_url,\n    access_url: storedConfig.access_url,\n    request_url: storedConfig.request_url,\n    scope_delimiter: storedConfig.scope_delimiter,\n    token_endpoint_auth_method: storedConfig.token_endpoint_auth_method,\n  };\n\n  if (endpoints.oauth === 1) {\n    if (!endpoints.request_url || !endpoints.authorize_url || !endpoints.access_url) {\n      return null;\n    }\n  } else if (!endpoints.authorize_url || !endpoints.access_url) {\n    return null;\n  }\n\n  return {\n    name: providerName,\n    ...endpoints,\n    key: storedConfig.key,\n    secret: storedConfig.secret,\n    scope: storedConfig.scope,\n    subdomain: storedConfig.subdomain,\n    callback: storedConfig.callback,\n    redirect_uri: redirectUri,\n  };\n};\n\nconst redirectWithPayload = (ctx, callbackUrl, payload) => {\n  const url = new URL(callbackUrl);\n  const params = new URLSearchParams();\n\n  Object.entries(payload).forEach(([key, value]) => {\n    if (key === 'raw') {\n      Object.entries(value).forEach(([rawKey, rawValue]) => {\n        params.set(`raw[${rawKey}]`, String(rawValue));\n      });\n      return;\n    }\n    if (value !== undefined && value !== null) {\n      params.set(key, String(value));\n    }\n  });\n\n  url.search = params.toString();\n  ctx.redirect(url.toString());\n};\n\nconst preserveGrantDynamic = (ctx) => {\n  const dynamic = ctx.session.grant?.dynamic;\n  return dynamic ? { dynamic } : {};\n};\n\nconst redirectWithSessionResponse = (ctx, callbackUrl, provider, tokenResponse) => {\n  const grantResponse = oauth2.tokensToQueryPayload(provider, tokenResponse);\n  ctx.session.grant = {\n    response: trimGrantSessionResponse(grantResponse, provider.name),\n  };\n\n  return redirectWithPayload(ctx, callbackUrl, {});\n};\n\nconst startOAuth1Flow = async (ctx, provider, parsed, redirectUri) => {\n  const requestToken = await oauth1.requestToken({\n    requestUrl: provider.request_url,\n    redirectUri,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n  });\n\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    request: requestToken,\n  };\n\n  const authorizeUrl = `${provider.authorize_url}?oauth_token=${encodeURIComponent(requestToken.oauth_token)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst startOAuth2Flow = (ctx, provider, parsed, redirectUri) => {\n  const state = oauth2.generateState();\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    state,\n  };\n\n  let authorizeUrl = oauth2.buildAuthorizeUrl(provider, {\n    key: provider.key,\n    redirectUri,\n    scope: provider.scope,\n    subdomain: provider.subdomain,\n  });\n\n  authorizeUrl += `&state=${encodeURIComponent(state)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst handleOAuth1Callback = async (ctx, provider, callbackUrl) => {\n  const session = ctx.session.grant || {};\n  const { oauth_token: oauthToken, oauth_verifier: oauthVerifier } = ctx.query;\n  const requestToken = session.request;\n\n  if (!requestToken?.oauth_token || oauthToken !== requestToken.oauth_token) {\n    throw new Error('OAuth1 token mismatch');\n  }\n\n  const tokenResponse = await oauth1.accessToken({\n    accessUrl: provider.access_url,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n    oauthToken,\n    oauthVerifier,\n    oauthTokenCredential: requestToken.oauth_token_secret,\n  });\n\n  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);\n};\n\nconst handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) => {\n  const session = ctx.session.grant || {};\n  const { code, state: queryState, error, error_description: errorDescription } = ctx.query;\n\n  if (error) {\n    ctx.session.grant = {};\n    return redirectWithPayload(ctx, callbackUrl, {\n      error,\n      error_description: errorDescription,\n    });\n  }\n\n  if (!code) {\n    throw new Error('OAuth2 missing code parameter');\n  }\n\n  // Reject when session state is missing (not only on mismatch) to close login-CSRF.\n  if (!session.state || queryState !== session.state) {\n    throw new Error('OAuth2 state mismatch');\n  }\n\n  const tokenResponse = await oauth2.exchangeAuthorizationCode(provider, {\n    key: provider.key,\n    secret: provider.secret,\n    redirectUri,\n    code,\n    subdomain: provider.subdomain,\n  });\n\n  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);\n};\n\nconst createOAuthConnectMiddleware = () => {\n  return async (ctx, next) => {\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n    const [requestPath] = ctx.request.url.split('?');\n    const parsed = parseConnectPath(requestPath, apiPrefix);\n\n    if (!parsed) {\n      return next();\n    }\n\n    if (!ctx.session) {\n      ctx.throw(400, 'OAuth connect requires session middleware');\n    }\n\n    const storedProviders = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n      .get();\n\n    const storedConfig = storedProviders?.[parsed.provider];\n    if (!storedConfig?.enabled) {\n      throw new errors.ApplicationError('This provider is disabled');\n    }\n\n    const { getService } = require('..');\n    const redirectUri = getService('providers').buildRedirectUri(parsed.provider);\n\n    const callbackOverride =\n      ctx.state.oauthConnect?.callback ?? ctx.session.grant?.dynamic?.callback;\n    const effectiveConfig = callbackOverride\n      ? { ...storedConfig, callback: callbackOverride }\n      : storedConfig;\n\n    const provider = buildProviderConfig(parsed.provider, effectiveConfig, redirectUri);\n\n    if (!provider) {\n      throw new errors.ApplicationError('Unknown OAuth provider');\n    }\n\n    ctx.session.grant = ctx.session.grant || {};\n\n    if (!parsed.isCallback) {\n      if (provider.oauth === 1) {\n        return startOAuth1Flow(ctx, provider, parsed, redirectUri);\n      }\n      return startOAuth2Flow(ctx, provider, parsed, redirectUri);\n    }\n\n    const callbackUrl = effectiveConfig.callback;\n    if (!callbackUrl) {\n      throw new errors.ApplicationError('Provider callback URL is not configured');\n    }\n\n    try {\n      if (provider.oauth === 1) {\n        return await handleOAuth1Callback(ctx, provider, callbackUrl);\n      }\n      return await handleOAuth2Callback(ctx, provider, callbackUrl, redirectUri);\n    } catch (err) {\n      ctx.session.grant = {};\n      return redirectWithPayload(ctx, callbackUrl, {\n        error: 'oauth_error',\n        error_description: err.message,\n      });\n    }\n  };\n};\n\nmodule.exports = {\n  createOAuthConnectMiddleware,\n  parseConnectPath,\n  buildProviderConfig,\n  redirectWithPayload,\n};\n"],"names":["errors","require$$0","builtinProviderEndpoints","require$$1","oauth1","require$$2","oauth2","require$$3","trimGrantSessionResponse","require$$4","CONNECT_PREFIX","parseConnectPath","requestPath","apiPrefix","prefix","startsWith","remainder","slice","length","provider","segment","split","filter","Boolean","isCallback","buildProviderConfig","providerName","storedConfig","redirectUri","defaults","endpoints","oauth","authorize_url","access_url","request_url","scope_delimiter","token_endpoint_auth_method","name","key","secret","scope","subdomain","callback","redirect_uri","redirectWithPayload","ctx","callbackUrl","payload","url","URL","params","URLSearchParams","Object","entries","forEach","value","rawKey","rawValue","set","String","undefined","search","toString","redirect","preserveGrantDynamic","dynamic","session","grant","redirectWithSessionResponse","tokenResponse","grantResponse","tokensToQueryPayload","response","startOAuth1Flow","parsed","requestToken","requestUrl","consumerKey","clientCredential","request","authorizeUrl","encodeURIComponent","oauth_token","startOAuth2Flow","state","generateState","buildAuthorizeUrl","handleOAuth1Callback","oauthToken","oauth_verifier","oauthVerifier","query","Error","accessToken","accessUrl","oauthTokenCredential","oauth_token_secret","handleOAuth2Callback","code","queryState","error","error_description","errorDescription","exchangeAuthorizationCode","createOAuthConnectMiddleware","next","strapi","config","get","throw","storedProviders","store","type","enabled","ApplicationError","getService","require$$5","buildRedirectUri","callbackOverride","oauthConnect","effectiveConfig","err","message"],"mappings":";;;;;;;;;;;;;;;;;;IAEA,MAAM,EAAEA,MAAM,EAAE,GAAGC,2BAAAA;AAEnB,IAAA,MAAMC,wBAAAA,GAA2BC,mBAAAA,EAAAA;AACjC,IAAA,MAAMC,QAAAA,GAASC,gBAAAA,EAAAA;AACf,IAAA,MAAMC,QAAAA,GAASC,gBAAAA,EAAAA;IACf,MAAM,4BAAEC,0BAAwB,EAAE,GAAGC,kCAAAA,EAAAA;AAErC,IAAA,MAAMC,cAAAA,GAAiB,UAAA;IAEvB,MAAMC,gBAAAA,GAAmB,CAACC,WAAAA,EAAaC,SAAAA,GAAAA;AACrC,QAAA,MAAMC,MAAAA,GAAS,CAAA,EAAGD,SAAAA,CAAAA,EAAYH,cAAAA,CAAe,CAAC,CAAC;AAC/C,QAAA,IAAI,CAACE,WAAAA,CAAYG,UAAU,CAACD,MAAAA,CAAAA,EAAS;YACnC,OAAO,IAAA;AACX,QAAA;AAEE,QAAA,MAAME,SAAAA,GAAYJ,WAAAA,CAAYK,KAAK,CAACH,OAAOI,MAAM,CAAA;QACjD,MAAM,CAACC,UAAUC,OAAAA,CAAQ,GAAGJ,UAAUK,KAAK,CAAC,GAAA,CAAA,CAAKC,MAAM,CAACC,OAAAA,CAAAA;AAExD,QAAA,IAAI,CAACJ,QAAAA,EAAU;YACb,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;AACLA,YAAAA,QAAAA;AACAK,YAAAA,UAAAA,EAAYJ,OAAAA,KAAY;AAC5B,SAAA;AACA,IAAA,CAAA;AAEA;;;AAGA,KACA,MAAMK,mBAAAA,GAAsB,CAACC,YAAAA,EAAcC,YAAAA,EAAcC,WAAAA,GAAAA;QACvD,MAAMC,QAAAA,GAAW3B,wBAAwB,CAACwB,YAAAA,CAAa;AACvD,QAAA,MAAMI,YAAYD,QAAAA,IAAY;AAC5BE,YAAAA,KAAAA,EAAOJ,aAAaI,KAAK;AACzBC,YAAAA,aAAAA,EAAeL,aAAaK,aAAa;AACzCC,YAAAA,UAAAA,EAAYN,aAAaM,UAAU;AACnCC,YAAAA,WAAAA,EAAaP,aAAaO,WAAW;AACrCC,YAAAA,eAAAA,EAAiBR,aAAaQ,eAAe;AAC7CC,YAAAA,0BAAAA,EAA4BT,aAAaS;AAC7C,SAAA;QAEE,IAAIN,SAAAA,CAAUC,KAAK,KAAK,CAAA,EAAG;YACzB,IAAI,CAACD,SAAAA,CAAUI,WAAW,IAAI,CAACJ,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;gBAC/E,OAAO,IAAA;AACb,YAAA;QACA,CAAA,MAAS,IAAI,CAACH,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;YAC5D,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;YACLI,IAAAA,EAAMX,YAAAA;AACN,YAAA,GAAGI,SAAS;AACZQ,YAAAA,GAAAA,EAAKX,aAAaW,GAAG;AACrBC,YAAAA,MAAAA,EAAQZ,aAAaY,MAAM;AAC3BC,YAAAA,KAAAA,EAAOb,aAAaa,KAAK;AACzBC,YAAAA,SAAAA,EAAWd,aAAac,SAAS;AACjCC,YAAAA,QAAAA,EAAUf,aAAae,QAAQ;YAC/BC,YAAAA,EAAcf;AAClB,SAAA;AACA,IAAA,CAAA;IAEA,MAAMgB,mBAAAA,GAAsB,CAACC,GAAAA,EAAKC,WAAAA,EAAaC,OAAAA,GAAAA;QAC7C,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAIH,WAAAA,CAAAA;AACpB,QAAA,MAAMI,SAAS,IAAIC,eAAAA,EAAAA;QAEnBC,MAAAA,CAAOC,OAAO,CAACN,OAAAA,CAAAA,CAASO,OAAO,CAAC,CAAC,CAAChB,KAAKiB,KAAAA,CAAM,GAAA;AAC3C,YAAA,IAAIjB,QAAQ,KAAA,EAAO;gBACjBc,MAAAA,CAAOC,OAAO,CAACE,KAAAA,CAAAA,CAAOD,OAAO,CAAC,CAAC,CAACE,QAAQC,QAAAA,CAAS,GAAA;oBAC/CP,MAAAA,CAAOQ,GAAG,CAAC,CAAC,IAAI,EAAEF,MAAAA,CAAO,CAAC,CAAC,EAAEG,MAAAA,CAAOF,QAAAA,CAAAA,CAAAA;AAC5C,gBAAA,CAAA,CAAA;AACM,gBAAA;AACN,YAAA;YACI,IAAIF,KAAAA,KAAUK,SAAAA,IAAaL,KAAAA,KAAU,IAAA,EAAM;gBACzCL,MAAAA,CAAOQ,GAAG,CAACpB,GAAAA,EAAKqB,MAAAA,CAAOJ,KAAAA,CAAAA,CAAAA;AAC7B,YAAA;AACA,QAAA,CAAA,CAAA;QAEEP,GAAAA,CAAIa,MAAM,GAAGX,MAAAA,CAAOY,QAAQ,EAAA;QAC5BjB,GAAAA,CAAIkB,QAAQ,CAACf,GAAAA,CAAIc,QAAQ,EAAA,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAME,uBAAuB,CAACnB,GAAAA,GAAAA;AAC5B,QAAA,MAAMoB,OAAAA,GAAUpB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA;AACnC,QAAA,OAAOA,OAAAA,GAAU;AAAEA,YAAAA;AAAO,SAAA,GAAK,EAAA;AACjC,IAAA,CAAA;AAEA,IAAA,MAAMG,2BAAAA,GAA8B,CAACvB,GAAAA,EAAKC,WAAAA,EAAa3B,QAAAA,EAAUkD,aAAAA,GAAAA;AAC/D,QAAA,MAAMC,aAAAA,GAAgBhE,QAAAA,CAAOiE,oBAAoB,CAACpD,QAAAA,EAAUkD,aAAAA,CAAAA;QAC5DxB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;YAClBK,QAAAA,EAAUhE,0BAAAA,CAAyB8D,aAAAA,EAAenD,QAAAA,CAASkB,IAAI;AACnE,SAAA;QAEE,OAAOO,mBAAAA,CAAoBC,GAAAA,EAAKC,WAAAA,EAAa;AAC/C,IAAA,CAAA;AAEA,IAAA,MAAM2B,eAAAA,GAAkB,OAAO5B,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,GAAAA;AACpD,QAAA,MAAM+C,YAAAA,GAAe,MAAMvE,QAAAA,CAAOuE,YAAY,CAAC;AAC7CC,YAAAA,UAAAA,EAAYzD,SAASe,WAAW;AAChCN,YAAAA,WAAAA;AACAiD,YAAAA,WAAAA,EAAa1D,SAASmB,GAAG;AACzBwC,YAAAA,gBAAAA,EAAkB3D,SAASoB;AAC/B,SAAA,CAAA;QAEEM,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUuD,OAAOvD,QAAQ;YACzB4D,OAAAA,EAASJ;AACb,SAAA;QAEE,MAAMK,YAAAA,GAAe,CAAA,EAAG7D,QAAAA,CAASa,aAAa,CAAC,aAAa,EAAEiD,kBAAAA,CAAmBN,YAAAA,CAAaO,WAAW,CAAA,CAAA,CAAG;QAC5G,OAAOrC,GAAAA,CAAIkB,QAAQ,CAACiB,YAAAA,CAAAA;AACtB,IAAA,CAAA;AAEA,IAAA,MAAMG,eAAAA,GAAkB,CAACtC,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,GAAAA;QAC9C,MAAMwD,KAAAA,GAAQ9E,SAAO+E,aAAa,EAAA;QAClCxC,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUuD,OAAOvD,QAAQ;AACzBiE,YAAAA;AACJ,SAAA;AAEE,QAAA,IAAIJ,YAAAA,GAAe1E,QAAAA,CAAOgF,iBAAiB,CAACnE,QAAAA,EAAU;AACpDmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBV,YAAAA,WAAAA;AACAY,YAAAA,KAAAA,EAAOrB,SAASqB,KAAK;AACrBC,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;AAEEuC,QAAAA,YAAAA,IAAgB,CAAC,OAAO,EAAEC,kBAAAA,CAAmBG,KAAAA,CAAAA,CAAAA,CAAQ;QACrD,OAAOvC,GAAAA,CAAIkB,QAAQ,CAACiB,YAAAA,CAAAA;AACtB,IAAA,CAAA;IAEA,MAAMO,oBAAAA,GAAuB,OAAO1C,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,GAAAA;AACjD,QAAA,MAAMoB,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;QACrC,MAAM,EAAEe,aAAaM,UAAU,EAAEC,gBAAgBC,aAAa,EAAE,GAAG7C,GAAAA,CAAI8C,KAAK;QAC5E,MAAMhB,YAAAA,GAAeT,QAAQa,OAAO;AAEpC,QAAA,IAAI,CAACJ,YAAAA,EAAcO,WAAAA,IAAeM,UAAAA,KAAeb,YAAAA,CAAaO,WAAW,EAAE;AACzE,YAAA,MAAM,IAAIU,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMvB,aAAAA,GAAgB,MAAMjE,QAAAA,CAAOyF,WAAW,CAAC;AAC7CC,YAAAA,SAAAA,EAAW3E,SAASc,UAAU;AAC9B4C,YAAAA,WAAAA,EAAa1D,SAASmB,GAAG;AACzBwC,YAAAA,gBAAAA,EAAkB3D,SAASoB,MAAM;AACjCiD,YAAAA,UAAAA;AACAE,YAAAA,aAAAA;AACAK,YAAAA,oBAAAA,EAAsBpB,aAAaqB;AACvC,SAAA,CAAA;QAEE,OAAO5B,2BAAAA,CAA4BvB,GAAAA,EAAKC,WAAAA,EAAa3B,QAAAA,EAAUkD,aAAAA,CAAAA;AACjE,IAAA,CAAA;AAEA,IAAA,MAAM4B,oBAAAA,GAAuB,OAAOpD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,GAAAA;AAC9D,QAAA,MAAMsC,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;AACrC,QAAA,MAAM,EAAE+B,IAAI,EAAEd,KAAAA,EAAOe,UAAU,EAAEC,KAAK,EAAEC,iBAAAA,EAAmBC,gBAAgB,EAAE,GAAGzD,IAAI8C,KAAK;AAEzF,QAAA,IAAIS,KAAAA,EAAO;AACTvD,YAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;YACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;AAC3CsD,gBAAAA,KAAAA;gBACAC,iBAAAA,EAAmBC;AACzB,aAAA,CAAA;AACA,QAAA;AAEE,QAAA,IAAI,CAACJ,IAAAA,EAAM;AACT,YAAA,MAAM,IAAIN,KAAAA,CAAM,+BAAA,CAAA;AACpB,QAAA;;AAGE,QAAA,IAAI,CAAC1B,OAAAA,CAAQkB,KAAK,IAAIe,UAAAA,KAAejC,OAAAA,CAAQkB,KAAK,EAAE;AAClD,YAAA,MAAM,IAAIQ,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMvB,aAAAA,GAAgB,MAAM/D,QAAAA,CAAOiG,yBAAyB,CAACpF,QAAAA,EAAU;AACrEmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBC,YAAAA,MAAAA,EAAQpB,SAASoB,MAAM;AACvBX,YAAAA,WAAAA;AACAsE,YAAAA,IAAAA;AACAzD,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;QAEE,OAAO2B,2BAAAA,CAA4BvB,GAAAA,EAAKC,WAAAA,EAAa3B,QAAAA,EAAUkD,aAAAA,CAAAA;AACjE,IAAA,CAAA;AAEA,IAAA,MAAMmC,4BAAAA,GAA+B,IAAA;AACnC,QAAA,OAAO,OAAO3D,GAAAA,EAAK4D,IAAAA,GAAAA;AACjB,YAAA,MAAM5F,SAAAA,GAAY6F,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,iBAAA,CAAA;YACpC,MAAM,CAAChG,YAAY,GAAGiC,GAAAA,CAAIkC,OAAO,CAAC/B,GAAG,CAAC3B,KAAK,CAAC,GAAA,CAAA;YAC5C,MAAMqD,MAAAA,GAAS/D,iBAAiBC,WAAAA,EAAaC,SAAAA,CAAAA;AAE7C,YAAA,IAAI,CAAC6D,MAAAA,EAAQ;gBACX,OAAO+B,IAAAA,EAAAA;AACb,YAAA;YAEI,IAAI,CAAC5D,GAAAA,CAAIqB,OAAO,EAAE;gBAChBrB,GAAAA,CAAIgE,KAAK,CAAC,GAAA,EAAK,2CAAA,CAAA;AACrB,YAAA;AAEI,YAAA,MAAMC,eAAAA,GAAkB,MAAMJ,MAAAA,CAC3BK,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAU3E,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAO,aAAA,CAAA,CAC/DsE,GAAG,EAAA;AAEN,YAAA,MAAMjF,YAAAA,GAAemF,eAAAA,GAAkBpC,MAAAA,CAAOvD,QAAQ,CAAC;YACvD,IAAI,CAACQ,cAAcsF,OAAAA,EAAS;gBAC1B,MAAM,IAAIjH,MAAAA,CAAOkH,gBAAgB,CAAC,2BAAA,CAAA;AACxC,YAAA;YAEI,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AACvB,YAAA,MAAMxF,cAAcuF,UAAAA,CAAW,WAAA,CAAA,CAAaE,gBAAgB,CAAC3C,OAAOvD,QAAQ,CAAA;AAE5E,YAAA,MAAMmG,gBAAAA,GACJzE,GAAAA,CAAIuC,KAAK,CAACmC,YAAY,EAAE7E,QAAAA,IAAYG,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA,EAASvB,QAAAA;AAClE,YAAA,MAAM8E,kBAAkBF,gBAAAA,GACpB;AAAE,gBAAA,GAAG3F,YAAY;gBAAEe,QAAAA,EAAU4E;aAAgB,GAC7C3F,YAAAA;AAEJ,YAAA,MAAMR,QAAAA,GAAWM,mBAAAA,CAAoBiD,MAAAA,CAAOvD,QAAQ,EAAEqG,eAAAA,EAAiB5F,WAAAA,CAAAA;AAEvE,YAAA,IAAI,CAACT,QAAAA,EAAU;gBACb,MAAM,IAAInB,MAAAA,CAAOkH,gBAAgB,CAAC,wBAAA,CAAA;AACxC,YAAA;YAEIrE,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAGtB,IAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;YAEzC,IAAI,CAACO,MAAAA,CAAOlD,UAAU,EAAE;gBACtB,IAAIL,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAO0C,eAAAA,CAAgB5B,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,CAAAA;AACtD,gBAAA;gBACM,OAAOuD,eAAAA,CAAgBtC,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,CAAAA;AACpD,YAAA;YAEI,MAAMkB,WAAAA,GAAc0E,gBAAgB9E,QAAQ;AAC5C,YAAA,IAAI,CAACI,WAAAA,EAAa;gBAChB,MAAM,IAAI9C,MAAAA,CAAOkH,gBAAgB,CAAC,yCAAA,CAAA;AACxC,YAAA;YAEI,IAAI;gBACF,IAAI/F,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAO,MAAMwD,oBAAAA,CAAqB1C,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,CAAAA;AACzD,gBAAA;AACM,gBAAA,OAAO,MAAMmD,oBAAAA,CAAqBpD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,CAAAA;AACpE,YAAA,CAAA,CAAM,OAAO6F,GAAAA,EAAK;AACZ5E,gBAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;gBACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;oBAC3CsD,KAAAA,EAAO,aAAA;AACPC,oBAAAA,iBAAAA,EAAmBoB,IAAIC;AAC/B,iBAAA,CAAA;AACA,YAAA;AACA,QAAA,CAAA;AACA,IAAA,CAAA;IAEAH,YAAAA,GAAiB;AACff,QAAAA,4BAAAA;AACA7F,QAAAA,gBAAAA;AACAc,QAAAA,mBAAAA;AACAmB,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/oauth-connect/index.mjs

@@ -2,6 +2,7 @@ import require$$1 from '@strapi/utils';
 import { __require as requireProviders } from './providers.mjs';
 import { __require as requireOauth1 } from './oauth1.mjs';
 import { __require as requireOauth2 } from './oauth2.mjs';
+import { __require as requireTrimGrantSessionResponse } from '../trim-grant-session-response.mjs';
 import { __require as requireUtils } from '../index.mjs';
 
 var oauthConnect;
@@ -13,6 +14,7 @@ function requireOauthConnect() {
     const builtinProviderEndpoints = requireProviders();
     const oauth1 = requireOauth1();
     const oauth2 = requireOauth2();
+    const { trimGrantSessionResponse } = requireTrimGrantSessionResponse();
     const CONNECT_PREFIX = '/connect';
     const parseConnectPath = (requestPath, apiPrefix)=>{
         const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;
@@ -83,6 +85,13 @@ function requireOauthConnect() {
             dynamic
         } : {};
     };
+    const redirectWithSessionResponse = (ctx, callbackUrl, provider, tokenResponse)=>{
+        const grantResponse = oauth2.tokensToQueryPayload(provider, tokenResponse);
+        ctx.session.grant = {
+            response: trimGrantSessionResponse(grantResponse, provider.name)
+        };
+        return redirectWithPayload(ctx, callbackUrl, {});
+    };
     const startOAuth1Flow = async (ctx, provider, parsed, redirectUri)=>{
         const requestToken = await oauth1.requestToken({
             requestUrl: provider.request_url,
@@ -129,9 +138,7 @@ function requireOauthConnect() {
             oauthVerifier,
             oauthTokenCredential: requestToken.oauth_token_secret
         });
-        const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);
-        ctx.session.grant = {};
-        return redirectWithPayload(ctx, callbackUrl, payload);
+        return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
     };
     const handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri)=>{
         const session = ctx.session.grant || {};
@@ -157,9 +164,7 @@ function requireOauthConnect() {
             code,
             subdomain: provider.subdomain
         });
-        const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);
-        ctx.session.grant = {};
-        return redirectWithPayload(ctx, callbackUrl, payload);
+        return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
     };
     const createOAuthConnectMiddleware = ()=>{
         return async (ctx, next)=>{

package/dist/server/utils/oauth-connect/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":["../../../../server/src/utils/oauth-connect/index.js"],"sourcesContent":["'use strict';\n\nconst { errors } = require('@strapi/utils');\n\nconst builtinProviderEndpoints = require('./providers');\nconst oauth1 = require('./oauth1');\nconst oauth2 = require('./oauth2');\n\nconst CONNECT_PREFIX = '/connect';\n\nconst parseConnectPath = (requestPath, apiPrefix) => {\n  const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;\n  if (!requestPath.startsWith(prefix)) {\n    return null;\n  }\n\n  const remainder = requestPath.slice(prefix.length);\n  const [provider, segment] = remainder.split('/').filter(Boolean);\n\n  if (!provider) {\n    return null;\n  }\n\n  return {\n    provider,\n    isCallback: segment === 'callback',\n  };\n};\n\n/**\n * Resolve OAuth endpoint config from built-ins, falling back to store-defined\n * endpoints so custom providers registered via providers-registry still work.\n */\nconst buildProviderConfig = (providerName, storedConfig, redirectUri) => {\n  const defaults = builtinProviderEndpoints[providerName];\n  const endpoints = defaults || {\n    oauth: storedConfig.oauth,\n    authorize_url: storedConfig.authorize_url,\n    access_url: storedConfig.access_url,\n    request_url: storedConfig.request_url,\n    scope_delimiter: storedConfig.scope_delimiter,\n    token_endpoint_auth_method: storedConfig.token_endpoint_auth_method,\n  };\n\n  if (endpoints.oauth === 1) {\n    if (!endpoints.request_url || !endpoints.authorize_url || !endpoints.access_url) {\n      return null;\n    }\n  } else if (!endpoints.authorize_url || !endpoints.access_url) {\n    return null;\n  }\n\n  return {\n    name: providerName,\n    ...endpoints,\n    key: storedConfig.key,\n    secret: storedConfig.secret,\n    scope: storedConfig.scope,\n    subdomain: storedConfig.subdomain,\n    callback: storedConfig.callback,\n    redirect_uri: redirectUri,\n  };\n};\n\nconst redirectWithPayload = (ctx, callbackUrl, payload) => {\n  const url = new URL(callbackUrl);\n  const params = new URLSearchParams();\n\n  Object.entries(payload).forEach(([key, value]) => {\n    if (key === 'raw') {\n      Object.entries(value).forEach(([rawKey, rawValue]) => {\n        params.set(`raw[${rawKey}]`, String(rawValue));\n      });\n      return;\n    }\n    if (value !== undefined && value !== null) {\n      params.set(key, String(value));\n    }\n  });\n\n  url.search = params.toString();\n  ctx.redirect(url.toString());\n};\n\nconst preserveGrantDynamic = (ctx) => {\n  const dynamic = ctx.session.grant?.dynamic;\n  return dynamic ? { dynamic } : {};\n};\n\nconst startOAuth1Flow = async (ctx, provider, parsed, redirectUri) => {\n  const requestToken = await oauth1.requestToken({\n    requestUrl: provider.request_url,\n    redirectUri,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n  });\n\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    request: requestToken,\n  };\n\n  const authorizeUrl = `${provider.authorize_url}?oauth_token=${encodeURIComponent(requestToken.oauth_token)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst startOAuth2Flow = (ctx, provider, parsed, redirectUri) => {\n  const state = oauth2.generateState();\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    state,\n  };\n\n  let authorizeUrl = oauth2.buildAuthorizeUrl(provider, {\n    key: provider.key,\n    redirectUri,\n    scope: provider.scope,\n    subdomain: provider.subdomain,\n  });\n\n  authorizeUrl += `&state=${encodeURIComponent(state)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst handleOAuth1Callback = async (ctx, provider, callbackUrl) => {\n  const session = ctx.session.grant || {};\n  const { oauth_token: oauthToken, oauth_verifier: oauthVerifier } = ctx.query;\n  const requestToken = session.request;\n\n  if (!requestToken?.oauth_token || oauthToken !== requestToken.oauth_token) {\n    throw new Error('OAuth1 token mismatch');\n  }\n\n  const tokenResponse = await oauth1.accessToken({\n    accessUrl: provider.access_url,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n    oauthToken,\n    oauthVerifier,\n    oauthTokenCredential: requestToken.oauth_token_secret,\n  });\n\n  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);\n  ctx.session.grant = {};\n  return redirectWithPayload(ctx, callbackUrl, payload);\n};\n\nconst handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) => {\n  const session = ctx.session.grant || {};\n  const { code, state: queryState, error, error_description: errorDescription } = ctx.query;\n\n  if (error) {\n    ctx.session.grant = {};\n    return redirectWithPayload(ctx, callbackUrl, {\n      error,\n      error_description: errorDescription,\n    });\n  }\n\n  if (!code) {\n    throw new Error('OAuth2 missing code parameter');\n  }\n\n  // Reject when session state is missing (not only on mismatch) to close login-CSRF.\n  if (!session.state || queryState !== session.state) {\n    throw new Error('OAuth2 state mismatch');\n  }\n\n  const tokenResponse = await oauth2.exchangeAuthorizationCode(provider, {\n    key: provider.key,\n    secret: provider.secret,\n    redirectUri,\n    code,\n    subdomain: provider.subdomain,\n  });\n\n  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);\n  ctx.session.grant = {};\n  return redirectWithPayload(ctx, callbackUrl, payload);\n};\n\nconst createOAuthConnectMiddleware = () => {\n  return async (ctx, next) => {\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n    const [requestPath] = ctx.request.url.split('?');\n    const parsed = parseConnectPath(requestPath, apiPrefix);\n\n    if (!parsed) {\n      return next();\n    }\n\n    if (!ctx.session) {\n      ctx.throw(400, 'OAuth connect requires session middleware');\n    }\n\n    const storedProviders = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n      .get();\n\n    const storedConfig = storedProviders?.[parsed.provider];\n    if (!storedConfig?.enabled) {\n      throw new errors.ApplicationError('This provider is disabled');\n    }\n\n    const { getService } = require('..');\n    const redirectUri = getService('providers').buildRedirectUri(parsed.provider);\n\n    const callbackOverride =\n      ctx.state.oauthConnect?.callback ?? ctx.session.grant?.dynamic?.callback;\n    const effectiveConfig = callbackOverride\n      ? { ...storedConfig, callback: callbackOverride }\n      : storedConfig;\n\n    const provider = buildProviderConfig(parsed.provider, effectiveConfig, redirectUri);\n\n    if (!provider) {\n      throw new errors.ApplicationError('Unknown OAuth provider');\n    }\n\n    ctx.session.grant = ctx.session.grant || {};\n\n    if (!parsed.isCallback) {\n      if (provider.oauth === 1) {\n        return startOAuth1Flow(ctx, provider, parsed, redirectUri);\n      }\n      return startOAuth2Flow(ctx, provider, parsed, redirectUri);\n    }\n\n    const callbackUrl = effectiveConfig.callback;\n    if (!callbackUrl) {\n      throw new errors.ApplicationError('Provider callback URL is not configured');\n    }\n\n    try {\n      if (provider.oauth === 1) {\n        return await handleOAuth1Callback(ctx, provider, callbackUrl);\n      }\n      return await handleOAuth2Callback(ctx, provider, callbackUrl, redirectUri);\n    } catch (err) {\n      ctx.session.grant = {};\n      return redirectWithPayload(ctx, callbackUrl, {\n        error: 'oauth_error',\n        error_description: err.message,\n      });\n    }\n  };\n};\n\nmodule.exports = {\n  createOAuthConnectMiddleware,\n  parseConnectPath,\n  buildProviderConfig,\n  redirectWithPayload,\n};\n"],"names":["errors","require$$0","builtinProviderEndpoints","require$$1","oauth1","require$$2","oauth2","require$$3","CONNECT_PREFIX","parseConnectPath","requestPath","apiPrefix","prefix","startsWith","remainder","slice","length","provider","segment","split","filter","Boolean","isCallback","buildProviderConfig","providerName","storedConfig","redirectUri","defaults","endpoints","oauth","authorize_url","access_url","request_url","scope_delimiter","token_endpoint_auth_method","name","key","secret","scope","subdomain","callback","redirect_uri","redirectWithPayload","ctx","callbackUrl","payload","url","URL","params","URLSearchParams","Object","entries","forEach","value","rawKey","rawValue","set","String","undefined","search","toString","redirect","preserveGrantDynamic","dynamic","session","grant","startOAuth1Flow","parsed","requestToken","requestUrl","consumerKey","clientCredential","request","authorizeUrl","encodeURIComponent","oauth_token","startOAuth2Flow","state","generateState","buildAuthorizeUrl","handleOAuth1Callback","oauthToken","oauth_verifier","oauthVerifier","query","Error","tokenResponse","accessToken","accessUrl","oauthTokenCredential","oauth_token_secret","tokensToQueryPayload","handleOAuth2Callback","code","queryState","error","error_description","errorDescription","exchangeAuthorizationCode","createOAuthConnectMiddleware","next","strapi","config","get","throw","storedProviders","store","type","enabled","ApplicationError","getService","require$$4","buildRedirectUri","callbackOverride","oauthConnect","effectiveConfig","err","message"],"mappings":";;;;;;;;;;;IAEA,MAAM,EAAEA,MAAM,EAAE,GAAGC,UAAAA;AAEnB,IAAA,MAAMC,wBAAAA,GAA2BC,gBAAAA,EAAAA;AACjC,IAAA,MAAMC,MAAAA,GAASC,aAAAA,EAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,aAAAA,EAAAA;AAEf,IAAA,MAAMC,cAAAA,GAAiB,UAAA;IAEvB,MAAMC,gBAAAA,GAAmB,CAACC,WAAAA,EAAaC,SAAAA,GAAAA;AACrC,QAAA,MAAMC,MAAAA,GAAS,CAAA,EAAGD,SAAAA,CAAAA,EAAYH,cAAAA,CAAe,CAAC,CAAC;AAC/C,QAAA,IAAI,CAACE,WAAAA,CAAYG,UAAU,CAACD,MAAAA,CAAAA,EAAS;YACnC,OAAO,IAAA;AACX,QAAA;AAEE,QAAA,MAAME,SAAAA,GAAYJ,WAAAA,CAAYK,KAAK,CAACH,OAAOI,MAAM,CAAA;QACjD,MAAM,CAACC,UAAUC,OAAAA,CAAQ,GAAGJ,UAAUK,KAAK,CAAC,GAAA,CAAA,CAAKC,MAAM,CAACC,OAAAA,CAAAA;AAExD,QAAA,IAAI,CAACJ,QAAAA,EAAU;YACb,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;AACLA,YAAAA,QAAAA;AACAK,YAAAA,UAAAA,EAAYJ,OAAAA,KAAY;AAC5B,SAAA;AACA,IAAA,CAAA;AAEA;;;AAGA,KACA,MAAMK,mBAAAA,GAAsB,CAACC,YAAAA,EAAcC,YAAAA,EAAcC,WAAAA,GAAAA;QACvD,MAAMC,QAAAA,GAAWzB,wBAAwB,CAACsB,YAAAA,CAAa;AACvD,QAAA,MAAMI,YAAYD,QAAAA,IAAY;AAC5BE,YAAAA,KAAAA,EAAOJ,aAAaI,KAAK;AACzBC,YAAAA,aAAAA,EAAeL,aAAaK,aAAa;AACzCC,YAAAA,UAAAA,EAAYN,aAAaM,UAAU;AACnCC,YAAAA,WAAAA,EAAaP,aAAaO,WAAW;AACrCC,YAAAA,eAAAA,EAAiBR,aAAaQ,eAAe;AAC7CC,YAAAA,0BAAAA,EAA4BT,aAAaS;AAC7C,SAAA;QAEE,IAAIN,SAAAA,CAAUC,KAAK,KAAK,CAAA,EAAG;YACzB,IAAI,CAACD,SAAAA,CAAUI,WAAW,IAAI,CAACJ,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;gBAC/E,OAAO,IAAA;AACb,YAAA;QACA,CAAA,MAAS,IAAI,CAACH,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;YAC5D,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;YACLI,IAAAA,EAAMX,YAAAA;AACN,YAAA,GAAGI,SAAS;AACZQ,YAAAA,GAAAA,EAAKX,aAAaW,GAAG;AACrBC,YAAAA,MAAAA,EAAQZ,aAAaY,MAAM;AAC3BC,YAAAA,KAAAA,EAAOb,aAAaa,KAAK;AACzBC,YAAAA,SAAAA,EAAWd,aAAac,SAAS;AACjCC,YAAAA,QAAAA,EAAUf,aAAae,QAAQ;YAC/BC,YAAAA,EAAcf;AAClB,SAAA;AACA,IAAA,CAAA;IAEA,MAAMgB,mBAAAA,GAAsB,CAACC,GAAAA,EAAKC,WAAAA,EAAaC,OAAAA,GAAAA;QAC7C,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAIH,WAAAA,CAAAA;AACpB,QAAA,MAAMI,SAAS,IAAIC,eAAAA,EAAAA;QAEnBC,MAAAA,CAAOC,OAAO,CAACN,OAAAA,CAAAA,CAASO,OAAO,CAAC,CAAC,CAAChB,KAAKiB,KAAAA,CAAM,GAAA;AAC3C,YAAA,IAAIjB,QAAQ,KAAA,EAAO;gBACjBc,MAAAA,CAAOC,OAAO,CAACE,KAAAA,CAAAA,CAAOD,OAAO,CAAC,CAAC,CAACE,QAAQC,QAAAA,CAAS,GAAA;oBAC/CP,MAAAA,CAAOQ,GAAG,CAAC,CAAC,IAAI,EAAEF,MAAAA,CAAO,CAAC,CAAC,EAAEG,MAAAA,CAAOF,QAAAA,CAAAA,CAAAA;AAC5C,gBAAA,CAAA,CAAA;AACM,gBAAA;AACN,YAAA;YACI,IAAIF,KAAAA,KAAUK,SAAAA,IAAaL,KAAAA,KAAU,IAAA,EAAM;gBACzCL,MAAAA,CAAOQ,GAAG,CAACpB,GAAAA,EAAKqB,MAAAA,CAAOJ,KAAAA,CAAAA,CAAAA;AAC7B,YAAA;AACA,QAAA,CAAA,CAAA;QAEEP,GAAAA,CAAIa,MAAM,GAAGX,MAAAA,CAAOY,QAAQ,EAAA;QAC5BjB,GAAAA,CAAIkB,QAAQ,CAACf,GAAAA,CAAIc,QAAQ,EAAA,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAME,uBAAuB,CAACnB,GAAAA,GAAAA;AAC5B,QAAA,MAAMoB,OAAAA,GAAUpB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA;AACnC,QAAA,OAAOA,OAAAA,GAAU;AAAEA,YAAAA;AAAO,SAAA,GAAK,EAAA;AACjC,IAAA,CAAA;AAEA,IAAA,MAAMG,eAAAA,GAAkB,OAAOvB,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,GAAAA;AACpD,QAAA,MAAM0C,YAAAA,GAAe,MAAMhE,MAAAA,CAAOgE,YAAY,CAAC;AAC7CC,YAAAA,UAAAA,EAAYpD,SAASe,WAAW;AAChCN,YAAAA,WAAAA;AACA4C,YAAAA,WAAAA,EAAarD,SAASmB,GAAG;AACzBmC,YAAAA,gBAAAA,EAAkBtD,SAASoB;AAC/B,SAAA,CAAA;QAEEM,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUkD,OAAOlD,QAAQ;YACzBuD,OAAAA,EAASJ;AACb,SAAA;QAEE,MAAMK,YAAAA,GAAe,CAAA,EAAGxD,QAAAA,CAASa,aAAa,CAAC,aAAa,EAAE4C,kBAAAA,CAAmBN,YAAAA,CAAaO,WAAW,CAAA,CAAA,CAAG;QAC5G,OAAOhC,GAAAA,CAAIkB,QAAQ,CAACY,YAAAA,CAAAA;AACtB,IAAA,CAAA;AAEA,IAAA,MAAMG,eAAAA,GAAkB,CAACjC,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,GAAAA;QAC9C,MAAMmD,KAAAA,GAAQvE,OAAOwE,aAAa,EAAA;QAClCnC,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUkD,OAAOlD,QAAQ;AACzB4D,YAAAA;AACJ,SAAA;AAEE,QAAA,IAAIJ,YAAAA,GAAenE,MAAAA,CAAOyE,iBAAiB,CAAC9D,QAAAA,EAAU;AACpDmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBV,YAAAA,WAAAA;AACAY,YAAAA,KAAAA,EAAOrB,SAASqB,KAAK;AACrBC,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;AAEEkC,QAAAA,YAAAA,IAAgB,CAAC,OAAO,EAAEC,kBAAAA,CAAmBG,KAAAA,CAAAA,CAAAA,CAAQ;QACrD,OAAOlC,GAAAA,CAAIkB,QAAQ,CAACY,YAAAA,CAAAA;AACtB,IAAA,CAAA;IAEA,MAAMO,oBAAAA,GAAuB,OAAOrC,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,GAAAA;AACjD,QAAA,MAAMoB,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;QACrC,MAAM,EAAEU,aAAaM,UAAU,EAAEC,gBAAgBC,aAAa,EAAE,GAAGxC,GAAAA,CAAIyC,KAAK;QAC5E,MAAMhB,YAAAA,GAAeJ,QAAQQ,OAAO;AAEpC,QAAA,IAAI,CAACJ,YAAAA,EAAcO,WAAAA,IAAeM,UAAAA,KAAeb,YAAAA,CAAaO,WAAW,EAAE;AACzE,YAAA,MAAM,IAAIU,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMC,aAAAA,GAAgB,MAAMlF,MAAAA,CAAOmF,WAAW,CAAC;AAC7CC,YAAAA,SAAAA,EAAWvE,SAASc,UAAU;AAC9BuC,YAAAA,WAAAA,EAAarD,SAASmB,GAAG;AACzBmC,YAAAA,gBAAAA,EAAkBtD,SAASoB,MAAM;AACjC4C,YAAAA,UAAAA;AACAE,YAAAA,aAAAA;AACAM,YAAAA,oBAAAA,EAAsBrB,aAAasB;AACvC,SAAA,CAAA;AAEE,QAAA,MAAM7C,OAAAA,GAAUvC,MAAAA,CAAOqF,oBAAoB,CAAC1E,QAAAA,EAAUqE,aAAAA,CAAAA;AACtD3C,QAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;QACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAaC,OAAAA,CAAAA;AAC/C,IAAA,CAAA;AAEA,IAAA,MAAM+C,oBAAAA,GAAuB,OAAOjD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,GAAAA;AAC9D,QAAA,MAAMsC,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;AACrC,QAAA,MAAM,EAAE4B,IAAI,EAAEhB,KAAAA,EAAOiB,UAAU,EAAEC,KAAK,EAAEC,iBAAAA,EAAmBC,gBAAgB,EAAE,GAAGtD,IAAIyC,KAAK;AAEzF,QAAA,IAAIW,KAAAA,EAAO;AACTpD,YAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;YACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;AAC3CmD,gBAAAA,KAAAA;gBACAC,iBAAAA,EAAmBC;AACzB,aAAA,CAAA;AACA,QAAA;AAEE,QAAA,IAAI,CAACJ,IAAAA,EAAM;AACT,YAAA,MAAM,IAAIR,KAAAA,CAAM,+BAAA,CAAA;AACpB,QAAA;;AAGE,QAAA,IAAI,CAACrB,OAAAA,CAAQa,KAAK,IAAIiB,UAAAA,KAAe9B,OAAAA,CAAQa,KAAK,EAAE;AAClD,YAAA,MAAM,IAAIQ,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMC,aAAAA,GAAgB,MAAMhF,MAAAA,CAAO4F,yBAAyB,CAACjF,QAAAA,EAAU;AACrEmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBC,YAAAA,MAAAA,EAAQpB,SAASoB,MAAM;AACvBX,YAAAA,WAAAA;AACAmE,YAAAA,IAAAA;AACAtD,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;AAEE,QAAA,MAAMM,OAAAA,GAAUvC,MAAAA,CAAOqF,oBAAoB,CAAC1E,QAAAA,EAAUqE,aAAAA,CAAAA;AACtD3C,QAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;QACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAaC,OAAAA,CAAAA;AAC/C,IAAA,CAAA;AAEA,IAAA,MAAMsD,4BAAAA,GAA+B,IAAA;AACnC,QAAA,OAAO,OAAOxD,GAAAA,EAAKyD,IAAAA,GAAAA;AACjB,YAAA,MAAMzF,SAAAA,GAAY0F,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,iBAAA,CAAA;YACpC,MAAM,CAAC7F,YAAY,GAAGiC,GAAAA,CAAI6B,OAAO,CAAC1B,GAAG,CAAC3B,KAAK,CAAC,GAAA,CAAA;YAC5C,MAAMgD,MAAAA,GAAS1D,iBAAiBC,WAAAA,EAAaC,SAAAA,CAAAA;AAE7C,YAAA,IAAI,CAACwD,MAAAA,EAAQ;gBACX,OAAOiC,IAAAA,EAAAA;AACb,YAAA;YAEI,IAAI,CAACzD,GAAAA,CAAIqB,OAAO,EAAE;gBAChBrB,GAAAA,CAAI6D,KAAK,CAAC,GAAA,EAAK,2CAAA,CAAA;AACrB,YAAA;AAEI,YAAA,MAAMC,eAAAA,GAAkB,MAAMJ,MAAAA,CAC3BK,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAUxE,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAO,aAAA,CAAA,CAC/DmE,GAAG,EAAA;AAEN,YAAA,MAAM9E,YAAAA,GAAegF,eAAAA,GAAkBtC,MAAAA,CAAOlD,QAAQ,CAAC;YACvD,IAAI,CAACQ,cAAcmF,OAAAA,EAAS;gBAC1B,MAAM,IAAI5G,MAAAA,CAAO6G,gBAAgB,CAAC,2BAAA,CAAA;AACxC,YAAA;YAEI,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AACvB,YAAA,MAAMrF,cAAcoF,UAAAA,CAAW,WAAA,CAAA,CAAaE,gBAAgB,CAAC7C,OAAOlD,QAAQ,CAAA;AAE5E,YAAA,MAAMgG,gBAAAA,GACJtE,GAAAA,CAAIkC,KAAK,CAACqC,YAAY,EAAE1E,QAAAA,IAAYG,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA,EAASvB,QAAAA;AAClE,YAAA,MAAM2E,kBAAkBF,gBAAAA,GACpB;AAAE,gBAAA,GAAGxF,YAAY;gBAAEe,QAAAA,EAAUyE;aAAgB,GAC7CxF,YAAAA;AAEJ,YAAA,MAAMR,QAAAA,GAAWM,mBAAAA,CAAoB4C,MAAAA,CAAOlD,QAAQ,EAAEkG,eAAAA,EAAiBzF,WAAAA,CAAAA;AAEvE,YAAA,IAAI,CAACT,QAAAA,EAAU;gBACb,MAAM,IAAIjB,MAAAA,CAAO6G,gBAAgB,CAAC,wBAAA,CAAA;AACxC,YAAA;YAEIlE,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAGtB,IAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;YAEzC,IAAI,CAACE,MAAAA,CAAO7C,UAAU,EAAE;gBACtB,IAAIL,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAOqC,eAAAA,CAAgBvB,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,CAAAA;AACtD,gBAAA;gBACM,OAAOkD,eAAAA,CAAgBjC,GAAAA,EAAK1B,QAAAA,EAAUkD,MAAAA,EAAQzC,WAAAA,CAAAA;AACpD,YAAA;YAEI,MAAMkB,WAAAA,GAAcuE,gBAAgB3E,QAAQ;AAC5C,YAAA,IAAI,CAACI,WAAAA,EAAa;gBAChB,MAAM,IAAI5C,MAAAA,CAAO6G,gBAAgB,CAAC,yCAAA,CAAA;AACxC,YAAA;YAEI,IAAI;gBACF,IAAI5F,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAO,MAAMmD,oBAAAA,CAAqBrC,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,CAAAA;AACzD,gBAAA;AACM,gBAAA,OAAO,MAAMgD,oBAAAA,CAAqBjD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,CAAAA;AACpE,YAAA,CAAA,CAAM,OAAO0F,GAAAA,EAAK;AACZzE,gBAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;gBACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;oBAC3CmD,KAAAA,EAAO,aAAA;AACPC,oBAAAA,iBAAAA,EAAmBoB,IAAIC;AAC/B,iBAAA,CAAA;AACA,YAAA;AACA,QAAA,CAAA;AACA,IAAA,CAAA;IAEAH,YAAAA,GAAiB;AACff,QAAAA,4BAAAA;AACA1F,QAAAA,gBAAAA;AACAc,QAAAA,mBAAAA;AACAmB,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"index.mjs","sources":["../../../../server/src/utils/oauth-connect/index.js"],"sourcesContent":["'use strict';\n\nconst { errors } = require('@strapi/utils');\n\nconst builtinProviderEndpoints = require('./providers');\nconst oauth1 = require('./oauth1');\nconst oauth2 = require('./oauth2');\nconst { trimGrantSessionResponse } = require('../trim-grant-session-response');\n\nconst CONNECT_PREFIX = '/connect';\n\nconst parseConnectPath = (requestPath, apiPrefix) => {\n  const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;\n  if (!requestPath.startsWith(prefix)) {\n    return null;\n  }\n\n  const remainder = requestPath.slice(prefix.length);\n  const [provider, segment] = remainder.split('/').filter(Boolean);\n\n  if (!provider) {\n    return null;\n  }\n\n  return {\n    provider,\n    isCallback: segment === 'callback',\n  };\n};\n\n/**\n * Resolve OAuth endpoint config from built-ins, falling back to store-defined\n * endpoints so custom providers registered via providers-registry still work.\n */\nconst buildProviderConfig = (providerName, storedConfig, redirectUri) => {\n  const defaults = builtinProviderEndpoints[providerName];\n  const endpoints = defaults || {\n    oauth: storedConfig.oauth,\n    authorize_url: storedConfig.authorize_url,\n    access_url: storedConfig.access_url,\n    request_url: storedConfig.request_url,\n    scope_delimiter: storedConfig.scope_delimiter,\n    token_endpoint_auth_method: storedConfig.token_endpoint_auth_method,\n  };\n\n  if (endpoints.oauth === 1) {\n    if (!endpoints.request_url || !endpoints.authorize_url || !endpoints.access_url) {\n      return null;\n    }\n  } else if (!endpoints.authorize_url || !endpoints.access_url) {\n    return null;\n  }\n\n  return {\n    name: providerName,\n    ...endpoints,\n    key: storedConfig.key,\n    secret: storedConfig.secret,\n    scope: storedConfig.scope,\n    subdomain: storedConfig.subdomain,\n    callback: storedConfig.callback,\n    redirect_uri: redirectUri,\n  };\n};\n\nconst redirectWithPayload = (ctx, callbackUrl, payload) => {\n  const url = new URL(callbackUrl);\n  const params = new URLSearchParams();\n\n  Object.entries(payload).forEach(([key, value]) => {\n    if (key === 'raw') {\n      Object.entries(value).forEach(([rawKey, rawValue]) => {\n        params.set(`raw[${rawKey}]`, String(rawValue));\n      });\n      return;\n    }\n    if (value !== undefined && value !== null) {\n      params.set(key, String(value));\n    }\n  });\n\n  url.search = params.toString();\n  ctx.redirect(url.toString());\n};\n\nconst preserveGrantDynamic = (ctx) => {\n  const dynamic = ctx.session.grant?.dynamic;\n  return dynamic ? { dynamic } : {};\n};\n\nconst redirectWithSessionResponse = (ctx, callbackUrl, provider, tokenResponse) => {\n  const grantResponse = oauth2.tokensToQueryPayload(provider, tokenResponse);\n  ctx.session.grant = {\n    response: trimGrantSessionResponse(grantResponse, provider.name),\n  };\n\n  return redirectWithPayload(ctx, callbackUrl, {});\n};\n\nconst startOAuth1Flow = async (ctx, provider, parsed, redirectUri) => {\n  const requestToken = await oauth1.requestToken({\n    requestUrl: provider.request_url,\n    redirectUri,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n  });\n\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    request: requestToken,\n  };\n\n  const authorizeUrl = `${provider.authorize_url}?oauth_token=${encodeURIComponent(requestToken.oauth_token)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst startOAuth2Flow = (ctx, provider, parsed, redirectUri) => {\n  const state = oauth2.generateState();\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    state,\n  };\n\n  let authorizeUrl = oauth2.buildAuthorizeUrl(provider, {\n    key: provider.key,\n    redirectUri,\n    scope: provider.scope,\n    subdomain: provider.subdomain,\n  });\n\n  authorizeUrl += `&state=${encodeURIComponent(state)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst handleOAuth1Callback = async (ctx, provider, callbackUrl) => {\n  const session = ctx.session.grant || {};\n  const { oauth_token: oauthToken, oauth_verifier: oauthVerifier } = ctx.query;\n  const requestToken = session.request;\n\n  if (!requestToken?.oauth_token || oauthToken !== requestToken.oauth_token) {\n    throw new Error('OAuth1 token mismatch');\n  }\n\n  const tokenResponse = await oauth1.accessToken({\n    accessUrl: provider.access_url,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n    oauthToken,\n    oauthVerifier,\n    oauthTokenCredential: requestToken.oauth_token_secret,\n  });\n\n  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);\n};\n\nconst handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) => {\n  const session = ctx.session.grant || {};\n  const { code, state: queryState, error, error_description: errorDescription } = ctx.query;\n\n  if (error) {\n    ctx.session.grant = {};\n    return redirectWithPayload(ctx, callbackUrl, {\n      error,\n      error_description: errorDescription,\n    });\n  }\n\n  if (!code) {\n    throw new Error('OAuth2 missing code parameter');\n  }\n\n  // Reject when session state is missing (not only on mismatch) to close login-CSRF.\n  if (!session.state || queryState !== session.state) {\n    throw new Error('OAuth2 state mismatch');\n  }\n\n  const tokenResponse = await oauth2.exchangeAuthorizationCode(provider, {\n    key: provider.key,\n    secret: provider.secret,\n    redirectUri,\n    code,\n    subdomain: provider.subdomain,\n  });\n\n  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);\n};\n\nconst createOAuthConnectMiddleware = () => {\n  return async (ctx, next) => {\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n    const [requestPath] = ctx.request.url.split('?');\n    const parsed = parseConnectPath(requestPath, apiPrefix);\n\n    if (!parsed) {\n      return next();\n    }\n\n    if (!ctx.session) {\n      ctx.throw(400, 'OAuth connect requires session middleware');\n    }\n\n    const storedProviders = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n      .get();\n\n    const storedConfig = storedProviders?.[parsed.provider];\n    if (!storedConfig?.enabled) {\n      throw new errors.ApplicationError('This provider is disabled');\n    }\n\n    const { getService } = require('..');\n    const redirectUri = getService('providers').buildRedirectUri(parsed.provider);\n\n    const callbackOverride =\n      ctx.state.oauthConnect?.callback ?? ctx.session.grant?.dynamic?.callback;\n    const effectiveConfig = callbackOverride\n      ? { ...storedConfig, callback: callbackOverride }\n      : storedConfig;\n\n    const provider = buildProviderConfig(parsed.provider, effectiveConfig, redirectUri);\n\n    if (!provider) {\n      throw new errors.ApplicationError('Unknown OAuth provider');\n    }\n\n    ctx.session.grant = ctx.session.grant || {};\n\n    if (!parsed.isCallback) {\n      if (provider.oauth === 1) {\n        return startOAuth1Flow(ctx, provider, parsed, redirectUri);\n      }\n      return startOAuth2Flow(ctx, provider, parsed, redirectUri);\n    }\n\n    const callbackUrl = effectiveConfig.callback;\n    if (!callbackUrl) {\n      throw new errors.ApplicationError('Provider callback URL is not configured');\n    }\n\n    try {\n      if (provider.oauth === 1) {\n        return await handleOAuth1Callback(ctx, provider, callbackUrl);\n      }\n      return await handleOAuth2Callback(ctx, provider, callbackUrl, redirectUri);\n    } catch (err) {\n      ctx.session.grant = {};\n      return redirectWithPayload(ctx, callbackUrl, {\n        error: 'oauth_error',\n        error_description: err.message,\n      });\n    }\n  };\n};\n\nmodule.exports = {\n  createOAuthConnectMiddleware,\n  parseConnectPath,\n  buildProviderConfig,\n  redirectWithPayload,\n};\n"],"names":["errors","require$$0","builtinProviderEndpoints","require$$1","oauth1","require$$2","oauth2","require$$3","trimGrantSessionResponse","require$$4","CONNECT_PREFIX","parseConnectPath","requestPath","apiPrefix","prefix","startsWith","remainder","slice","length","provider","segment","split","filter","Boolean","isCallback","buildProviderConfig","providerName","storedConfig","redirectUri","defaults","endpoints","oauth","authorize_url","access_url","request_url","scope_delimiter","token_endpoint_auth_method","name","key","secret","scope","subdomain","callback","redirect_uri","redirectWithPayload","ctx","callbackUrl","payload","url","URL","params","URLSearchParams","Object","entries","forEach","value","rawKey","rawValue","set","String","undefined","search","toString","redirect","preserveGrantDynamic","dynamic","session","grant","redirectWithSessionResponse","tokenResponse","grantResponse","tokensToQueryPayload","response","startOAuth1Flow","parsed","requestToken","requestUrl","consumerKey","clientCredential","request","authorizeUrl","encodeURIComponent","oauth_token","startOAuth2Flow","state","generateState","buildAuthorizeUrl","handleOAuth1Callback","oauthToken","oauth_verifier","oauthVerifier","query","Error","accessToken","accessUrl","oauthTokenCredential","oauth_token_secret","handleOAuth2Callback","code","queryState","error","error_description","errorDescription","exchangeAuthorizationCode","createOAuthConnectMiddleware","next","strapi","config","get","throw","storedProviders","store","type","enabled","ApplicationError","getService","require$$5","buildRedirectUri","callbackOverride","oauthConnect","effectiveConfig","err","message"],"mappings":";;;;;;;;;;;;IAEA,MAAM,EAAEA,MAAM,EAAE,GAAGC,UAAAA;AAEnB,IAAA,MAAMC,wBAAAA,GAA2BC,gBAAAA,EAAAA;AACjC,IAAA,MAAMC,MAAAA,GAASC,aAAAA,EAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,aAAAA,EAAAA;IACf,MAAM,EAAEC,wBAAwB,EAAE,GAAGC,+BAAAA,EAAAA;AAErC,IAAA,MAAMC,cAAAA,GAAiB,UAAA;IAEvB,MAAMC,gBAAAA,GAAmB,CAACC,WAAAA,EAAaC,SAAAA,GAAAA;AACrC,QAAA,MAAMC,MAAAA,GAAS,CAAA,EAAGD,SAAAA,CAAAA,EAAYH,cAAAA,CAAe,CAAC,CAAC;AAC/C,QAAA,IAAI,CAACE,WAAAA,CAAYG,UAAU,CAACD,MAAAA,CAAAA,EAAS;YACnC,OAAO,IAAA;AACX,QAAA;AAEE,QAAA,MAAME,SAAAA,GAAYJ,WAAAA,CAAYK,KAAK,CAACH,OAAOI,MAAM,CAAA;QACjD,MAAM,CAACC,UAAUC,OAAAA,CAAQ,GAAGJ,UAAUK,KAAK,CAAC,GAAA,CAAA,CAAKC,MAAM,CAACC,OAAAA,CAAAA;AAExD,QAAA,IAAI,CAACJ,QAAAA,EAAU;YACb,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;AACLA,YAAAA,QAAAA;AACAK,YAAAA,UAAAA,EAAYJ,OAAAA,KAAY;AAC5B,SAAA;AACA,IAAA,CAAA;AAEA;;;AAGA,KACA,MAAMK,mBAAAA,GAAsB,CAACC,YAAAA,EAAcC,YAAAA,EAAcC,WAAAA,GAAAA;QACvD,MAAMC,QAAAA,GAAW3B,wBAAwB,CAACwB,YAAAA,CAAa;AACvD,QAAA,MAAMI,YAAYD,QAAAA,IAAY;AAC5BE,YAAAA,KAAAA,EAAOJ,aAAaI,KAAK;AACzBC,YAAAA,aAAAA,EAAeL,aAAaK,aAAa;AACzCC,YAAAA,UAAAA,EAAYN,aAAaM,UAAU;AACnCC,YAAAA,WAAAA,EAAaP,aAAaO,WAAW;AACrCC,YAAAA,eAAAA,EAAiBR,aAAaQ,eAAe;AAC7CC,YAAAA,0BAAAA,EAA4BT,aAAaS;AAC7C,SAAA;QAEE,IAAIN,SAAAA,CAAUC,KAAK,KAAK,CAAA,EAAG;YACzB,IAAI,CAACD,SAAAA,CAAUI,WAAW,IAAI,CAACJ,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;gBAC/E,OAAO,IAAA;AACb,YAAA;QACA,CAAA,MAAS,IAAI,CAACH,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;YAC5D,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;YACLI,IAAAA,EAAMX,YAAAA;AACN,YAAA,GAAGI,SAAS;AACZQ,YAAAA,GAAAA,EAAKX,aAAaW,GAAG;AACrBC,YAAAA,MAAAA,EAAQZ,aAAaY,MAAM;AAC3BC,YAAAA,KAAAA,EAAOb,aAAaa,KAAK;AACzBC,YAAAA,SAAAA,EAAWd,aAAac,SAAS;AACjCC,YAAAA,QAAAA,EAAUf,aAAae,QAAQ;YAC/BC,YAAAA,EAAcf;AAClB,SAAA;AACA,IAAA,CAAA;IAEA,MAAMgB,mBAAAA,GAAsB,CAACC,GAAAA,EAAKC,WAAAA,EAAaC,OAAAA,GAAAA;QAC7C,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAIH,WAAAA,CAAAA;AACpB,QAAA,MAAMI,SAAS,IAAIC,eAAAA,EAAAA;QAEnBC,MAAAA,CAAOC,OAAO,CAACN,OAAAA,CAAAA,CAASO,OAAO,CAAC,CAAC,CAAChB,KAAKiB,KAAAA,CAAM,GAAA;AAC3C,YAAA,IAAIjB,QAAQ,KAAA,EAAO;gBACjBc,MAAAA,CAAOC,OAAO,CAACE,KAAAA,CAAAA,CAAOD,OAAO,CAAC,CAAC,CAACE,QAAQC,QAAAA,CAAS,GAAA;oBAC/CP,MAAAA,CAAOQ,GAAG,CAAC,CAAC,IAAI,EAAEF,MAAAA,CAAO,CAAC,CAAC,EAAEG,MAAAA,CAAOF,QAAAA,CAAAA,CAAAA;AAC5C,gBAAA,CAAA,CAAA;AACM,gBAAA;AACN,YAAA;YACI,IAAIF,KAAAA,KAAUK,SAAAA,IAAaL,KAAAA,KAAU,IAAA,EAAM;gBACzCL,MAAAA,CAAOQ,GAAG,CAACpB,GAAAA,EAAKqB,MAAAA,CAAOJ,KAAAA,CAAAA,CAAAA;AAC7B,YAAA;AACA,QAAA,CAAA,CAAA;QAEEP,GAAAA,CAAIa,MAAM,GAAGX,MAAAA,CAAOY,QAAQ,EAAA;QAC5BjB,GAAAA,CAAIkB,QAAQ,CAACf,GAAAA,CAAIc,QAAQ,EAAA,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAME,uBAAuB,CAACnB,GAAAA,GAAAA;AAC5B,QAAA,MAAMoB,OAAAA,GAAUpB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA;AACnC,QAAA,OAAOA,OAAAA,GAAU;AAAEA,YAAAA;AAAO,SAAA,GAAK,EAAA;AACjC,IAAA,CAAA;AAEA,IAAA,MAAMG,2BAAAA,GAA8B,CAACvB,GAAAA,EAAKC,WAAAA,EAAa3B,QAAAA,EAAUkD,aAAAA,GAAAA;AAC/D,QAAA,MAAMC,aAAAA,GAAgBhE,MAAAA,CAAOiE,oBAAoB,CAACpD,QAAAA,EAAUkD,aAAAA,CAAAA;QAC5DxB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;YAClBK,QAAAA,EAAUhE,wBAAAA,CAAyB8D,aAAAA,EAAenD,QAAAA,CAASkB,IAAI;AACnE,SAAA;QAEE,OAAOO,mBAAAA,CAAoBC,GAAAA,EAAKC,WAAAA,EAAa;AAC/C,IAAA,CAAA;AAEA,IAAA,MAAM2B,eAAAA,GAAkB,OAAO5B,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,GAAAA;AACpD,QAAA,MAAM+C,YAAAA,GAAe,MAAMvE,MAAAA,CAAOuE,YAAY,CAAC;AAC7CC,YAAAA,UAAAA,EAAYzD,SAASe,WAAW;AAChCN,YAAAA,WAAAA;AACAiD,YAAAA,WAAAA,EAAa1D,SAASmB,GAAG;AACzBwC,YAAAA,gBAAAA,EAAkB3D,SAASoB;AAC/B,SAAA,CAAA;QAEEM,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUuD,OAAOvD,QAAQ;YACzB4D,OAAAA,EAASJ;AACb,SAAA;QAEE,MAAMK,YAAAA,GAAe,CAAA,EAAG7D,QAAAA,CAASa,aAAa,CAAC,aAAa,EAAEiD,kBAAAA,CAAmBN,YAAAA,CAAaO,WAAW,CAAA,CAAA,CAAG;QAC5G,OAAOrC,GAAAA,CAAIkB,QAAQ,CAACiB,YAAAA,CAAAA;AACtB,IAAA,CAAA;AAEA,IAAA,MAAMG,eAAAA,GAAkB,CAACtC,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,GAAAA;QAC9C,MAAMwD,KAAAA,GAAQ9E,OAAO+E,aAAa,EAAA;QAClCxC,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUuD,OAAOvD,QAAQ;AACzBiE,YAAAA;AACJ,SAAA;AAEE,QAAA,IAAIJ,YAAAA,GAAe1E,MAAAA,CAAOgF,iBAAiB,CAACnE,QAAAA,EAAU;AACpDmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBV,YAAAA,WAAAA;AACAY,YAAAA,KAAAA,EAAOrB,SAASqB,KAAK;AACrBC,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;AAEEuC,QAAAA,YAAAA,IAAgB,CAAC,OAAO,EAAEC,kBAAAA,CAAmBG,KAAAA,CAAAA,CAAAA,CAAQ;QACrD,OAAOvC,GAAAA,CAAIkB,QAAQ,CAACiB,YAAAA,CAAAA;AACtB,IAAA,CAAA;IAEA,MAAMO,oBAAAA,GAAuB,OAAO1C,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,GAAAA;AACjD,QAAA,MAAMoB,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;QACrC,MAAM,EAAEe,aAAaM,UAAU,EAAEC,gBAAgBC,aAAa,EAAE,GAAG7C,GAAAA,CAAI8C,KAAK;QAC5E,MAAMhB,YAAAA,GAAeT,QAAQa,OAAO;AAEpC,QAAA,IAAI,CAACJ,YAAAA,EAAcO,WAAAA,IAAeM,UAAAA,KAAeb,YAAAA,CAAaO,WAAW,EAAE;AACzE,YAAA,MAAM,IAAIU,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMvB,aAAAA,GAAgB,MAAMjE,MAAAA,CAAOyF,WAAW,CAAC;AAC7CC,YAAAA,SAAAA,EAAW3E,SAASc,UAAU;AAC9B4C,YAAAA,WAAAA,EAAa1D,SAASmB,GAAG;AACzBwC,YAAAA,gBAAAA,EAAkB3D,SAASoB,MAAM;AACjCiD,YAAAA,UAAAA;AACAE,YAAAA,aAAAA;AACAK,YAAAA,oBAAAA,EAAsBpB,aAAaqB;AACvC,SAAA,CAAA;QAEE,OAAO5B,2BAAAA,CAA4BvB,GAAAA,EAAKC,WAAAA,EAAa3B,QAAAA,EAAUkD,aAAAA,CAAAA;AACjE,IAAA,CAAA;AAEA,IAAA,MAAM4B,oBAAAA,GAAuB,OAAOpD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,GAAAA;AAC9D,QAAA,MAAMsC,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;AACrC,QAAA,MAAM,EAAE+B,IAAI,EAAEd,KAAAA,EAAOe,UAAU,EAAEC,KAAK,EAAEC,iBAAAA,EAAmBC,gBAAgB,EAAE,GAAGzD,IAAI8C,KAAK;AAEzF,QAAA,IAAIS,KAAAA,EAAO;AACTvD,YAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;YACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;AAC3CsD,gBAAAA,KAAAA;gBACAC,iBAAAA,EAAmBC;AACzB,aAAA,CAAA;AACA,QAAA;AAEE,QAAA,IAAI,CAACJ,IAAAA,EAAM;AACT,YAAA,MAAM,IAAIN,KAAAA,CAAM,+BAAA,CAAA;AACpB,QAAA;;AAGE,QAAA,IAAI,CAAC1B,OAAAA,CAAQkB,KAAK,IAAIe,UAAAA,KAAejC,OAAAA,CAAQkB,KAAK,EAAE;AAClD,YAAA,MAAM,IAAIQ,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMvB,aAAAA,GAAgB,MAAM/D,MAAAA,CAAOiG,yBAAyB,CAACpF,QAAAA,EAAU;AACrEmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBC,YAAAA,MAAAA,EAAQpB,SAASoB,MAAM;AACvBX,YAAAA,WAAAA;AACAsE,YAAAA,IAAAA;AACAzD,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;QAEE,OAAO2B,2BAAAA,CAA4BvB,GAAAA,EAAKC,WAAAA,EAAa3B,QAAAA,EAAUkD,aAAAA,CAAAA;AACjE,IAAA,CAAA;AAEA,IAAA,MAAMmC,4BAAAA,GAA+B,IAAA;AACnC,QAAA,OAAO,OAAO3D,GAAAA,EAAK4D,IAAAA,GAAAA;AACjB,YAAA,MAAM5F,SAAAA,GAAY6F,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,iBAAA,CAAA;YACpC,MAAM,CAAChG,YAAY,GAAGiC,GAAAA,CAAIkC,OAAO,CAAC/B,GAAG,CAAC3B,KAAK,CAAC,GAAA,CAAA;YAC5C,MAAMqD,MAAAA,GAAS/D,iBAAiBC,WAAAA,EAAaC,SAAAA,CAAAA;AAE7C,YAAA,IAAI,CAAC6D,MAAAA,EAAQ;gBACX,OAAO+B,IAAAA,EAAAA;AACb,YAAA;YAEI,IAAI,CAAC5D,GAAAA,CAAIqB,OAAO,EAAE;gBAChBrB,GAAAA,CAAIgE,KAAK,CAAC,GAAA,EAAK,2CAAA,CAAA;AACrB,YAAA;AAEI,YAAA,MAAMC,eAAAA,GAAkB,MAAMJ,MAAAA,CAC3BK,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAU3E,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAO,aAAA,CAAA,CAC/DsE,GAAG,EAAA;AAEN,YAAA,MAAMjF,YAAAA,GAAemF,eAAAA,GAAkBpC,MAAAA,CAAOvD,QAAQ,CAAC;YACvD,IAAI,CAACQ,cAAcsF,OAAAA,EAAS;gBAC1B,MAAM,IAAIjH,MAAAA,CAAOkH,gBAAgB,CAAC,2BAAA,CAAA;AACxC,YAAA;YAEI,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AACvB,YAAA,MAAMxF,cAAcuF,UAAAA,CAAW,WAAA,CAAA,CAAaE,gBAAgB,CAAC3C,OAAOvD,QAAQ,CAAA;AAE5E,YAAA,MAAMmG,gBAAAA,GACJzE,GAAAA,CAAIuC,KAAK,CAACmC,YAAY,EAAE7E,QAAAA,IAAYG,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA,EAASvB,QAAAA;AAClE,YAAA,MAAM8E,kBAAkBF,gBAAAA,GACpB;AAAE,gBAAA,GAAG3F,YAAY;gBAAEe,QAAAA,EAAU4E;aAAgB,GAC7C3F,YAAAA;AAEJ,YAAA,MAAMR,QAAAA,GAAWM,mBAAAA,CAAoBiD,MAAAA,CAAOvD,QAAQ,EAAEqG,eAAAA,EAAiB5F,WAAAA,CAAAA;AAEvE,YAAA,IAAI,CAACT,QAAAA,EAAU;gBACb,MAAM,IAAInB,MAAAA,CAAOkH,gBAAgB,CAAC,wBAAA,CAAA;AACxC,YAAA;YAEIrE,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAGtB,IAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;YAEzC,IAAI,CAACO,MAAAA,CAAOlD,UAAU,EAAE;gBACtB,IAAIL,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAO0C,eAAAA,CAAgB5B,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,CAAAA;AACtD,gBAAA;gBACM,OAAOuD,eAAAA,CAAgBtC,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,CAAAA;AACpD,YAAA;YAEI,MAAMkB,WAAAA,GAAc0E,gBAAgB9E,QAAQ;AAC5C,YAAA,IAAI,CAACI,WAAAA,EAAa;gBAChB,MAAM,IAAI9C,MAAAA,CAAOkH,gBAAgB,CAAC,yCAAA,CAAA;AACxC,YAAA;YAEI,IAAI;gBACF,IAAI/F,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAO,MAAMwD,oBAAAA,CAAqB1C,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,CAAAA;AACzD,gBAAA;AACM,gBAAA,OAAO,MAAMmD,oBAAAA,CAAqBpD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,CAAAA;AACpE,YAAA,CAAA,CAAM,OAAO6F,GAAAA,EAAK;AACZ5E,gBAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;gBACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;oBAC3CsD,KAAAA,EAAO,aAAA;AACPC,oBAAAA,iBAAAA,EAAmBoB,IAAIC;AAC/B,iBAAA,CAAA;AACA,YAAA;AACA,QAAA,CAAA;AACA,IAAA,CAAA;IAEAH,YAAAA,GAAiB;AACff,QAAAA,4BAAAA;AACA7F,QAAAA,gBAAAA;AACAc,QAAAA,mBAAAA;AACAmB,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/trim-grant-session-response.js

@@ -0,0 +1,67 @@
+'use strict';
+
+var trimGrantSessionResponse_1;
+var hasRequiredTrimGrantSessionResponse;
+function requireTrimGrantSessionResponse() {
+    if (hasRequiredTrimGrantSessionResponse) return trimGrantSessionResponse_1;
+    hasRequiredTrimGrantSessionResponse = 1;
+    const compact = (value)=>{
+        if (value === null || value === undefined) {
+            return undefined;
+        }
+        if (typeof value !== 'object' || Array.isArray(value)) {
+            return value;
+        }
+        return Object.fromEntries(Object.entries(value).map(([key, entry])=>[
+                key,
+                compact(entry)
+            ]).filter(([, entry])=>entry !== undefined));
+    };
+    /**
+	 * Compact grant's OAuth token response before it is written to the signed
+	 * koa-session cookie. The full token exchange payload (especially Cognito's
+	 * dual JWTs plus a duplicated raw blob) can exceed the browser's ~4 KB
+	 * per-cookie limit and silently break the auth callback.
+	 *
+	 * Keep only fields that auth.callback / providers-registry actually read.
+	 */ const trimGrantSessionResponse = (grantResponse, provider)=>{
+        if (!grantResponse || typeof grantResponse !== 'object') {
+            return grantResponse;
+        }
+        switch(provider){
+            case 'cognito':
+                return compact({
+                    id_token: grantResponse.id_token
+                });
+            case 'twitter':
+                return compact({
+                    access_token: grantResponse.access_token,
+                    access_secret: grantResponse.access_secret,
+                    raw: grantResponse.raw?.screen_name ? {
+                        screen_name: grantResponse.raw.screen_name
+                    } : undefined
+                });
+            case 'vk':
+                return compact({
+                    access_token: grantResponse.access_token,
+                    raw: grantResponse.raw?.email != null && grantResponse.raw?.user_id != null ? {
+                        email: grantResponse.raw.email,
+                        user_id: grantResponse.raw.user_id
+                    } : undefined
+                });
+            default:
+                return compact({
+                    access_token: grantResponse.access_token,
+                    oauth_token: grantResponse.oauth_token,
+                    id_token: grantResponse.id_token
+                });
+        }
+    };
+    trimGrantSessionResponse_1 = {
+        trimGrantSessionResponse
+    };
+    return trimGrantSessionResponse_1;
+}
+
+exports.__require = requireTrimGrantSessionResponse;
+//# sourceMappingURL=trim-grant-session-response.js.map

package/dist/server/utils/trim-grant-session-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trim-grant-session-response.js","sources":["../../../server/src/utils/trim-grant-session-response.js"],"sourcesContent":["'use strict';\n\nconst compact = (value) => {\n  if (value === null || value === undefined) {\n    return undefined;\n  }\n\n  if (typeof value !== 'object' || Array.isArray(value)) {\n    return value;\n  }\n\n  return Object.fromEntries(\n    Object.entries(value)\n      .map(([key, entry]) => [key, compact(entry)])\n      .filter(([, entry]) => entry !== undefined)\n  );\n};\n\n/**\n * Compact grant's OAuth token response before it is written to the signed\n * koa-session cookie. The full token exchange payload (especially Cognito's\n * dual JWTs plus a duplicated raw blob) can exceed the browser's ~4 KB\n * per-cookie limit and silently break the auth callback.\n *\n * Keep only fields that auth.callback / providers-registry actually read.\n */\nconst trimGrantSessionResponse = (grantResponse, provider) => {\n  if (!grantResponse || typeof grantResponse !== 'object') {\n    return grantResponse;\n  }\n\n  switch (provider) {\n    case 'cognito':\n      return compact({\n        id_token: grantResponse.id_token,\n      });\n\n    case 'twitter':\n      return compact({\n        access_token: grantResponse.access_token,\n        access_secret: grantResponse.access_secret,\n        raw: grantResponse.raw?.screen_name\n          ? { screen_name: grantResponse.raw.screen_name }\n          : undefined,\n      });\n\n    case 'vk':\n      return compact({\n        access_token: grantResponse.access_token,\n        raw:\n          grantResponse.raw?.email != null && grantResponse.raw?.user_id != null\n            ? {\n                email: grantResponse.raw.email,\n                user_id: grantResponse.raw.user_id,\n              }\n            : undefined,\n      });\n\n    default:\n      return compact({\n        access_token: grantResponse.access_token,\n        oauth_token: grantResponse.oauth_token,\n        id_token: grantResponse.id_token,\n      });\n  }\n};\n\nmodule.exports = {\n  trimGrantSessionResponse,\n};\n"],"names":["compact","value","undefined","Array","isArray","Object","fromEntries","entries","map","key","entry","filter","trimGrantSessionResponse","grantResponse","provider","id_token","access_token","access_secret","raw","screen_name","email","user_id","oauth_token","trimGrantSessionResponse_1"],"mappings":";;;;;;;AAEA,IAAA,MAAMA,UAAU,CAACC,KAAAA,GAAAA;QACf,IAAIA,KAAAA,KAAU,IAAA,IAAQA,KAAAA,KAAUC,SAAAA,EAAW;YACzC,OAAOA,SAAAA;AACX,QAAA;AAEE,QAAA,IAAI,OAAOD,KAAAA,KAAU,QAAA,IAAYE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;YACrD,OAAOA,KAAAA;AACX,QAAA;AAEE,QAAA,OAAOI,MAAAA,CAAOC,WAAW,CACvBD,MAAAA,CAAOE,OAAO,CAACN,KAAAA,CAAAA,CACZO,GAAG,CAAC,CAAC,CAACC,GAAAA,EAAKC,MAAM,GAAK;AAACD,gBAAAA,GAAAA;gBAAKT,OAAAA,CAAQU,KAAAA;AAAO,aAAA,CAAA,CAC3CC,MAAM,CAAC,CAAC,GAAGD,KAAAA,CAAM,GAAKA,KAAAA,KAAUR,SAAAA,CAAAA,CAAAA;AAEvC,IAAA,CAAA;AAEA;;;;;;;KAQA,MAAMU,wBAAAA,GAA2B,CAACC,aAAAA,EAAeC,QAAAA,GAAAA;AAC/C,QAAA,IAAI,CAACD,aAAAA,IAAiB,OAAOA,aAAAA,KAAkB,QAAA,EAAU;YACvD,OAAOA,aAAAA;AACX,QAAA;QAEE,OAAQC,QAAAA;YACN,KAAK,SAAA;AACH,gBAAA,OAAOd,OAAAA,CAAQ;AACbe,oBAAAA,QAAAA,EAAUF,cAAcE;AAChC,iBAAA,CAAA;YAEI,KAAK,SAAA;AACH,gBAAA,OAAOf,OAAAA,CAAQ;AACbgB,oBAAAA,YAAAA,EAAcH,cAAcG,YAAY;AACxCC,oBAAAA,aAAAA,EAAeJ,cAAcI,aAAa;oBAC1CC,GAAAA,EAAKL,aAAAA,CAAcK,GAAG,EAAEC,WAAAA,GACpB;wBAAEA,WAAAA,EAAaN,aAAAA,CAAcK,GAAG,CAACC;qBAAW,GAC5CjB;AACZ,iBAAA,CAAA;YAEI,KAAK,IAAA;AACH,gBAAA,OAAOF,OAAAA,CAAQ;AACbgB,oBAAAA,YAAAA,EAAcH,cAAcG,YAAY;oBACxCE,GAAAA,EACEL,aAAAA,CAAcK,GAAG,EAAEE,KAAAA,IAAS,QAAQP,aAAAA,CAAcK,GAAG,EAAEG,OAAAA,IAAW,IAAA,GAC9D;wBACED,KAAAA,EAAOP,aAAAA,CAAcK,GAAG,CAACE,KAAK;wBAC9BC,OAAAA,EAASR,aAAAA,CAAcK,GAAG,CAACG;qBAC3C,GACcnB;AACd,iBAAA,CAAA;AAEI,YAAA;AACE,gBAAA,OAAOF,OAAAA,CAAQ;AACbgB,oBAAAA,YAAAA,EAAcH,cAAcG,YAAY;AACxCM,oBAAAA,WAAAA,EAAaT,cAAcS,WAAW;AACtCP,oBAAAA,QAAAA,EAAUF,cAAcE;AAChC,iBAAA,CAAA;AACA;AACA,IAAA,CAAA;IAEAQ,0BAAAA,GAAiB;AACfX,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/trim-grant-session-response.mjs

@@ -0,0 +1,65 @@
+var trimGrantSessionResponse_1;
+var hasRequiredTrimGrantSessionResponse;
+function requireTrimGrantSessionResponse() {
+    if (hasRequiredTrimGrantSessionResponse) return trimGrantSessionResponse_1;
+    hasRequiredTrimGrantSessionResponse = 1;
+    const compact = (value)=>{
+        if (value === null || value === undefined) {
+            return undefined;
+        }
+        if (typeof value !== 'object' || Array.isArray(value)) {
+            return value;
+        }
+        return Object.fromEntries(Object.entries(value).map(([key, entry])=>[
+                key,
+                compact(entry)
+            ]).filter(([, entry])=>entry !== undefined));
+    };
+    /**
+	 * Compact grant's OAuth token response before it is written to the signed
+	 * koa-session cookie. The full token exchange payload (especially Cognito's
+	 * dual JWTs plus a duplicated raw blob) can exceed the browser's ~4 KB
+	 * per-cookie limit and silently break the auth callback.
+	 *
+	 * Keep only fields that auth.callback / providers-registry actually read.
+	 */ const trimGrantSessionResponse = (grantResponse, provider)=>{
+        if (!grantResponse || typeof grantResponse !== 'object') {
+            return grantResponse;
+        }
+        switch(provider){
+            case 'cognito':
+                return compact({
+                    id_token: grantResponse.id_token
+                });
+            case 'twitter':
+                return compact({
+                    access_token: grantResponse.access_token,
+                    access_secret: grantResponse.access_secret,
+                    raw: grantResponse.raw?.screen_name ? {
+                        screen_name: grantResponse.raw.screen_name
+                    } : undefined
+                });
+            case 'vk':
+                return compact({
+                    access_token: grantResponse.access_token,
+                    raw: grantResponse.raw?.email != null && grantResponse.raw?.user_id != null ? {
+                        email: grantResponse.raw.email,
+                        user_id: grantResponse.raw.user_id
+                    } : undefined
+                });
+            default:
+                return compact({
+                    access_token: grantResponse.access_token,
+                    oauth_token: grantResponse.oauth_token,
+                    id_token: grantResponse.id_token
+                });
+        }
+    };
+    trimGrantSessionResponse_1 = {
+        trimGrantSessionResponse
+    };
+    return trimGrantSessionResponse_1;
+}
+
+export { requireTrimGrantSessionResponse as __require };
+//# sourceMappingURL=trim-grant-session-response.mjs.map