@strapi/plugin-users-permissions 5.56.0 → 5.57.0

package/dist/server/services/users-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"users-permissions.js","sources":["../../../server/src/services/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst _ = require('lodash');\nconst { filter, map, pipe, prop } = require('lodash/fp');\nconst urlJoin = require('url-join');\nconst {\n  template: { createStrictInterpolationRegExp },\n  errors,\n  objects,\n  sanitizeRoutesMapForSerialization,\n} = require('@strapi/utils');\n\nconst { getService } = require('../utils');\n\nconst DEFAULT_PERMISSIONS = [\n  { action: 'plugin::users-permissions.auth.callback', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.connect', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.forgotPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.resetPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.register', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.emailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.sendEmailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.refresh', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.logout', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.getSessions', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.revokeSession', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.user.me', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.changePassword', roleType: 'authenticated' },\n];\n\nconst transformRoutePrefixFor = (pluginName) => (route) => {\n  const prefix = route.config && route.config.prefix;\n  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;\n\n  return {\n    ...route,\n    path,\n  };\n};\n\nmodule.exports = ({ strapi }) => ({\n  getActions({ defaultEnable = false } = {}) {\n    const actionMap = {};\n\n    const isContentApi = (action) => {\n      if (!_.has(action, Symbol.for('__type__'))) {\n        return false;\n      }\n\n      return action[Symbol.for('__type__')].includes('content-api');\n    };\n\n    for (const [apiName, api] of Object.entries(strapi.apis)) {\n      const controllers = _.reduce(\n        api.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`api::${apiName}`] = { controllers };\n      }\n    }\n\n    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {\n      const controllers = _.reduce(\n        plugin.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`plugin::${pluginName}`] = { controllers };\n      }\n    }\n\n    // Return a deeply cloned version to avoid circular references\n    return _.cloneDeep(actionMap);\n  },\n\n  async getRoutes() {\n    const routesMap = {};\n\n    for (const [apiName, api] of Object.entries(strapi.apis)) {\n      const routes = _.flatMap(api.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes;\n        }\n\n        return route;\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`api::${apiName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    }\n\n    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {\n      const transformPrefix = transformRoutePrefixFor(pluginName);\n\n      const routes = _.flatMap(plugin.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes.map(transformPrefix);\n        }\n\n        return transformPrefix(route);\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    }\n\n    return sanitizeRoutesMapForSerialization(routesMap);\n  },\n\n  async syncPermissions() {\n    const roles = await strapi.db.query('plugin::users-permissions.role').findMany();\n    const dbPermissions = await strapi.db.query('plugin::users-permissions.permission').findMany();\n\n    const permissionsFoundInDB = _.uniq(_.map(dbPermissions, 'action'));\n\n    const appActions = _.flatMap(strapi.apis, (api, apiName) => {\n      return _.flatMap(api.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `api::${apiName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const pluginsActions = _.flatMap(strapi.plugins, (plugin, pluginName) => {\n      return _.flatMap(plugin.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `plugin::${pluginName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const allActions = [...appActions, ...pluginsActions];\n\n    const toDelete = _.difference(permissionsFoundInDB, allActions);\n\n    await Promise.all(\n      toDelete.map((action) => {\n        return strapi.db\n          .query('plugin::users-permissions.permission')\n          .delete({ where: { action } });\n      })\n    );\n\n    if (permissionsFoundInDB.length === 0) {\n      // create default permissions\n      for (const role of roles) {\n        const toCreate = pipe(\n          filter(({ roleType }) => roleType === role.type || roleType === null),\n          map(prop('action'))\n        )(DEFAULT_PERMISSIONS);\n\n        await Promise.all(\n          toCreate.map((action) => {\n            return strapi.db.query('plugin::users-permissions.permission').create({\n              data: {\n                action,\n                role: role.id,\n              },\n            });\n          })\n        );\n      }\n    }\n  },\n\n  async initialize() {\n    const roleCount = await strapi.db.query('plugin::users-permissions.role').count();\n\n    if (roleCount === 0) {\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Authenticated',\n          description: 'Default role given to authenticated user.',\n          type: 'authenticated',\n        },\n      });\n\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Public',\n          description: 'Default role given to unauthenticated user.',\n          type: 'public',\n        },\n      });\n    }\n\n    return getService('users-permissions').syncPermissions();\n  },\n\n  async updateUserRole(user, role) {\n    return strapi.db\n      .query('plugin::users-permissions.user')\n      .update({ where: { id: user.id }, data: { role } });\n  },\n\n  template(layout, data) {\n    const allowedTemplateVariables = objects.keysDeep(data);\n\n    // Create a strict interpolation RegExp based on possible variable names\n    const interpolate = createStrictInterpolationRegExp(allowedTemplateVariables, 'g');\n\n    try {\n      return _.template(layout, { interpolate, evaluate: false, escape: false })(data);\n    } catch {\n      throw new errors.ApplicationError('Invalid email template');\n    }\n  },\n});\n"],"names":["_","require$$0","filter","map","pipe","prop","require$$1","urlJoin","require$$2","template","createStrictInterpolationRegExp","errors","objects","sanitizeRoutesMapForSerialization","require$$3","getService","require$$4","DEFAULT_PERMISSIONS","action","roleType","transformRoutePrefixFor","pluginName","route","prefix","config","path","undefined","usersPermissions","strapi","getActions","defaultEnable","actionMap","isContentApi","has","Symbol","for","includes","apiName","api","Object","entries","apis","controllers","reduce","acc","controller","controllerName","contentApiActions","pickBy","isEmpty","mapValues","enabled","policy","plugin","plugins","cloneDeep","getRoutes","routesMap","routes","flatMap","info","type","length","apiPrefix","get","transformPrefix","syncPermissions","roles","db","query","findMany","dbPermissions","permissionsFoundInDB","uniq","appActions","keys","actionName","pluginsActions","allActions","toDelete","difference","Promise","all","delete","where","role","toCreate","create","data","id","initialize","roleCount","count","name","description","updateUserRole","user","update","layout","allowedTemplateVariables","keysDeep","interpolate","evaluate","escape","ApplicationError"],"mappings":";;;;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAMA,CAAAA,GAAIC,6BAAAA;IACV,MAAM,EAAEC,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGC,2BAAAA;AACpC,IAAA,MAAMC,OAAAA,GAAUC,2BAAAA;AAChB,IAAA,MAAM,EACJC,QAAAA,EAAU,EAAEC,+BAA+B,EAAE,EAC7CC,MAAM,EACNC,OAAO,EACPC,iCAAiC,EAClC,GAAGC,2BAAAA;IAEJ,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB;AAC1B,QAAA;YAAEC,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAQ,SAAA;AAC7E,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAQ,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,kDAAA;YAAoDC,QAAAA,EAAU;AAAQ,SAAA;AAChF,QAAA;YAAED,MAAAA,EAAQ,sDAAA;YAAwDC,QAAAA,EAAU;AAAQ,SAAA;AACpF,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,uCAAA;YAAyCC,QAAAA,EAAU;AAAe,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,4CAAA;YAA8CC,QAAAA,EAAU;AAAe,SAAA;AACjF,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAe,SAAA;AACnF,QAAA;YAAED,MAAAA,EAAQ,mCAAA;YAAqCC,QAAAA,EAAU;AAAe,SAAA;AACxE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAe;AACrF,KAAA;IAED,MAAMC,uBAAAA,GAA0B,CAACC,UAAAA,GAAe,CAACC,KAAAA,GAAAA;AAC/C,YAAA,MAAMC,SAASD,KAAAA,CAAME,MAAM,IAAIF,KAAAA,CAAME,MAAM,CAACD,MAAM;AAClD,YAAA,MAAME,IAAAA,GAAOF,MAAAA,KAAWG,SAAAA,GAAY,CAAA,EAAGH,SAASD,KAAAA,CAAMG,IAAI,CAAA,CAAE,GAAG,CAAC,CAAC,EAAEJ,UAAAA,CAAAA,EAAaC,KAAAA,CAAMG,IAAI,CAAA,CAAE;YAE5F,OAAO;AACL,gBAAA,GAAGH,KAAK;AACRG,gBAAAA;AACJ,aAAA;AACA,QAAA,CAAA;AAEAE,IAAAA,gBAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,IAAM;AAChCC,YAAAA,UAAAA,CAAAA,CAAW,EAAEC,aAAAA,GAAgB,KAAK,EAAE,GAAG,EAAE,EAAA;AACvC,gBAAA,MAAMC,YAAY,EAAA;AAElB,gBAAA,MAAMC,eAAe,CAACd,MAAAA,GAAAA;oBACpB,IAAI,CAAClB,EAAEiC,GAAG,CAACf,QAAQgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAA,EAAc;wBAC1C,OAAO,KAAA;AACf,oBAAA;oBAEM,OAAOjB,MAAM,CAACgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAY,CAACC,QAAQ,CAAC,aAAA,CAAA;AACrD,gBAAA,CAAA;gBAEI,KAAK,MAAM,CAACC,OAAAA,EAASC,GAAAA,CAAI,IAAIC,OAAOC,OAAO,CAACZ,MAAAA,CAAOa,IAAI,CAAA,CAAG;oBACxD,MAAMC,WAAAA,GAAc1C,EAAE2C,MAAM,CAC1BL,IAAII,WAAW,EACf,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB/C,CAAAA,CAAEgD,MAAM,CAACH,UAAAA,EAAYb,YAAAA,CAAAA;wBAE/C,IAAIhC,CAAAA,CAAEiD,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAG9C,CAAAA,CAAEkD,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASrB,aAAAA;gCACTsB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAAC5C,CAAAA,CAAEiD,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BX,wBAAAA,SAAS,CAAC,CAAC,KAAK,EAAEM,OAAAA,CAAAA,CAAS,CAAC,GAAG;AAAEK,4BAAAA;AAAW,yBAAA;AACpD,oBAAA;AACA,gBAAA;gBAEI,KAAK,MAAM,CAACrB,UAAAA,EAAYgC,MAAAA,CAAO,IAAId,OAAOC,OAAO,CAACZ,MAAAA,CAAO0B,OAAO,CAAA,CAAG;oBACjE,MAAMZ,WAAAA,GAAc1C,EAAE2C,MAAM,CAC1BU,OAAOX,WAAW,EAClB,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB/C,CAAAA,CAAEgD,MAAM,CAACH,UAAAA,EAAYb,YAAAA,CAAAA;wBAE/C,IAAIhC,CAAAA,CAAEiD,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAG9C,CAAAA,CAAEkD,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASrB,aAAAA;gCACTsB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAAC5C,CAAAA,CAAEiD,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BX,wBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEV,UAAAA,CAAAA,CAAY,CAAC,GAAG;AAAEqB,4BAAAA;AAAW,yBAAA;AAC1D,oBAAA;AACA,gBAAA;;gBAGI,OAAO1C,CAAAA,CAAEuD,SAAS,CAACxB,SAAAA,CAAAA;AACvB,YAAA,CAAA;YAEE,MAAMyB,SAAAA,CAAAA,GAAAA;AACJ,gBAAA,MAAMC,YAAY,EAAA;gBAElB,KAAK,MAAM,CAACpB,OAAAA,EAASC,GAAAA,CAAI,IAAIC,OAAOC,OAAO,CAACZ,MAAAA,CAAOa,IAAI,CAAA,CAAG;AACxD,oBAAA,MAAMiB,SAAS1D,CAAAA,CAAE2D,OAAO,CAACrB,GAAAA,CAAIoB,MAAM,EAAE,CAACpC,KAAAA,GAAAA;AACpC,wBAAA,IAAItB,CAAAA,CAAEiC,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,MAAMoC,MAAM;AAC7B,wBAAA;wBAEQ,OAAOpC,KAAAA;oBACf,CAAA,CAAA,CAASpB,MAAM,CAAC,CAACoB,KAAAA,GAAUA,MAAMsC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIH,MAAAA,CAAOI,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYnC,MAAAA,CAAOJ,MAAM,CAACwC,GAAG,CAAC,iBAAA,CAAA;AACpCP,oBAAAA,SAAS,CAAC,CAAC,KAAK,EAAEpB,OAAAA,CAAAA,CAAS,CAAC,GAAGqB,MAAAA,CAAOvD,GAAG,CAAC,CAACmB,KAAAA,IAAW;AACpD,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQwD,SAAAA,EAAWzC,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA;gBAEI,KAAK,MAAM,CAACJ,UAAAA,EAAYgC,MAAAA,CAAO,IAAId,OAAOC,OAAO,CAACZ,MAAAA,CAAO0B,OAAO,CAAA,CAAG;AACjE,oBAAA,MAAMW,kBAAkB7C,uBAAAA,CAAwBC,UAAAA,CAAAA;AAEhD,oBAAA,MAAMqC,SAAS1D,CAAAA,CAAE2D,OAAO,CAACN,MAAAA,CAAOK,MAAM,EAAE,CAACpC,KAAAA,GAAAA;AACvC,wBAAA,IAAItB,CAAAA,CAAEiC,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,KAAAA,CAAMoC,MAAM,CAACvD,GAAG,CAAC8D,eAAAA,CAAAA;AAClC,wBAAA;AAEQ,wBAAA,OAAOA,eAAAA,CAAgB3C,KAAAA,CAAAA;oBAC/B,CAAA,CAAA,CAASpB,MAAM,CAAC,CAACoB,KAAAA,GAAUA,MAAMsC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIH,MAAAA,CAAOI,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYnC,MAAAA,CAAOJ,MAAM,CAACwC,GAAG,CAAC,iBAAA,CAAA;AACpCP,oBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEpC,UAAAA,CAAAA,CAAY,CAAC,GAAGqC,MAAAA,CAAOvD,GAAG,CAAC,CAACmB,KAAAA,IAAW;AAC1D,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQwD,SAAAA,EAAWzC,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA;AAEI,gBAAA,OAAOZ,iCAAAA,CAAkC4C,SAAAA,CAAAA;AAC7C,YAAA,CAAA;YAEE,MAAMS,eAAAA,CAAAA,GAAAA;gBACJ,MAAMC,KAAAA,GAAQ,MAAMvC,MAAAA,CAAOwC,EAAE,CAACC,KAAK,CAAC,kCAAkCC,QAAQ,EAAA;gBAC9E,MAAMC,aAAAA,GAAgB,MAAM3C,MAAAA,CAAOwC,EAAE,CAACC,KAAK,CAAC,wCAAwCC,QAAQ,EAAA;AAE5F,gBAAA,MAAME,uBAAuBxE,CAAAA,CAAEyE,IAAI,CAACzE,CAAAA,CAAEG,GAAG,CAACoE,aAAAA,EAAe,QAAA,CAAA,CAAA;gBAEzD,MAAMG,UAAAA,GAAa1E,EAAE2D,OAAO,CAAC/B,OAAOa,IAAI,EAAE,CAACH,GAAAA,EAAKD,OAAAA,GAAAA;AAC9C,oBAAA,OAAOrC,EAAE2D,OAAO,CAACrB,IAAII,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAC7C,wBAAA,OAAO9C,EAAE2E,IAAI,CAAC9B,UAAAA,CAAAA,CAAY1C,GAAG,CAAC,CAACyE,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,KAAK,EAAEvC,OAAAA,CAAQ,CAAC,EAAES,cAAAA,CAAe,CAAC,EAAE8B,UAAAA,CAAAA,CAAY;AAClE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;gBAEI,MAAMC,cAAAA,GAAiB7E,EAAE2D,OAAO,CAAC/B,OAAO0B,OAAO,EAAE,CAACD,MAAAA,EAAQhC,UAAAA,GAAAA;AACxD,oBAAA,OAAOrB,EAAE2D,OAAO,CAACN,OAAOX,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAChD,wBAAA,OAAO9C,EAAE2E,IAAI,CAAC9B,UAAAA,CAAAA,CAAY1C,GAAG,CAAC,CAACyE,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,QAAQ,EAAEvD,UAAAA,CAAW,CAAC,EAAEyB,cAAAA,CAAe,CAAC,EAAE8B,UAAAA,CAAAA,CAAY;AACxE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;AAEI,gBAAA,MAAME,UAAAA,GAAa;AAAIJ,oBAAAA,GAAAA,UAAAA;AAAeG,oBAAAA,GAAAA;AAAe,iBAAA;AAErD,gBAAA,MAAME,QAAAA,GAAW/E,CAAAA,CAAEgF,UAAU,CAACR,oBAAAA,EAAsBM,UAAAA,CAAAA;AAEpD,gBAAA,MAAMG,QAAQC,GAAG,CACfH,QAAAA,CAAS5E,GAAG,CAAC,CAACe,MAAAA,GAAAA;AACZ,oBAAA,OAAOU,OAAOwC,EAAA,CACXC,KAAK,CAAC,sCAAA,CAAA,CACNc,MAAM,CAAC;wBAAEC,KAAAA,EAAO;AAAElE,4BAAAA;AAAM;AAAE,qBAAA,CAAA;AACrC,gBAAA,CAAA,CAAA,CAAA;gBAGI,IAAIsD,oBAAAA,CAAqBV,MAAM,KAAK,CAAA,EAAG;;oBAErC,KAAK,MAAMuB,QAAQlB,KAAAA,CAAO;AACxB,wBAAA,MAAMmB,WAAWlF,IAAAA,CACfF,MAAAA,CAAO,CAAC,EAAEiB,QAAQ,EAAE,GAAKA,QAAAA,KAAakE,IAAAA,CAAKxB,IAAI,IAAI1C,QAAAA,KAAa,IAAA,CAAA,EAChEhB,GAAAA,CAAIE,KAAK,QAAA,CAAA,CAAA,CAAA,CACTY,mBAAAA,CAAAA;AAEF,wBAAA,MAAMgE,QAAQC,GAAG,CACfI,QAAAA,CAASnF,GAAG,CAAC,CAACe,MAAAA,GAAAA;AACZ,4BAAA,OAAOU,OAAOwC,EAAE,CAACC,KAAK,CAAC,sCAAA,CAAA,CAAwCkB,MAAM,CAAC;gCACpEC,IAAAA,EAAM;AACJtE,oCAAAA,MAAAA;AACAmE,oCAAAA,IAAAA,EAAMA,KAAKI;AAC3B;AACA,6BAAA,CAAA;AACA,wBAAA,CAAA,CAAA,CAAA;AAEA,oBAAA;AACA,gBAAA;AACA,YAAA,CAAA;YAEE,MAAMC,UAAAA,CAAAA,GAAAA;gBACJ,MAAMC,SAAAA,GAAY,MAAM/D,MAAAA,CAAOwC,EAAE,CAACC,KAAK,CAAC,kCAAkCuB,KAAK,EAAA;AAE/E,gBAAA,IAAID,cAAc,CAAA,EAAG;AACnB,oBAAA,MAAM/D,OAAOwC,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,eAAA;4BACNC,WAAAA,EAAa,2CAAA;4BACbjC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AAEM,oBAAA,MAAMjC,OAAOwC,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,QAAA;4BACNC,WAAAA,EAAa,6CAAA;4BACbjC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AACA,gBAAA;gBAEI,OAAO9C,UAAAA,CAAW,qBAAqBmD,eAAe,EAAA;AAC1D,YAAA,CAAA;YAEE,MAAM6B,cAAAA,CAAAA,CAAeC,IAAI,EAAEX,IAAI,EAAA;AAC7B,gBAAA,OAAOzD,OAAOwC,EAAA,CACXC,KAAK,CAAC,gCAAA,CAAA,CACN4B,MAAM,CAAC;oBAAEb,KAAAA,EAAO;AAAEK,wBAAAA,EAAAA,EAAIO,KAAKP;AAAE,qBAAA;oBAAID,IAAAA,EAAM;AAAEH,wBAAAA;AAAI;;AACpD,YAAA,CAAA;YAEE5E,QAAAA,CAAAA,CAASyF,MAAM,EAAEV,IAAI,EAAA;gBACnB,MAAMW,wBAAAA,GAA2BvF,OAAAA,CAAQwF,QAAQ,CAACZ,IAAAA,CAAAA;;gBAGlD,MAAMa,WAAAA,GAAc3F,gCAAgCyF,wBAAAA,EAA0B,GAAA,CAAA;gBAE9E,IAAI;oBACF,OAAOnG,CAAAA,CAAES,QAAQ,CAACyF,MAAAA,EAAQ;AAAEG,wBAAAA,WAAAA;wBAAaC,QAAAA,EAAU,KAAA;wBAAOC,MAAAA,EAAQ;qBAAK,CAAA,CAAIf,IAAAA,CAAAA;AACjF,gBAAA,CAAA,CAAM,OAAM;oBACN,MAAM,IAAI7E,MAAAA,CAAO6F,gBAAgB,CAAC,wBAAA,CAAA;AACxC,gBAAA;AACA,YAAA;SACA,CAAA;;;;;;"}
+{"version":3,"file":"users-permissions.js","sources":["../../../server/src/services/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst _ = require('lodash');\nconst urlJoin = require('url-join');\nconst {\n  template: { createStrictInterpolationRegExp },\n  errors,\n  objects,\n  sanitizeRoutesMapForSerialization,\n} = require('@strapi/utils');\n\nconst { getService } = require('../utils');\n\nconst DEFAULT_PERMISSIONS = [\n  { action: 'plugin::users-permissions.auth.callback', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.connect', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.forgotPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.resetPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.register', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.emailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.sendEmailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.refresh', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.logout', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.getSessions', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.revokeSession', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.user.me', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.changePassword', roleType: 'authenticated' },\n];\n\nconst transformRoutePrefixFor = (pluginName) => (route) => {\n  const prefix = route.config && route.config.prefix;\n  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;\n\n  return {\n    ...route,\n    path,\n  };\n};\n\nmodule.exports = ({ strapi }) => ({\n  getActions({ defaultEnable = false } = {}) {\n    const actionMap = {};\n\n    const isContentApi = (action) => {\n      if (!_.has(action, Symbol.for('__type__'))) {\n        return false;\n      }\n\n      return action[Symbol.for('__type__')].includes('content-api');\n    };\n\n    for (const [apiName, api] of Object.entries(strapi.apis)) {\n      const controllers = _.reduce(\n        api.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`api::${apiName}`] = { controllers };\n      }\n    }\n\n    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {\n      const controllers = _.reduce(\n        plugin.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`plugin::${pluginName}`] = { controllers };\n      }\n    }\n\n    // Return a deeply cloned version to avoid circular references\n    return _.cloneDeep(actionMap);\n  },\n\n  async getRoutes() {\n    const routesMap = {};\n\n    for (const [apiName, api] of Object.entries(strapi.apis)) {\n      const routes = _.flatMap(api.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes;\n        }\n\n        return route;\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`api::${apiName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    }\n\n    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {\n      const transformPrefix = transformRoutePrefixFor(pluginName);\n\n      const routes = _.flatMap(plugin.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes.map(transformPrefix);\n        }\n\n        return transformPrefix(route);\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    }\n\n    return sanitizeRoutesMapForSerialization(routesMap);\n  },\n\n  async syncPermissions() {\n    const roles = await strapi.db.query('plugin::users-permissions.role').findMany();\n    const dbPermissions = await strapi.db.query('plugin::users-permissions.permission').findMany();\n\n    const permissionsFoundInDB = _.uniq(_.map(dbPermissions, 'action'));\n\n    const appActions = _.flatMap(strapi.apis, (api, apiName) => {\n      return _.flatMap(api.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `api::${apiName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const pluginsActions = _.flatMap(strapi.plugins, (plugin, pluginName) => {\n      return _.flatMap(plugin.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `plugin::${pluginName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const allActions = [...appActions, ...pluginsActions];\n\n    const toDelete = _.difference(permissionsFoundInDB, allActions);\n\n    await Promise.all(\n      toDelete.map((action) => {\n        return strapi.db\n          .query('plugin::users-permissions.permission')\n          .delete({ where: { action } });\n      })\n    );\n\n    if (permissionsFoundInDB.length === 0) {\n      // create default permissions\n      for (const role of roles) {\n        const toCreate = DEFAULT_PERMISSIONS.filter(\n          ({ roleType }) => roleType === role.type || roleType === null\n        ).map(({ action }) => action);\n\n        await Promise.all(\n          toCreate.map((action) => {\n            return strapi.db.query('plugin::users-permissions.permission').create({\n              data: {\n                action,\n                role: role.id,\n              },\n            });\n          })\n        );\n      }\n    }\n  },\n\n  async initialize() {\n    const roleCount = await strapi.db.query('plugin::users-permissions.role').count();\n\n    if (roleCount === 0) {\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Authenticated',\n          description: 'Default role given to authenticated user.',\n          type: 'authenticated',\n        },\n      });\n\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Public',\n          description: 'Default role given to unauthenticated user.',\n          type: 'public',\n        },\n      });\n    }\n\n    return getService('users-permissions').syncPermissions();\n  },\n\n  async updateUserRole(user, role) {\n    return strapi.db\n      .query('plugin::users-permissions.user')\n      .update({ where: { id: user.id }, data: { role } });\n  },\n\n  template(layout, data) {\n    const allowedTemplateVariables = objects.keysDeep(data);\n\n    // Create a strict interpolation RegExp based on possible variable names\n    const interpolate = createStrictInterpolationRegExp(allowedTemplateVariables, 'g');\n\n    try {\n      return _.template(layout, { interpolate, evaluate: false, escape: false })(data);\n    } catch {\n      throw new errors.ApplicationError('Invalid email template');\n    }\n  },\n});\n"],"names":["_","require$$0","urlJoin","require$$1","template","createStrictInterpolationRegExp","errors","objects","sanitizeRoutesMapForSerialization","require$$2","getService","require$$3","DEFAULT_PERMISSIONS","action","roleType","transformRoutePrefixFor","pluginName","route","prefix","config","path","undefined","usersPermissions","strapi","getActions","defaultEnable","actionMap","isContentApi","has","Symbol","for","includes","apiName","api","Object","entries","apis","controllers","reduce","acc","controller","controllerName","contentApiActions","pickBy","isEmpty","mapValues","enabled","policy","plugin","plugins","cloneDeep","getRoutes","routesMap","routes","flatMap","filter","info","type","length","apiPrefix","get","map","transformPrefix","syncPermissions","roles","db","query","findMany","dbPermissions","permissionsFoundInDB","uniq","appActions","keys","actionName","pluginsActions","allActions","toDelete","difference","Promise","all","delete","where","role","toCreate","create","data","id","initialize","roleCount","count","name","description","updateUserRole","user","update","layout","allowedTemplateVariables","keysDeep","interpolate","evaluate","escape","ApplicationError"],"mappings":";;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAMA,CAAAA,GAAIC,2BAAAA;AACV,IAAA,MAAMC,OAAAA,GAAUC,6BAAAA;AAChB,IAAA,MAAM,EACJC,QAAAA,EAAU,EAAEC,+BAA+B,EAAE,EAC7CC,MAAM,EACNC,OAAO,EACPC,iCAAiC,EAClC,GAAGC,2BAAAA;IAEJ,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB;AAC1B,QAAA;YAAEC,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAQ,SAAA;AAC7E,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAQ,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,kDAAA;YAAoDC,QAAAA,EAAU;AAAQ,SAAA;AAChF,QAAA;YAAED,MAAAA,EAAQ,sDAAA;YAAwDC,QAAAA,EAAU;AAAQ,SAAA;AACpF,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,uCAAA;YAAyCC,QAAAA,EAAU;AAAe,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,4CAAA;YAA8CC,QAAAA,EAAU;AAAe,SAAA;AACjF,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAe,SAAA;AACnF,QAAA;YAAED,MAAAA,EAAQ,mCAAA;YAAqCC,QAAAA,EAAU;AAAe,SAAA;AACxE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAe;AACrF,KAAA;IAED,MAAMC,uBAAAA,GAA0B,CAACC,UAAAA,GAAe,CAACC,KAAAA,GAAAA;AAC/C,YAAA,MAAMC,SAASD,KAAAA,CAAME,MAAM,IAAIF,KAAAA,CAAME,MAAM,CAACD,MAAM;AAClD,YAAA,MAAME,IAAAA,GAAOF,MAAAA,KAAWG,SAAAA,GAAY,CAAA,EAAGH,SAASD,KAAAA,CAAMG,IAAI,CAAA,CAAE,GAAG,CAAC,CAAC,EAAEJ,UAAAA,CAAAA,EAAaC,KAAAA,CAAMG,IAAI,CAAA,CAAE;YAE5F,OAAO;AACL,gBAAA,GAAGH,KAAK;AACRG,gBAAAA;AACJ,aAAA;AACA,QAAA,CAAA;AAEAE,IAAAA,gBAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,IAAM;AAChCC,YAAAA,UAAAA,CAAAA,CAAW,EAAEC,aAAAA,GAAgB,KAAK,EAAE,GAAG,EAAE,EAAA;AACvC,gBAAA,MAAMC,YAAY,EAAA;AAElB,gBAAA,MAAMC,eAAe,CAACd,MAAAA,GAAAA;oBACpB,IAAI,CAACb,EAAE4B,GAAG,CAACf,QAAQgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAA,EAAc;wBAC1C,OAAO,KAAA;AACf,oBAAA;oBAEM,OAAOjB,MAAM,CAACgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAY,CAACC,QAAQ,CAAC,aAAA,CAAA;AACrD,gBAAA,CAAA;gBAEI,KAAK,MAAM,CAACC,OAAAA,EAASC,GAAAA,CAAI,IAAIC,OAAOC,OAAO,CAACZ,MAAAA,CAAOa,IAAI,CAAA,CAAG;oBACxD,MAAMC,WAAAA,GAAcrC,EAAEsC,MAAM,CAC1BL,IAAII,WAAW,EACf,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB1C,CAAAA,CAAE2C,MAAM,CAACH,UAAAA,EAAYb,YAAAA,CAAAA;wBAE/C,IAAI3B,CAAAA,CAAE4C,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAGzC,CAAAA,CAAE6C,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASrB,aAAAA;gCACTsB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAACvC,CAAAA,CAAE4C,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BX,wBAAAA,SAAS,CAAC,CAAC,KAAK,EAAEM,OAAAA,CAAAA,CAAS,CAAC,GAAG;AAAEK,4BAAAA;AAAW,yBAAA;AACpD,oBAAA;AACA,gBAAA;gBAEI,KAAK,MAAM,CAACrB,UAAAA,EAAYgC,MAAAA,CAAO,IAAId,OAAOC,OAAO,CAACZ,MAAAA,CAAO0B,OAAO,CAAA,CAAG;oBACjE,MAAMZ,WAAAA,GAAcrC,EAAEsC,MAAM,CAC1BU,OAAOX,WAAW,EAClB,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB1C,CAAAA,CAAE2C,MAAM,CAACH,UAAAA,EAAYb,YAAAA,CAAAA;wBAE/C,IAAI3B,CAAAA,CAAE4C,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAGzC,CAAAA,CAAE6C,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASrB,aAAAA;gCACTsB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAACvC,CAAAA,CAAE4C,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BX,wBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEV,UAAAA,CAAAA,CAAY,CAAC,GAAG;AAAEqB,4BAAAA;AAAW,yBAAA;AAC1D,oBAAA;AACA,gBAAA;;gBAGI,OAAOrC,CAAAA,CAAEkD,SAAS,CAACxB,SAAAA,CAAAA;AACvB,YAAA,CAAA;YAEE,MAAMyB,SAAAA,CAAAA,GAAAA;AACJ,gBAAA,MAAMC,YAAY,EAAA;gBAElB,KAAK,MAAM,CAACpB,OAAAA,EAASC,GAAAA,CAAI,IAAIC,OAAOC,OAAO,CAACZ,MAAAA,CAAOa,IAAI,CAAA,CAAG;AACxD,oBAAA,MAAMiB,SAASrD,CAAAA,CAAEsD,OAAO,CAACrB,GAAAA,CAAIoB,MAAM,EAAE,CAACpC,KAAAA,GAAAA;AACpC,wBAAA,IAAIjB,CAAAA,CAAE4B,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,MAAMoC,MAAM;AAC7B,wBAAA;wBAEQ,OAAOpC,KAAAA;oBACf,CAAA,CAAA,CAASsC,MAAM,CAAC,CAACtC,KAAAA,GAAUA,MAAMuC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIJ,MAAAA,CAAOK,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYpC,MAAAA,CAAOJ,MAAM,CAACyC,GAAG,CAAC,iBAAA,CAAA;AACpCR,oBAAAA,SAAS,CAAC,CAAC,KAAK,EAAEpB,OAAAA,CAAAA,CAAS,CAAC,GAAGqB,MAAAA,CAAOQ,GAAG,CAAC,CAAC5C,KAAAA,IAAW;AACpD,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQyD,SAAAA,EAAW1C,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA;gBAEI,KAAK,MAAM,CAACJ,UAAAA,EAAYgC,MAAAA,CAAO,IAAId,OAAOC,OAAO,CAACZ,MAAAA,CAAO0B,OAAO,CAAA,CAAG;AACjE,oBAAA,MAAMa,kBAAkB/C,uBAAAA,CAAwBC,UAAAA,CAAAA;AAEhD,oBAAA,MAAMqC,SAASrD,CAAAA,CAAEsD,OAAO,CAACN,MAAAA,CAAOK,MAAM,EAAE,CAACpC,KAAAA,GAAAA;AACvC,wBAAA,IAAIjB,CAAAA,CAAE4B,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,KAAAA,CAAMoC,MAAM,CAACQ,GAAG,CAACC,eAAAA,CAAAA;AAClC,wBAAA;AAEQ,wBAAA,OAAOA,eAAAA,CAAgB7C,KAAAA,CAAAA;oBAC/B,CAAA,CAAA,CAASsC,MAAM,CAAC,CAACtC,KAAAA,GAAUA,MAAMuC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIJ,MAAAA,CAAOK,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYpC,MAAAA,CAAOJ,MAAM,CAACyC,GAAG,CAAC,iBAAA,CAAA;AACpCR,oBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEpC,UAAAA,CAAAA,CAAY,CAAC,GAAGqC,MAAAA,CAAOQ,GAAG,CAAC,CAAC5C,KAAAA,IAAW;AAC1D,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQyD,SAAAA,EAAW1C,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA;AAEI,gBAAA,OAAOZ,iCAAAA,CAAkC4C,SAAAA,CAAAA;AAC7C,YAAA,CAAA;YAEE,MAAMW,eAAAA,CAAAA,GAAAA;gBACJ,MAAMC,KAAAA,GAAQ,MAAMzC,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,kCAAkCC,QAAQ,EAAA;gBAC9E,MAAMC,aAAAA,GAAgB,MAAM7C,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,wCAAwCC,QAAQ,EAAA;AAE5F,gBAAA,MAAME,uBAAuBrE,CAAAA,CAAEsE,IAAI,CAACtE,CAAAA,CAAE6D,GAAG,CAACO,aAAAA,EAAe,QAAA,CAAA,CAAA;gBAEzD,MAAMG,UAAAA,GAAavE,EAAEsD,OAAO,CAAC/B,OAAOa,IAAI,EAAE,CAACH,GAAAA,EAAKD,OAAAA,GAAAA;AAC9C,oBAAA,OAAOhC,EAAEsD,OAAO,CAACrB,IAAII,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAC7C,wBAAA,OAAOzC,EAAEwE,IAAI,CAAChC,UAAAA,CAAAA,CAAYqB,GAAG,CAAC,CAACY,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,KAAK,EAAEzC,OAAAA,CAAQ,CAAC,EAAES,cAAAA,CAAe,CAAC,EAAEgC,UAAAA,CAAAA,CAAY;AAClE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;gBAEI,MAAMC,cAAAA,GAAiB1E,EAAEsD,OAAO,CAAC/B,OAAO0B,OAAO,EAAE,CAACD,MAAAA,EAAQhC,UAAAA,GAAAA;AACxD,oBAAA,OAAOhB,EAAEsD,OAAO,CAACN,OAAOX,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAChD,wBAAA,OAAOzC,EAAEwE,IAAI,CAAChC,UAAAA,CAAAA,CAAYqB,GAAG,CAAC,CAACY,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,QAAQ,EAAEzD,UAAAA,CAAW,CAAC,EAAEyB,cAAAA,CAAe,CAAC,EAAEgC,UAAAA,CAAAA,CAAY;AACxE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;AAEI,gBAAA,MAAME,UAAAA,GAAa;AAAIJ,oBAAAA,GAAAA,UAAAA;AAAeG,oBAAAA,GAAAA;AAAe,iBAAA;AAErD,gBAAA,MAAME,QAAAA,GAAW5E,CAAAA,CAAE6E,UAAU,CAACR,oBAAAA,EAAsBM,UAAAA,CAAAA;AAEpD,gBAAA,MAAMG,QAAQC,GAAG,CACfH,QAAAA,CAASf,GAAG,CAAC,CAAChD,MAAAA,GAAAA;AACZ,oBAAA,OAAOU,OAAO0C,EAAA,CACXC,KAAK,CAAC,sCAAA,CAAA,CACNc,MAAM,CAAC;wBAAEC,KAAAA,EAAO;AAAEpE,4BAAAA;AAAM;AAAE,qBAAA,CAAA;AACrC,gBAAA,CAAA,CAAA,CAAA;gBAGI,IAAIwD,oBAAAA,CAAqBX,MAAM,KAAK,CAAA,EAAG;;oBAErC,KAAK,MAAMwB,QAAQlB,KAAAA,CAAO;wBACxB,MAAMmB,QAAAA,GAAWvE,oBAAoB2C,MAAM,CACzC,CAAC,EAAEzC,QAAQ,EAAE,GAAKA,QAAAA,KAAaoE,KAAKzB,IAAI,IAAI3C,aAAa,IAAA,CAAA,CACzD+C,GAAG,CAAC,CAAC,EAAEhD,MAAM,EAAE,GAAKA,MAAAA,CAAAA;AAEtB,wBAAA,MAAMiE,QAAQC,GAAG,CACfI,QAAAA,CAAStB,GAAG,CAAC,CAAChD,MAAAA,GAAAA;AACZ,4BAAA,OAAOU,OAAO0C,EAAE,CAACC,KAAK,CAAC,sCAAA,CAAA,CAAwCkB,MAAM,CAAC;gCACpEC,IAAAA,EAAM;AACJxE,oCAAAA,MAAAA;AACAqE,oCAAAA,IAAAA,EAAMA,KAAKI;AAC3B;AACA,6BAAA,CAAA;AACA,wBAAA,CAAA,CAAA,CAAA;AAEA,oBAAA;AACA,gBAAA;AACA,YAAA,CAAA;YAEE,MAAMC,UAAAA,CAAAA,GAAAA;gBACJ,MAAMC,SAAAA,GAAY,MAAMjE,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,kCAAkCuB,KAAK,EAAA;AAE/E,gBAAA,IAAID,cAAc,CAAA,EAAG;AACnB,oBAAA,MAAMjE,OAAO0C,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,eAAA;4BACNC,WAAAA,EAAa,2CAAA;4BACblC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AAEM,oBAAA,MAAMlC,OAAO0C,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,QAAA;4BACNC,WAAAA,EAAa,6CAAA;4BACblC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AACA,gBAAA;gBAEI,OAAO/C,UAAAA,CAAW,qBAAqBqD,eAAe,EAAA;AAC1D,YAAA,CAAA;YAEE,MAAM6B,cAAAA,CAAAA,CAAeC,IAAI,EAAEX,IAAI,EAAA;AAC7B,gBAAA,OAAO3D,OAAO0C,EAAA,CACXC,KAAK,CAAC,gCAAA,CAAA,CACN4B,MAAM,CAAC;oBAAEb,KAAAA,EAAO;AAAEK,wBAAAA,EAAAA,EAAIO,KAAKP;AAAE,qBAAA;oBAAID,IAAAA,EAAM;AAAEH,wBAAAA;AAAI;;AACpD,YAAA,CAAA;YAEE9E,QAAAA,CAAAA,CAAS2F,MAAM,EAAEV,IAAI,EAAA;gBACnB,MAAMW,wBAAAA,GAA2BzF,OAAAA,CAAQ0F,QAAQ,CAACZ,IAAAA,CAAAA;;gBAGlD,MAAMa,WAAAA,GAAc7F,gCAAgC2F,wBAAAA,EAA0B,GAAA,CAAA;gBAE9E,IAAI;oBACF,OAAOhG,CAAAA,CAAEI,QAAQ,CAAC2F,MAAAA,EAAQ;AAAEG,wBAAAA,WAAAA;wBAAaC,QAAAA,EAAU,KAAA;wBAAOC,MAAAA,EAAQ;qBAAK,CAAA,CAAIf,IAAAA,CAAAA;AACjF,gBAAA,CAAA,CAAM,OAAM;oBACN,MAAM,IAAI/E,MAAAA,CAAO+F,gBAAgB,CAAC,wBAAA,CAAA;AACxC,gBAAA;AACA,YAAA;SACA,CAAA;;;;;;"}

package/dist/server/services/users-permissions.mjs

@@ -1,6 +1,5 @@
-import require$$0$1 from 'lodash';
-import require$$0 from 'lodash/fp';
-import require$$2 from 'url-join';
+import require$$0 from 'lodash';
+import require$$1$1 from 'url-join';
 import require$$1 from '@strapi/utils';
 import { __require as requireUtils } from '../utils/index.mjs';
 
@@ -9,9 +8,8 @@ var hasRequiredUsersPermissions;
 function requireUsersPermissions() {
     if (hasRequiredUsersPermissions) return usersPermissions;
     hasRequiredUsersPermissions = 1;
-    const _ = require$$0$1;
-    const { filter, map, pipe, prop } = require$$0;
-    const urlJoin = require$$2;
+    const _ = require$$0;
+    const urlJoin = require$$1$1;
     const { template: { createStrictInterpolationRegExp }, errors, objects, sanitizeRoutesMapForSerialization } = require$$1;
     const { getService } = requireUtils();
     const DEFAULT_PERMISSIONS = [
@@ -198,7 +196,7 @@ function requireUsersPermissions() {
                 if (permissionsFoundInDB.length === 0) {
                     // create default permissions
                     for (const role of roles){
-                        const toCreate = pipe(filter(({ roleType })=>roleType === role.type || roleType === null), map(prop('action')))(DEFAULT_PERMISSIONS);
+                        const toCreate = DEFAULT_PERMISSIONS.filter(({ roleType })=>roleType === role.type || roleType === null).map(({ action })=>action);
                         await Promise.all(toCreate.map((action)=>{
                             return strapi.db.query('plugin::users-permissions.permission').create({
                                 data: {

package/dist/server/services/users-permissions.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"users-permissions.mjs","sources":["../../../server/src/services/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst _ = require('lodash');\nconst { filter, map, pipe, prop } = require('lodash/fp');\nconst urlJoin = require('url-join');\nconst {\n  template: { createStrictInterpolationRegExp },\n  errors,\n  objects,\n  sanitizeRoutesMapForSerialization,\n} = require('@strapi/utils');\n\nconst { getService } = require('../utils');\n\nconst DEFAULT_PERMISSIONS = [\n  { action: 'plugin::users-permissions.auth.callback', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.connect', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.forgotPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.resetPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.register', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.emailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.sendEmailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.refresh', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.logout', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.getSessions', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.revokeSession', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.user.me', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.changePassword', roleType: 'authenticated' },\n];\n\nconst transformRoutePrefixFor = (pluginName) => (route) => {\n  const prefix = route.config && route.config.prefix;\n  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;\n\n  return {\n    ...route,\n    path,\n  };\n};\n\nmodule.exports = ({ strapi }) => ({\n  getActions({ defaultEnable = false } = {}) {\n    const actionMap = {};\n\n    const isContentApi = (action) => {\n      if (!_.has(action, Symbol.for('__type__'))) {\n        return false;\n      }\n\n      return action[Symbol.for('__type__')].includes('content-api');\n    };\n\n    for (const [apiName, api] of Object.entries(strapi.apis)) {\n      const controllers = _.reduce(\n        api.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`api::${apiName}`] = { controllers };\n      }\n    }\n\n    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {\n      const controllers = _.reduce(\n        plugin.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`plugin::${pluginName}`] = { controllers };\n      }\n    }\n\n    // Return a deeply cloned version to avoid circular references\n    return _.cloneDeep(actionMap);\n  },\n\n  async getRoutes() {\n    const routesMap = {};\n\n    for (const [apiName, api] of Object.entries(strapi.apis)) {\n      const routes = _.flatMap(api.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes;\n        }\n\n        return route;\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`api::${apiName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    }\n\n    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {\n      const transformPrefix = transformRoutePrefixFor(pluginName);\n\n      const routes = _.flatMap(plugin.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes.map(transformPrefix);\n        }\n\n        return transformPrefix(route);\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    }\n\n    return sanitizeRoutesMapForSerialization(routesMap);\n  },\n\n  async syncPermissions() {\n    const roles = await strapi.db.query('plugin::users-permissions.role').findMany();\n    const dbPermissions = await strapi.db.query('plugin::users-permissions.permission').findMany();\n\n    const permissionsFoundInDB = _.uniq(_.map(dbPermissions, 'action'));\n\n    const appActions = _.flatMap(strapi.apis, (api, apiName) => {\n      return _.flatMap(api.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `api::${apiName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const pluginsActions = _.flatMap(strapi.plugins, (plugin, pluginName) => {\n      return _.flatMap(plugin.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `plugin::${pluginName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const allActions = [...appActions, ...pluginsActions];\n\n    const toDelete = _.difference(permissionsFoundInDB, allActions);\n\n    await Promise.all(\n      toDelete.map((action) => {\n        return strapi.db\n          .query('plugin::users-permissions.permission')\n          .delete({ where: { action } });\n      })\n    );\n\n    if (permissionsFoundInDB.length === 0) {\n      // create default permissions\n      for (const role of roles) {\n        const toCreate = pipe(\n          filter(({ roleType }) => roleType === role.type || roleType === null),\n          map(prop('action'))\n        )(DEFAULT_PERMISSIONS);\n\n        await Promise.all(\n          toCreate.map((action) => {\n            return strapi.db.query('plugin::users-permissions.permission').create({\n              data: {\n                action,\n                role: role.id,\n              },\n            });\n          })\n        );\n      }\n    }\n  },\n\n  async initialize() {\n    const roleCount = await strapi.db.query('plugin::users-permissions.role').count();\n\n    if (roleCount === 0) {\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Authenticated',\n          description: 'Default role given to authenticated user.',\n          type: 'authenticated',\n        },\n      });\n\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Public',\n          description: 'Default role given to unauthenticated user.',\n          type: 'public',\n        },\n      });\n    }\n\n    return getService('users-permissions').syncPermissions();\n  },\n\n  async updateUserRole(user, role) {\n    return strapi.db\n      .query('plugin::users-permissions.user')\n      .update({ where: { id: user.id }, data: { role } });\n  },\n\n  template(layout, data) {\n    const allowedTemplateVariables = objects.keysDeep(data);\n\n    // Create a strict interpolation RegExp based on possible variable names\n    const interpolate = createStrictInterpolationRegExp(allowedTemplateVariables, 'g');\n\n    try {\n      return _.template(layout, { interpolate, evaluate: false, escape: false })(data);\n    } catch {\n      throw new errors.ApplicationError('Invalid email template');\n    }\n  },\n});\n"],"names":["_","require$$0","filter","map","pipe","prop","require$$1","urlJoin","require$$2","template","createStrictInterpolationRegExp","errors","objects","sanitizeRoutesMapForSerialization","require$$3","getService","require$$4","DEFAULT_PERMISSIONS","action","roleType","transformRoutePrefixFor","pluginName","route","prefix","config","path","undefined","usersPermissions","strapi","getActions","defaultEnable","actionMap","isContentApi","has","Symbol","for","includes","apiName","api","Object","entries","apis","controllers","reduce","acc","controller","controllerName","contentApiActions","pickBy","isEmpty","mapValues","enabled","policy","plugin","plugins","cloneDeep","getRoutes","routesMap","routes","flatMap","info","type","length","apiPrefix","get","transformPrefix","syncPermissions","roles","db","query","findMany","dbPermissions","permissionsFoundInDB","uniq","appActions","keys","actionName","pluginsActions","allActions","toDelete","difference","Promise","all","delete","where","role","toCreate","create","data","id","initialize","roleCount","count","name","description","updateUserRole","user","update","layout","allowedTemplateVariables","keysDeep","interpolate","evaluate","escape","ApplicationError"],"mappings":";;;;;;;;;;;AAEA,IAAA,MAAMA,CAAAA,GAAIC,YAAAA;IACV,MAAM,EAAEC,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGC,UAAAA;AACpC,IAAA,MAAMC,OAAAA,GAAUC,UAAAA;AAChB,IAAA,MAAM,EACJC,QAAAA,EAAU,EAAEC,+BAA+B,EAAE,EAC7CC,MAAM,EACNC,OAAO,EACPC,iCAAiC,EAClC,GAAGC,UAAAA;IAEJ,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB;AAC1B,QAAA;YAAEC,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAQ,SAAA;AAC7E,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAQ,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,kDAAA;YAAoDC,QAAAA,EAAU;AAAQ,SAAA;AAChF,QAAA;YAAED,MAAAA,EAAQ,sDAAA;YAAwDC,QAAAA,EAAU;AAAQ,SAAA;AACpF,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,uCAAA;YAAyCC,QAAAA,EAAU;AAAe,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,4CAAA;YAA8CC,QAAAA,EAAU;AAAe,SAAA;AACjF,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAe,SAAA;AACnF,QAAA;YAAED,MAAAA,EAAQ,mCAAA;YAAqCC,QAAAA,EAAU;AAAe,SAAA;AACxE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAe;AACrF,KAAA;IAED,MAAMC,uBAAAA,GAA0B,CAACC,UAAAA,GAAe,CAACC,KAAAA,GAAAA;AAC/C,YAAA,MAAMC,SAASD,KAAAA,CAAME,MAAM,IAAIF,KAAAA,CAAME,MAAM,CAACD,MAAM;AAClD,YAAA,MAAME,IAAAA,GAAOF,MAAAA,KAAWG,SAAAA,GAAY,CAAA,EAAGH,SAASD,KAAAA,CAAMG,IAAI,CAAA,CAAE,GAAG,CAAC,CAAC,EAAEJ,UAAAA,CAAAA,EAAaC,KAAAA,CAAMG,IAAI,CAAA,CAAE;YAE5F,OAAO;AACL,gBAAA,GAAGH,KAAK;AACRG,gBAAAA;AACJ,aAAA;AACA,QAAA,CAAA;AAEAE,IAAAA,gBAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,IAAM;AAChCC,YAAAA,UAAAA,CAAAA,CAAW,EAAEC,aAAAA,GAAgB,KAAK,EAAE,GAAG,EAAE,EAAA;AACvC,gBAAA,MAAMC,YAAY,EAAA;AAElB,gBAAA,MAAMC,eAAe,CAACd,MAAAA,GAAAA;oBACpB,IAAI,CAAClB,EAAEiC,GAAG,CAACf,QAAQgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAA,EAAc;wBAC1C,OAAO,KAAA;AACf,oBAAA;oBAEM,OAAOjB,MAAM,CAACgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAY,CAACC,QAAQ,CAAC,aAAA,CAAA;AACrD,gBAAA,CAAA;gBAEI,KAAK,MAAM,CAACC,OAAAA,EAASC,GAAAA,CAAI,IAAIC,OAAOC,OAAO,CAACZ,MAAAA,CAAOa,IAAI,CAAA,CAAG;oBACxD,MAAMC,WAAAA,GAAc1C,EAAE2C,MAAM,CAC1BL,IAAII,WAAW,EACf,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB/C,CAAAA,CAAEgD,MAAM,CAACH,UAAAA,EAAYb,YAAAA,CAAAA;wBAE/C,IAAIhC,CAAAA,CAAEiD,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAG9C,CAAAA,CAAEkD,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASrB,aAAAA;gCACTsB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAAC5C,CAAAA,CAAEiD,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BX,wBAAAA,SAAS,CAAC,CAAC,KAAK,EAAEM,OAAAA,CAAAA,CAAS,CAAC,GAAG;AAAEK,4BAAAA;AAAW,yBAAA;AACpD,oBAAA;AACA,gBAAA;gBAEI,KAAK,MAAM,CAACrB,UAAAA,EAAYgC,MAAAA,CAAO,IAAId,OAAOC,OAAO,CAACZ,MAAAA,CAAO0B,OAAO,CAAA,CAAG;oBACjE,MAAMZ,WAAAA,GAAc1C,EAAE2C,MAAM,CAC1BU,OAAOX,WAAW,EAClB,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB/C,CAAAA,CAAEgD,MAAM,CAACH,UAAAA,EAAYb,YAAAA,CAAAA;wBAE/C,IAAIhC,CAAAA,CAAEiD,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAG9C,CAAAA,CAAEkD,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASrB,aAAAA;gCACTsB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAAC5C,CAAAA,CAAEiD,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BX,wBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEV,UAAAA,CAAAA,CAAY,CAAC,GAAG;AAAEqB,4BAAAA;AAAW,yBAAA;AAC1D,oBAAA;AACA,gBAAA;;gBAGI,OAAO1C,CAAAA,CAAEuD,SAAS,CAACxB,SAAAA,CAAAA;AACvB,YAAA,CAAA;YAEE,MAAMyB,SAAAA,CAAAA,GAAAA;AACJ,gBAAA,MAAMC,YAAY,EAAA;gBAElB,KAAK,MAAM,CAACpB,OAAAA,EAASC,GAAAA,CAAI,IAAIC,OAAOC,OAAO,CAACZ,MAAAA,CAAOa,IAAI,CAAA,CAAG;AACxD,oBAAA,MAAMiB,SAAS1D,CAAAA,CAAE2D,OAAO,CAACrB,GAAAA,CAAIoB,MAAM,EAAE,CAACpC,KAAAA,GAAAA;AACpC,wBAAA,IAAItB,CAAAA,CAAEiC,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,MAAMoC,MAAM;AAC7B,wBAAA;wBAEQ,OAAOpC,KAAAA;oBACf,CAAA,CAAA,CAASpB,MAAM,CAAC,CAACoB,KAAAA,GAAUA,MAAMsC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIH,MAAAA,CAAOI,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYnC,MAAAA,CAAOJ,MAAM,CAACwC,GAAG,CAAC,iBAAA,CAAA;AACpCP,oBAAAA,SAAS,CAAC,CAAC,KAAK,EAAEpB,OAAAA,CAAAA,CAAS,CAAC,GAAGqB,MAAAA,CAAOvD,GAAG,CAAC,CAACmB,KAAAA,IAAW;AACpD,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQwD,SAAAA,EAAWzC,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA;gBAEI,KAAK,MAAM,CAACJ,UAAAA,EAAYgC,MAAAA,CAAO,IAAId,OAAOC,OAAO,CAACZ,MAAAA,CAAO0B,OAAO,CAAA,CAAG;AACjE,oBAAA,MAAMW,kBAAkB7C,uBAAAA,CAAwBC,UAAAA,CAAAA;AAEhD,oBAAA,MAAMqC,SAAS1D,CAAAA,CAAE2D,OAAO,CAACN,MAAAA,CAAOK,MAAM,EAAE,CAACpC,KAAAA,GAAAA;AACvC,wBAAA,IAAItB,CAAAA,CAAEiC,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,KAAAA,CAAMoC,MAAM,CAACvD,GAAG,CAAC8D,eAAAA,CAAAA;AAClC,wBAAA;AAEQ,wBAAA,OAAOA,eAAAA,CAAgB3C,KAAAA,CAAAA;oBAC/B,CAAA,CAAA,CAASpB,MAAM,CAAC,CAACoB,KAAAA,GAAUA,MAAMsC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIH,MAAAA,CAAOI,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYnC,MAAAA,CAAOJ,MAAM,CAACwC,GAAG,CAAC,iBAAA,CAAA;AACpCP,oBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEpC,UAAAA,CAAAA,CAAY,CAAC,GAAGqC,MAAAA,CAAOvD,GAAG,CAAC,CAACmB,KAAAA,IAAW;AAC1D,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQwD,SAAAA,EAAWzC,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA;AAEI,gBAAA,OAAOZ,iCAAAA,CAAkC4C,SAAAA,CAAAA;AAC7C,YAAA,CAAA;YAEE,MAAMS,eAAAA,CAAAA,GAAAA;gBACJ,MAAMC,KAAAA,GAAQ,MAAMvC,MAAAA,CAAOwC,EAAE,CAACC,KAAK,CAAC,kCAAkCC,QAAQ,EAAA;gBAC9E,MAAMC,aAAAA,GAAgB,MAAM3C,MAAAA,CAAOwC,EAAE,CAACC,KAAK,CAAC,wCAAwCC,QAAQ,EAAA;AAE5F,gBAAA,MAAME,uBAAuBxE,CAAAA,CAAEyE,IAAI,CAACzE,CAAAA,CAAEG,GAAG,CAACoE,aAAAA,EAAe,QAAA,CAAA,CAAA;gBAEzD,MAAMG,UAAAA,GAAa1E,EAAE2D,OAAO,CAAC/B,OAAOa,IAAI,EAAE,CAACH,GAAAA,EAAKD,OAAAA,GAAAA;AAC9C,oBAAA,OAAOrC,EAAE2D,OAAO,CAACrB,IAAII,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAC7C,wBAAA,OAAO9C,EAAE2E,IAAI,CAAC9B,UAAAA,CAAAA,CAAY1C,GAAG,CAAC,CAACyE,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,KAAK,EAAEvC,OAAAA,CAAQ,CAAC,EAAES,cAAAA,CAAe,CAAC,EAAE8B,UAAAA,CAAAA,CAAY;AAClE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;gBAEI,MAAMC,cAAAA,GAAiB7E,EAAE2D,OAAO,CAAC/B,OAAO0B,OAAO,EAAE,CAACD,MAAAA,EAAQhC,UAAAA,GAAAA;AACxD,oBAAA,OAAOrB,EAAE2D,OAAO,CAACN,OAAOX,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAChD,wBAAA,OAAO9C,EAAE2E,IAAI,CAAC9B,UAAAA,CAAAA,CAAY1C,GAAG,CAAC,CAACyE,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,QAAQ,EAAEvD,UAAAA,CAAW,CAAC,EAAEyB,cAAAA,CAAe,CAAC,EAAE8B,UAAAA,CAAAA,CAAY;AACxE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;AAEI,gBAAA,MAAME,UAAAA,GAAa;AAAIJ,oBAAAA,GAAAA,UAAAA;AAAeG,oBAAAA,GAAAA;AAAe,iBAAA;AAErD,gBAAA,MAAME,QAAAA,GAAW/E,CAAAA,CAAEgF,UAAU,CAACR,oBAAAA,EAAsBM,UAAAA,CAAAA;AAEpD,gBAAA,MAAMG,QAAQC,GAAG,CACfH,QAAAA,CAAS5E,GAAG,CAAC,CAACe,MAAAA,GAAAA;AACZ,oBAAA,OAAOU,OAAOwC,EAAA,CACXC,KAAK,CAAC,sCAAA,CAAA,CACNc,MAAM,CAAC;wBAAEC,KAAAA,EAAO;AAAElE,4BAAAA;AAAM;AAAE,qBAAA,CAAA;AACrC,gBAAA,CAAA,CAAA,CAAA;gBAGI,IAAIsD,oBAAAA,CAAqBV,MAAM,KAAK,CAAA,EAAG;;oBAErC,KAAK,MAAMuB,QAAQlB,KAAAA,CAAO;AACxB,wBAAA,MAAMmB,WAAWlF,IAAAA,CACfF,MAAAA,CAAO,CAAC,EAAEiB,QAAQ,EAAE,GAAKA,QAAAA,KAAakE,IAAAA,CAAKxB,IAAI,IAAI1C,QAAAA,KAAa,IAAA,CAAA,EAChEhB,GAAAA,CAAIE,KAAK,QAAA,CAAA,CAAA,CAAA,CACTY,mBAAAA,CAAAA;AAEF,wBAAA,MAAMgE,QAAQC,GAAG,CACfI,QAAAA,CAASnF,GAAG,CAAC,CAACe,MAAAA,GAAAA;AACZ,4BAAA,OAAOU,OAAOwC,EAAE,CAACC,KAAK,CAAC,sCAAA,CAAA,CAAwCkB,MAAM,CAAC;gCACpEC,IAAAA,EAAM;AACJtE,oCAAAA,MAAAA;AACAmE,oCAAAA,IAAAA,EAAMA,KAAKI;AAC3B;AACA,6BAAA,CAAA;AACA,wBAAA,CAAA,CAAA,CAAA;AAEA,oBAAA;AACA,gBAAA;AACA,YAAA,CAAA;YAEE,MAAMC,UAAAA,CAAAA,GAAAA;gBACJ,MAAMC,SAAAA,GAAY,MAAM/D,MAAAA,CAAOwC,EAAE,CAACC,KAAK,CAAC,kCAAkCuB,KAAK,EAAA;AAE/E,gBAAA,IAAID,cAAc,CAAA,EAAG;AACnB,oBAAA,MAAM/D,OAAOwC,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,eAAA;4BACNC,WAAAA,EAAa,2CAAA;4BACbjC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AAEM,oBAAA,MAAMjC,OAAOwC,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,QAAA;4BACNC,WAAAA,EAAa,6CAAA;4BACbjC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AACA,gBAAA;gBAEI,OAAO9C,UAAAA,CAAW,qBAAqBmD,eAAe,EAAA;AAC1D,YAAA,CAAA;YAEE,MAAM6B,cAAAA,CAAAA,CAAeC,IAAI,EAAEX,IAAI,EAAA;AAC7B,gBAAA,OAAOzD,OAAOwC,EAAA,CACXC,KAAK,CAAC,gCAAA,CAAA,CACN4B,MAAM,CAAC;oBAAEb,KAAAA,EAAO;AAAEK,wBAAAA,EAAAA,EAAIO,KAAKP;AAAE,qBAAA;oBAAID,IAAAA,EAAM;AAAEH,wBAAAA;AAAI;;AACpD,YAAA,CAAA;YAEE5E,QAAAA,CAAAA,CAASyF,MAAM,EAAEV,IAAI,EAAA;gBACnB,MAAMW,wBAAAA,GAA2BvF,OAAAA,CAAQwF,QAAQ,CAACZ,IAAAA,CAAAA;;gBAGlD,MAAMa,WAAAA,GAAc3F,gCAAgCyF,wBAAAA,EAA0B,GAAA,CAAA;gBAE9E,IAAI;oBACF,OAAOnG,CAAAA,CAAES,QAAQ,CAACyF,MAAAA,EAAQ;AAAEG,wBAAAA,WAAAA;wBAAaC,QAAAA,EAAU,KAAA;wBAAOC,MAAAA,EAAQ;qBAAK,CAAA,CAAIf,IAAAA,CAAAA;AACjF,gBAAA,CAAA,CAAM,OAAM;oBACN,MAAM,IAAI7E,MAAAA,CAAO6F,gBAAgB,CAAC,wBAAA,CAAA;AACxC,gBAAA;AACA,YAAA;SACA,CAAA;;;;;;"}
+{"version":3,"file":"users-permissions.mjs","sources":["../../../server/src/services/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst _ = require('lodash');\nconst urlJoin = require('url-join');\nconst {\n  template: { createStrictInterpolationRegExp },\n  errors,\n  objects,\n  sanitizeRoutesMapForSerialization,\n} = require('@strapi/utils');\n\nconst { getService } = require('../utils');\n\nconst DEFAULT_PERMISSIONS = [\n  { action: 'plugin::users-permissions.auth.callback', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.connect', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.forgotPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.resetPassword', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.register', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.emailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.sendEmailConfirmation', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.refresh', roleType: 'public' },\n  { action: 'plugin::users-permissions.auth.logout', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.getSessions', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.revokeSession', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.user.me', roleType: 'authenticated' },\n  { action: 'plugin::users-permissions.auth.changePassword', roleType: 'authenticated' },\n];\n\nconst transformRoutePrefixFor = (pluginName) => (route) => {\n  const prefix = route.config && route.config.prefix;\n  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;\n\n  return {\n    ...route,\n    path,\n  };\n};\n\nmodule.exports = ({ strapi }) => ({\n  getActions({ defaultEnable = false } = {}) {\n    const actionMap = {};\n\n    const isContentApi = (action) => {\n      if (!_.has(action, Symbol.for('__type__'))) {\n        return false;\n      }\n\n      return action[Symbol.for('__type__')].includes('content-api');\n    };\n\n    for (const [apiName, api] of Object.entries(strapi.apis)) {\n      const controllers = _.reduce(\n        api.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`api::${apiName}`] = { controllers };\n      }\n    }\n\n    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {\n      const controllers = _.reduce(\n        plugin.controllers,\n        (acc, controller, controllerName) => {\n          const contentApiActions = _.pickBy(controller, isContentApi);\n\n          if (_.isEmpty(contentApiActions)) {\n            return acc;\n          }\n\n          acc[controllerName] = _.mapValues(contentApiActions, () => {\n            return {\n              enabled: defaultEnable,\n              policy: '',\n            };\n          });\n\n          return acc;\n        },\n        {}\n      );\n\n      if (!_.isEmpty(controllers)) {\n        actionMap[`plugin::${pluginName}`] = { controllers };\n      }\n    }\n\n    // Return a deeply cloned version to avoid circular references\n    return _.cloneDeep(actionMap);\n  },\n\n  async getRoutes() {\n    const routesMap = {};\n\n    for (const [apiName, api] of Object.entries(strapi.apis)) {\n      const routes = _.flatMap(api.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes;\n        }\n\n        return route;\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`api::${apiName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    }\n\n    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {\n      const transformPrefix = transformRoutePrefixFor(pluginName);\n\n      const routes = _.flatMap(plugin.routes, (route) => {\n        if (_.has(route, 'routes')) {\n          return route.routes.map(transformPrefix);\n        }\n\n        return transformPrefix(route);\n      }).filter((route) => route.info.type === 'content-api');\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({\n        ...route,\n        path: urlJoin(apiPrefix, route.path),\n      }));\n    }\n\n    return sanitizeRoutesMapForSerialization(routesMap);\n  },\n\n  async syncPermissions() {\n    const roles = await strapi.db.query('plugin::users-permissions.role').findMany();\n    const dbPermissions = await strapi.db.query('plugin::users-permissions.permission').findMany();\n\n    const permissionsFoundInDB = _.uniq(_.map(dbPermissions, 'action'));\n\n    const appActions = _.flatMap(strapi.apis, (api, apiName) => {\n      return _.flatMap(api.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `api::${apiName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const pluginsActions = _.flatMap(strapi.plugins, (plugin, pluginName) => {\n      return _.flatMap(plugin.controllers, (controller, controllerName) => {\n        return _.keys(controller).map((actionName) => {\n          return `plugin::${pluginName}.${controllerName}.${actionName}`;\n        });\n      });\n    });\n\n    const allActions = [...appActions, ...pluginsActions];\n\n    const toDelete = _.difference(permissionsFoundInDB, allActions);\n\n    await Promise.all(\n      toDelete.map((action) => {\n        return strapi.db\n          .query('plugin::users-permissions.permission')\n          .delete({ where: { action } });\n      })\n    );\n\n    if (permissionsFoundInDB.length === 0) {\n      // create default permissions\n      for (const role of roles) {\n        const toCreate = DEFAULT_PERMISSIONS.filter(\n          ({ roleType }) => roleType === role.type || roleType === null\n        ).map(({ action }) => action);\n\n        await Promise.all(\n          toCreate.map((action) => {\n            return strapi.db.query('plugin::users-permissions.permission').create({\n              data: {\n                action,\n                role: role.id,\n              },\n            });\n          })\n        );\n      }\n    }\n  },\n\n  async initialize() {\n    const roleCount = await strapi.db.query('plugin::users-permissions.role').count();\n\n    if (roleCount === 0) {\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Authenticated',\n          description: 'Default role given to authenticated user.',\n          type: 'authenticated',\n        },\n      });\n\n      await strapi.db.query('plugin::users-permissions.role').create({\n        data: {\n          name: 'Public',\n          description: 'Default role given to unauthenticated user.',\n          type: 'public',\n        },\n      });\n    }\n\n    return getService('users-permissions').syncPermissions();\n  },\n\n  async updateUserRole(user, role) {\n    return strapi.db\n      .query('plugin::users-permissions.user')\n      .update({ where: { id: user.id }, data: { role } });\n  },\n\n  template(layout, data) {\n    const allowedTemplateVariables = objects.keysDeep(data);\n\n    // Create a strict interpolation RegExp based on possible variable names\n    const interpolate = createStrictInterpolationRegExp(allowedTemplateVariables, 'g');\n\n    try {\n      return _.template(layout, { interpolate, evaluate: false, escape: false })(data);\n    } catch {\n      throw new errors.ApplicationError('Invalid email template');\n    }\n  },\n});\n"],"names":["_","require$$0","urlJoin","require$$1","template","createStrictInterpolationRegExp","errors","objects","sanitizeRoutesMapForSerialization","require$$2","getService","require$$3","DEFAULT_PERMISSIONS","action","roleType","transformRoutePrefixFor","pluginName","route","prefix","config","path","undefined","usersPermissions","strapi","getActions","defaultEnable","actionMap","isContentApi","has","Symbol","for","includes","apiName","api","Object","entries","apis","controllers","reduce","acc","controller","controllerName","contentApiActions","pickBy","isEmpty","mapValues","enabled","policy","plugin","plugins","cloneDeep","getRoutes","routesMap","routes","flatMap","filter","info","type","length","apiPrefix","get","map","transformPrefix","syncPermissions","roles","db","query","findMany","dbPermissions","permissionsFoundInDB","uniq","appActions","keys","actionName","pluginsActions","allActions","toDelete","difference","Promise","all","delete","where","role","toCreate","create","data","id","initialize","roleCount","count","name","description","updateUserRole","user","update","layout","allowedTemplateVariables","keysDeep","interpolate","evaluate","escape","ApplicationError"],"mappings":";;;;;;;;;;AAEA,IAAA,MAAMA,CAAAA,GAAIC,UAAAA;AACV,IAAA,MAAMC,OAAAA,GAAUC,YAAAA;AAChB,IAAA,MAAM,EACJC,QAAAA,EAAU,EAAEC,+BAA+B,EAAE,EAC7CC,MAAM,EACNC,OAAO,EACPC,iCAAiC,EAClC,GAAGC,UAAAA;IAEJ,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB;AAC1B,QAAA;YAAEC,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAQ,SAAA;AAC7E,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAQ,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,yCAAA;YAA2CC,QAAAA,EAAU;AAAQ,SAAA;AACvE,QAAA;YAAED,MAAAA,EAAQ,kDAAA;YAAoDC,QAAAA,EAAU;AAAQ,SAAA;AAChF,QAAA;YAAED,MAAAA,EAAQ,sDAAA;YAAwDC,QAAAA,EAAU;AAAQ,SAAA;AACpF,QAAA;YAAED,MAAAA,EAAQ,wCAAA;YAA0CC,QAAAA,EAAU;AAAQ,SAAA;AACtE,QAAA;YAAED,MAAAA,EAAQ,uCAAA;YAAyCC,QAAAA,EAAU;AAAe,SAAA;AAC5E,QAAA;YAAED,MAAAA,EAAQ,4CAAA;YAA8CC,QAAAA,EAAU;AAAe,SAAA;AACjF,QAAA;YAAED,MAAAA,EAAQ,8CAAA;YAAgDC,QAAAA,EAAU;AAAe,SAAA;AACnF,QAAA;YAAED,MAAAA,EAAQ,mCAAA;YAAqCC,QAAAA,EAAU;AAAe,SAAA;AACxE,QAAA;YAAED,MAAAA,EAAQ,+CAAA;YAAiDC,QAAAA,EAAU;AAAe;AACrF,KAAA;IAED,MAAMC,uBAAAA,GAA0B,CAACC,UAAAA,GAAe,CAACC,KAAAA,GAAAA;AAC/C,YAAA,MAAMC,SAASD,KAAAA,CAAME,MAAM,IAAIF,KAAAA,CAAME,MAAM,CAACD,MAAM;AAClD,YAAA,MAAME,IAAAA,GAAOF,MAAAA,KAAWG,SAAAA,GAAY,CAAA,EAAGH,SAASD,KAAAA,CAAMG,IAAI,CAAA,CAAE,GAAG,CAAC,CAAC,EAAEJ,UAAAA,CAAAA,EAAaC,KAAAA,CAAMG,IAAI,CAAA,CAAE;YAE5F,OAAO;AACL,gBAAA,GAAGH,KAAK;AACRG,gBAAAA;AACJ,aAAA;AACA,QAAA,CAAA;AAEAE,IAAAA,gBAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,IAAM;AAChCC,YAAAA,UAAAA,CAAAA,CAAW,EAAEC,aAAAA,GAAgB,KAAK,EAAE,GAAG,EAAE,EAAA;AACvC,gBAAA,MAAMC,YAAY,EAAA;AAElB,gBAAA,MAAMC,eAAe,CAACd,MAAAA,GAAAA;oBACpB,IAAI,CAACb,EAAE4B,GAAG,CAACf,QAAQgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAA,EAAc;wBAC1C,OAAO,KAAA;AACf,oBAAA;oBAEM,OAAOjB,MAAM,CAACgB,MAAAA,CAAOC,GAAG,CAAC,UAAA,CAAA,CAAY,CAACC,QAAQ,CAAC,aAAA,CAAA;AACrD,gBAAA,CAAA;gBAEI,KAAK,MAAM,CAACC,OAAAA,EAASC,GAAAA,CAAI,IAAIC,OAAOC,OAAO,CAACZ,MAAAA,CAAOa,IAAI,CAAA,CAAG;oBACxD,MAAMC,WAAAA,GAAcrC,EAAEsC,MAAM,CAC1BL,IAAII,WAAW,EACf,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB1C,CAAAA,CAAE2C,MAAM,CAACH,UAAAA,EAAYb,YAAAA,CAAAA;wBAE/C,IAAI3B,CAAAA,CAAE4C,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAGzC,CAAAA,CAAE6C,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASrB,aAAAA;gCACTsB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAACvC,CAAAA,CAAE4C,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BX,wBAAAA,SAAS,CAAC,CAAC,KAAK,EAAEM,OAAAA,CAAAA,CAAS,CAAC,GAAG;AAAEK,4BAAAA;AAAW,yBAAA;AACpD,oBAAA;AACA,gBAAA;gBAEI,KAAK,MAAM,CAACrB,UAAAA,EAAYgC,MAAAA,CAAO,IAAId,OAAOC,OAAO,CAACZ,MAAAA,CAAO0B,OAAO,CAAA,CAAG;oBACjE,MAAMZ,WAAAA,GAAcrC,EAAEsC,MAAM,CAC1BU,OAAOX,WAAW,EAClB,CAACE,GAAAA,EAAKC,UAAAA,EAAYC,cAAAA,GAAAA;AAChB,wBAAA,MAAMC,iBAAAA,GAAoB1C,CAAAA,CAAE2C,MAAM,CAACH,UAAAA,EAAYb,YAAAA,CAAAA;wBAE/C,IAAI3B,CAAAA,CAAE4C,OAAO,CAACF,iBAAAA,CAAAA,EAAoB;4BAChC,OAAOH,GAAAA;AACnB,wBAAA;AAEUA,wBAAAA,GAAG,CAACE,cAAAA,CAAe,GAAGzC,CAAAA,CAAE6C,SAAS,CAACH,iBAAAA,EAAmB,IAAA;4BACnD,OAAO;gCACLI,OAAAA,EAASrB,aAAAA;gCACTsB,MAAAA,EAAQ;AACtB,6BAAA;AACA,wBAAA,CAAA,CAAA;wBAEU,OAAOR,GAAAA;AACjB,oBAAA,CAAA,EACQ,EAAA,CAAA;AAGF,oBAAA,IAAI,CAACvC,CAAAA,CAAE4C,OAAO,CAACP,WAAAA,CAAAA,EAAc;AAC3BX,wBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEV,UAAAA,CAAAA,CAAY,CAAC,GAAG;AAAEqB,4BAAAA;AAAW,yBAAA;AAC1D,oBAAA;AACA,gBAAA;;gBAGI,OAAOrC,CAAAA,CAAEkD,SAAS,CAACxB,SAAAA,CAAAA;AACvB,YAAA,CAAA;YAEE,MAAMyB,SAAAA,CAAAA,GAAAA;AACJ,gBAAA,MAAMC,YAAY,EAAA;gBAElB,KAAK,MAAM,CAACpB,OAAAA,EAASC,GAAAA,CAAI,IAAIC,OAAOC,OAAO,CAACZ,MAAAA,CAAOa,IAAI,CAAA,CAAG;AACxD,oBAAA,MAAMiB,SAASrD,CAAAA,CAAEsD,OAAO,CAACrB,GAAAA,CAAIoB,MAAM,EAAE,CAACpC,KAAAA,GAAAA;AACpC,wBAAA,IAAIjB,CAAAA,CAAE4B,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,MAAMoC,MAAM;AAC7B,wBAAA;wBAEQ,OAAOpC,KAAAA;oBACf,CAAA,CAAA,CAASsC,MAAM,CAAC,CAACtC,KAAAA,GAAUA,MAAMuC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIJ,MAAAA,CAAOK,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYpC,MAAAA,CAAOJ,MAAM,CAACyC,GAAG,CAAC,iBAAA,CAAA;AACpCR,oBAAAA,SAAS,CAAC,CAAC,KAAK,EAAEpB,OAAAA,CAAAA,CAAS,CAAC,GAAGqB,MAAAA,CAAOQ,GAAG,CAAC,CAAC5C,KAAAA,IAAW;AACpD,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQyD,SAAAA,EAAW1C,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA;gBAEI,KAAK,MAAM,CAACJ,UAAAA,EAAYgC,MAAAA,CAAO,IAAId,OAAOC,OAAO,CAACZ,MAAAA,CAAO0B,OAAO,CAAA,CAAG;AACjE,oBAAA,MAAMa,kBAAkB/C,uBAAAA,CAAwBC,UAAAA,CAAAA;AAEhD,oBAAA,MAAMqC,SAASrD,CAAAA,CAAEsD,OAAO,CAACN,MAAAA,CAAOK,MAAM,EAAE,CAACpC,KAAAA,GAAAA;AACvC,wBAAA,IAAIjB,CAAAA,CAAE4B,GAAG,CAACX,KAAAA,EAAO,QAAA,CAAA,EAAW;AAC1B,4BAAA,OAAOA,KAAAA,CAAMoC,MAAM,CAACQ,GAAG,CAACC,eAAAA,CAAAA;AAClC,wBAAA;AAEQ,wBAAA,OAAOA,eAAAA,CAAgB7C,KAAAA,CAAAA;oBAC/B,CAAA,CAAA,CAASsC,MAAM,CAAC,CAACtC,KAAAA,GAAUA,MAAMuC,IAAI,CAACC,IAAI,KAAK,aAAA,CAAA;oBAEzC,IAAIJ,MAAAA,CAAOK,MAAM,KAAK,CAAA,EAAG;AACvB,wBAAA;AACR,oBAAA;AAEM,oBAAA,MAAMC,SAAAA,GAAYpC,MAAAA,CAAOJ,MAAM,CAACyC,GAAG,CAAC,iBAAA,CAAA;AACpCR,oBAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEpC,UAAAA,CAAAA,CAAY,CAAC,GAAGqC,MAAAA,CAAOQ,GAAG,CAAC,CAAC5C,KAAAA,IAAW;AAC1D,4BAAA,GAAGA,KAAK;4BACRG,IAAAA,EAAMlB,OAAAA,CAAQyD,SAAAA,EAAW1C,KAAAA,CAAMG,IAAI;yBAC3C,CAAA,CAAA;AACA,gBAAA;AAEI,gBAAA,OAAOZ,iCAAAA,CAAkC4C,SAAAA,CAAAA;AAC7C,YAAA,CAAA;YAEE,MAAMW,eAAAA,CAAAA,GAAAA;gBACJ,MAAMC,KAAAA,GAAQ,MAAMzC,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,kCAAkCC,QAAQ,EAAA;gBAC9E,MAAMC,aAAAA,GAAgB,MAAM7C,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,wCAAwCC,QAAQ,EAAA;AAE5F,gBAAA,MAAME,uBAAuBrE,CAAAA,CAAEsE,IAAI,CAACtE,CAAAA,CAAE6D,GAAG,CAACO,aAAAA,EAAe,QAAA,CAAA,CAAA;gBAEzD,MAAMG,UAAAA,GAAavE,EAAEsD,OAAO,CAAC/B,OAAOa,IAAI,EAAE,CAACH,GAAAA,EAAKD,OAAAA,GAAAA;AAC9C,oBAAA,OAAOhC,EAAEsD,OAAO,CAACrB,IAAII,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAC7C,wBAAA,OAAOzC,EAAEwE,IAAI,CAAChC,UAAAA,CAAAA,CAAYqB,GAAG,CAAC,CAACY,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,KAAK,EAAEzC,OAAAA,CAAQ,CAAC,EAAES,cAAAA,CAAe,CAAC,EAAEgC,UAAAA,CAAAA,CAAY;AAClE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;gBAEI,MAAMC,cAAAA,GAAiB1E,EAAEsD,OAAO,CAAC/B,OAAO0B,OAAO,EAAE,CAACD,MAAAA,EAAQhC,UAAAA,GAAAA;AACxD,oBAAA,OAAOhB,EAAEsD,OAAO,CAACN,OAAOX,WAAW,EAAE,CAACG,UAAAA,EAAYC,cAAAA,GAAAA;AAChD,wBAAA,OAAOzC,EAAEwE,IAAI,CAAChC,UAAAA,CAAAA,CAAYqB,GAAG,CAAC,CAACY,UAAAA,GAAAA;4BAC7B,OAAO,CAAC,QAAQ,EAAEzD,UAAAA,CAAW,CAAC,EAAEyB,cAAAA,CAAe,CAAC,EAAEgC,UAAAA,CAAAA,CAAY;AACxE,wBAAA,CAAA,CAAA;AACA,oBAAA,CAAA,CAAA;AACA,gBAAA,CAAA,CAAA;AAEI,gBAAA,MAAME,UAAAA,GAAa;AAAIJ,oBAAAA,GAAAA,UAAAA;AAAeG,oBAAAA,GAAAA;AAAe,iBAAA;AAErD,gBAAA,MAAME,QAAAA,GAAW5E,CAAAA,CAAE6E,UAAU,CAACR,oBAAAA,EAAsBM,UAAAA,CAAAA;AAEpD,gBAAA,MAAMG,QAAQC,GAAG,CACfH,QAAAA,CAASf,GAAG,CAAC,CAAChD,MAAAA,GAAAA;AACZ,oBAAA,OAAOU,OAAO0C,EAAA,CACXC,KAAK,CAAC,sCAAA,CAAA,CACNc,MAAM,CAAC;wBAAEC,KAAAA,EAAO;AAAEpE,4BAAAA;AAAM;AAAE,qBAAA,CAAA;AACrC,gBAAA,CAAA,CAAA,CAAA;gBAGI,IAAIwD,oBAAAA,CAAqBX,MAAM,KAAK,CAAA,EAAG;;oBAErC,KAAK,MAAMwB,QAAQlB,KAAAA,CAAO;wBACxB,MAAMmB,QAAAA,GAAWvE,oBAAoB2C,MAAM,CACzC,CAAC,EAAEzC,QAAQ,EAAE,GAAKA,QAAAA,KAAaoE,KAAKzB,IAAI,IAAI3C,aAAa,IAAA,CAAA,CACzD+C,GAAG,CAAC,CAAC,EAAEhD,MAAM,EAAE,GAAKA,MAAAA,CAAAA;AAEtB,wBAAA,MAAMiE,QAAQC,GAAG,CACfI,QAAAA,CAAStB,GAAG,CAAC,CAAChD,MAAAA,GAAAA;AACZ,4BAAA,OAAOU,OAAO0C,EAAE,CAACC,KAAK,CAAC,sCAAA,CAAA,CAAwCkB,MAAM,CAAC;gCACpEC,IAAAA,EAAM;AACJxE,oCAAAA,MAAAA;AACAqE,oCAAAA,IAAAA,EAAMA,KAAKI;AAC3B;AACA,6BAAA,CAAA;AACA,wBAAA,CAAA,CAAA,CAAA;AAEA,oBAAA;AACA,gBAAA;AACA,YAAA,CAAA;YAEE,MAAMC,UAAAA,CAAAA,GAAAA;gBACJ,MAAMC,SAAAA,GAAY,MAAMjE,MAAAA,CAAO0C,EAAE,CAACC,KAAK,CAAC,kCAAkCuB,KAAK,EAAA;AAE/E,gBAAA,IAAID,cAAc,CAAA,EAAG;AACnB,oBAAA,MAAMjE,OAAO0C,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,eAAA;4BACNC,WAAAA,EAAa,2CAAA;4BACblC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AAEM,oBAAA,MAAMlC,OAAO0C,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,MAAM,CAAC;wBAC7DC,IAAAA,EAAM;4BACJK,IAAAA,EAAM,QAAA;4BACNC,WAAAA,EAAa,6CAAA;4BACblC,IAAAA,EAAM;AAChB;AACA,qBAAA,CAAA;AACA,gBAAA;gBAEI,OAAO/C,UAAAA,CAAW,qBAAqBqD,eAAe,EAAA;AAC1D,YAAA,CAAA;YAEE,MAAM6B,cAAAA,CAAAA,CAAeC,IAAI,EAAEX,IAAI,EAAA;AAC7B,gBAAA,OAAO3D,OAAO0C,EAAA,CACXC,KAAK,CAAC,gCAAA,CAAA,CACN4B,MAAM,CAAC;oBAAEb,KAAAA,EAAO;AAAEK,wBAAAA,EAAAA,EAAIO,KAAKP;AAAE,qBAAA;oBAAID,IAAAA,EAAM;AAAEH,wBAAAA;AAAI;;AACpD,YAAA,CAAA;YAEE9E,QAAAA,CAAAA,CAAS2F,MAAM,EAAEV,IAAI,EAAA;gBACnB,MAAMW,wBAAAA,GAA2BzF,OAAAA,CAAQ0F,QAAQ,CAACZ,IAAAA,CAAAA;;gBAGlD,MAAMa,WAAAA,GAAc7F,gCAAgC2F,wBAAAA,EAA0B,GAAA,CAAA;gBAE9E,IAAI;oBACF,OAAOhG,CAAAA,CAAEI,QAAQ,CAAC2F,MAAAA,EAAQ;AAAEG,wBAAAA,WAAAA;wBAAaC,QAAAA,EAAU,KAAA;wBAAOC,MAAAA,EAAQ;qBAAK,CAAA,CAAIf,IAAAA,CAAAA;AACjF,gBAAA,CAAA,CAAM,OAAM;oBACN,MAAM,IAAI/E,MAAAA,CAAO+F,gBAAgB,CAAC,wBAAA,CAAA;AACxC,gBAAA;AACA,YAAA;SACA,CAAA;;;;;;"}

package/dist/server/strategies/users-permissions.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var require$$0 = require('lodash/fp');
+var require$$0 = require('lodash');
 var require$$1 = require('@strapi/utils');
 var index = require('../utils/index.js');
 
@@ -14,7 +14,7 @@ var hasRequiredUsersPermissions;
 function requireUsersPermissions() {
     if (hasRequiredUsersPermissions) return usersPermissions;
     hasRequiredUsersPermissions = 1;
-    const { castArray, map, every, pipe } = require$$0__default.default;
+    const { map, every } = require$$0__default.default;
     const { ForbiddenError, UnauthorizedError } = require$$1__default.default.errors;
     const { getService } = index.__require();
     const getAdvancedSettings = ()=>{
@@ -57,7 +57,7 @@ function requireUsersPermissions() {
                     };
                 }
                 // Fetch user's permissions
-                const permissions = await Promise.resolve(user.role.id).then(getService('permission').findRolePermissions).then(map(getService('permission').toContentAPIPermission));
+                const permissions = await Promise.resolve(user.role.id).then(getService('permission').findRolePermissions).then((permissions)=>map(permissions, (permission)=>getService('permission').toContentAPIPermission(permission)));
                 // Generate an ability (content API engine) based on the given permissions
                 const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);
                 ctx.state.user = user;
@@ -74,7 +74,7 @@ function requireUsersPermissions() {
                     ability
                 };
             }
-            const publicPermissions = await getService('permission').findPublicPermissions().then(map(getService('permission').toContentAPIPermission));
+            const publicPermissions = await getService('permission').findPublicPermissions().then((permissions)=>map(permissions, (permission)=>getService('permission').toContentAPIPermission(permission)));
             if (publicPermissions.length === 0) {
                 return {
                     authenticated: false
@@ -107,9 +107,10 @@ function requireUsersPermissions() {
         if (!ability) {
             throw new UnauthorizedError();
         }
-        const isAllowed = pipe(// Make sure we're dealing with an array
-        castArray, // Transform the scope array into an action array
-        every((scope)=>ability.can(scope)))(config.scope);
+        const scopes = Array.isArray(config.scope) ? config.scope : [
+            config.scope
+        ];
+        const isAllowed = every(scopes, (scope)=>ability.can(scope));
         if (!isAllowed) {
             throw new ForbiddenError();
         }

package/dist/server/strategies/users-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"users-permissions.js","sources":["../../../server/src/strategies/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst { castArray, map, every, pipe } = require('lodash/fp');\nconst { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;\n\nconst { getService } = require('../utils');\n\nconst getAdvancedSettings = () => {\n  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });\n};\n\nconst authenticate = async (ctx) => {\n  try {\n    const token = await getService('jwt').getToken(ctx);\n\n    if (token) {\n      const { id, sessionId } = token;\n\n      // Invalid token\n      if (id === undefined) {\n        return { authenticated: false };\n      }\n\n      const user = await getService('user').fetchAuthenticatedUser(id);\n\n      // No user associated to the token\n      if (!user) {\n        return { error: 'Invalid credentials' };\n      }\n\n      const advancedSettings = await getAdvancedSettings();\n\n      // User not confirmed\n      if (advancedSettings.email_confirmation && !user.confirmed) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // User blocked\n      if (user.blocked) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // Fetch user's permissions\n      const permissions = await Promise.resolve(user.role.id)\n        .then(getService('permission').findRolePermissions)\n        .then(map(getService('permission').toContentAPIPermission));\n\n      // Generate an ability (content API engine) based on the given permissions\n      const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);\n\n      ctx.state.user = user;\n      // Expose the session backing this request (refresh mode only) so endpoints\n      // can flag the \"current\" session when listing active sessions.\n      if (sessionId) {\n        ctx.state.session = { id: sessionId };\n      }\n\n      return {\n        authenticated: true,\n        credentials: user,\n        ability,\n      };\n    }\n\n    const publicPermissions = await getService('permission')\n      .findPublicPermissions()\n      .then(map(getService('permission').toContentAPIPermission));\n\n    if (publicPermissions.length === 0) {\n      return { authenticated: false };\n    }\n\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(publicPermissions);\n\n    return {\n      authenticated: true,\n      credentials: null,\n      ability,\n    };\n  } catch {\n    return { authenticated: false };\n  }\n};\n\nconst verify = async (auth, config) => {\n  const { credentials: user, ability } = auth;\n\n  if (!config.scope) {\n    if (!user) {\n      // A non authenticated user cannot access routes that do not have a scope\n      throw new UnauthorizedError();\n    } else {\n      // An authenticated user can access non scoped routes\n      return;\n    }\n  }\n\n  // If no ability have been generated, then consider auth is missing\n  if (!ability) {\n    throw new UnauthorizedError();\n  }\n\n  const isAllowed = pipe(\n    // Make sure we're dealing with an array\n    castArray,\n    // Transform the scope array into an action array\n    every((scope) => ability.can(scope))\n  )(config.scope);\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nmodule.exports = {\n  name: 'users-permissions',\n  authenticate,\n  verify,\n};\n"],"names":["castArray","map","every","pipe","require$$0","ForbiddenError","UnauthorizedError","require$$1","errors","getService","require$$2","getAdvancedSettings","strapi","store","type","name","get","key","authenticate","ctx","token","getToken","id","sessionId","undefined","authenticated","user","fetchAuthenticatedUser","error","advancedSettings","email_confirmation","confirmed","blocked","permissions","Promise","resolve","role","then","findRolePermissions","toContentAPIPermission","ability","contentAPI","engine","generateAbility","state","session","credentials","publicPermissions","findPublicPermissions","length","verify","auth","config","scope","isAllowed","can","usersPermissions"],"mappings":";;;;;;;;;;;;;;;;IAEA,MAAM,EAAEA,SAAS,EAAEC,GAAG,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,2BAAAA;AACxC,IAAA,MAAM,EAAEC,cAAc,EAAEC,iBAAiB,EAAE,GAAGC,4BAAyBC,MAAM;IAE7E,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB,IAAA;QAC1B,OAAOC,MAAAA,CAAOC,KAAK,CAAC;YAAEC,IAAAA,EAAM,QAAA;YAAUC,IAAAA,EAAM;AAAmB,SAAA,CAAA,CAAIC,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAU,SAAA,CAAA;AAC1F,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,OAAOC,GAAAA,GAAAA;QAC1B,IAAI;AACF,YAAA,MAAMC,KAAAA,GAAQ,MAAMX,UAAAA,CAAW,KAAA,CAAA,CAAOY,QAAQ,CAACF,GAAAA,CAAAA;AAE/C,YAAA,IAAIC,KAAAA,EAAO;AACT,gBAAA,MAAM,EAAEE,EAAE,EAAEC,SAAS,EAAE,GAAGH,KAAAA;;AAG1B,gBAAA,IAAIE,OAAOE,SAAAA,EAAW;oBACpB,OAAO;wBAAEC,aAAAA,EAAe;AAAK,qBAAA;AACrC,gBAAA;AAEM,gBAAA,MAAMC,IAAAA,GAAO,MAAMjB,UAAAA,CAAW,MAAA,CAAA,CAAQkB,sBAAsB,CAACL,EAAAA,CAAAA;;AAG7D,gBAAA,IAAI,CAACI,IAAAA,EAAM;oBACT,OAAO;wBAAEE,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;AAEM,gBAAA,MAAMC,mBAAmB,MAAMlB,mBAAAA,EAAAA;;AAG/B,gBAAA,IAAIkB,iBAAiBC,kBAAkB,IAAI,CAACJ,IAAAA,CAAKK,SAAS,EAAE;oBAC1D,OAAO;wBAAEH,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;;gBAGM,IAAIF,IAAAA,CAAKM,OAAO,EAAE;oBAChB,OAAO;wBAAEJ,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;;gBAGM,MAAMK,WAAAA,GAAc,MAAMC,OAAAA,CAAQC,OAAO,CAACT,IAAAA,CAAKU,IAAI,CAACd,EAAE,CAAA,CACnDe,IAAI,CAAC5B,UAAAA,CAAW,cAAc6B,mBAAmB,CAAA,CACjDD,IAAI,CAACpC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc8B,sBAAsB,CAAA,CAAA;;gBAG3D,MAAMC,OAAAA,GAAU,MAAM5B,MAAAA,CAAO6B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACV,WAAAA,CAAAA;gBAE3Ed,GAAAA,CAAIyB,KAAK,CAAClB,IAAI,GAAGA,IAAAA;;;AAGjB,gBAAA,IAAIH,SAAAA,EAAW;oBACbJ,GAAAA,CAAIyB,KAAK,CAACC,OAAO,GAAG;wBAAEvB,EAAAA,EAAIC;AAAS,qBAAA;AAC3C,gBAAA;gBAEM,OAAO;oBACLE,aAAAA,EAAe,IAAA;oBACfqB,WAAAA,EAAapB,IAAAA;AACbc,oBAAAA;AACR,iBAAA;AACA,YAAA;YAEI,MAAMO,iBAAAA,GAAoB,MAAMtC,UAAAA,CAAW,YAAA,CAAA,CACxCuC,qBAAqB,EAAA,CACrBX,IAAI,CAACpC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc8B,sBAAsB,CAAA,CAAA;YAE3D,IAAIQ,iBAAAA,CAAkBE,MAAM,KAAK,CAAA,EAAG;gBAClC,OAAO;oBAAExB,aAAAA,EAAe;AAAK,iBAAA;AACnC,YAAA;YAEI,MAAMe,OAAAA,GAAU,MAAM5B,MAAAA,CAAO6B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACI,iBAAAA,CAAAA;YAE3E,OAAO;gBACLtB,aAAAA,EAAe,IAAA;gBACfqB,WAAAA,EAAa,IAAA;AACbN,gBAAAA;AACN,aAAA;AACA,QAAA,CAAA,CAAI,OAAM;YACN,OAAO;gBAAEf,aAAAA,EAAe;AAAK,aAAA;AACjC,QAAA;AACA,IAAA,CAAA;IAEA,MAAMyB,MAAAA,GAAS,OAAOC,IAAAA,EAAMC,MAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEN,WAAAA,EAAapB,IAAI,EAAEc,OAAO,EAAE,GAAGW,IAAAA;QAEvC,IAAI,CAACC,MAAAA,CAAOC,KAAK,EAAE;AACjB,YAAA,IAAI,CAAC3B,IAAAA,EAAM;;AAET,gBAAA,MAAM,IAAIpB,iBAAAA,EAAAA;YAChB,CAAA,MAAW;;AAEL,gBAAA;AACN,YAAA;AACA,QAAA;;AAGE,QAAA,IAAI,CAACkC,OAAAA,EAAS;AACZ,YAAA,MAAM,IAAIlC,iBAAAA,EAAAA;AACd,QAAA;QAEE,MAAMgD,SAAAA,GAAYnD;AAEhBH,QAAAA,SAAAA;AAEAE,QAAAA,KAAAA,CAAM,CAACmD,KAAAA,GAAUb,OAAAA,CAAQe,GAAG,CAACF,KAAAA,CAAAA,CAAAA,CAAAA,CAC7BD,OAAOC,KAAK,CAAA;AAEd,QAAA,IAAI,CAACC,SAAAA,EAAW;AACd,YAAA,MAAM,IAAIjD,cAAAA,EAAAA;AACd,QAAA;AACA,IAAA,CAAA;IAEAmD,gBAAAA,GAAiB;QACfzC,IAAAA,EAAM,mBAAA;AACNG,QAAAA,YAAAA;AACAgC,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"users-permissions.js","sources":["../../../server/src/strategies/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst { map, every } = require('lodash');\nconst { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;\n\nconst { getService } = require('../utils');\n\nconst getAdvancedSettings = () => {\n  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });\n};\n\nconst authenticate = async (ctx) => {\n  try {\n    const token = await getService('jwt').getToken(ctx);\n\n    if (token) {\n      const { id, sessionId } = token;\n\n      // Invalid token\n      if (id === undefined) {\n        return { authenticated: false };\n      }\n\n      const user = await getService('user').fetchAuthenticatedUser(id);\n\n      // No user associated to the token\n      if (!user) {\n        return { error: 'Invalid credentials' };\n      }\n\n      const advancedSettings = await getAdvancedSettings();\n\n      // User not confirmed\n      if (advancedSettings.email_confirmation && !user.confirmed) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // User blocked\n      if (user.blocked) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // Fetch user's permissions\n      const permissions = await Promise.resolve(user.role.id)\n        .then(getService('permission').findRolePermissions)\n        .then((permissions) =>\n          map(permissions, (permission) =>\n            getService('permission').toContentAPIPermission(permission)\n          )\n        );\n\n      // Generate an ability (content API engine) based on the given permissions\n      const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);\n\n      ctx.state.user = user;\n      // Expose the session backing this request (refresh mode only) so endpoints\n      // can flag the \"current\" session when listing active sessions.\n      if (sessionId) {\n        ctx.state.session = { id: sessionId };\n      }\n\n      return {\n        authenticated: true,\n        credentials: user,\n        ability,\n      };\n    }\n\n    const publicPermissions = await getService('permission')\n      .findPublicPermissions()\n      .then((permissions) =>\n        map(permissions, (permission) =>\n          getService('permission').toContentAPIPermission(permission)\n        )\n      );\n\n    if (publicPermissions.length === 0) {\n      return { authenticated: false };\n    }\n\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(publicPermissions);\n\n    return {\n      authenticated: true,\n      credentials: null,\n      ability,\n    };\n  } catch {\n    return { authenticated: false };\n  }\n};\n\nconst verify = async (auth, config) => {\n  const { credentials: user, ability } = auth;\n\n  if (!config.scope) {\n    if (!user) {\n      // A non authenticated user cannot access routes that do not have a scope\n      throw new UnauthorizedError();\n    } else {\n      // An authenticated user can access non scoped routes\n      return;\n    }\n  }\n\n  // If no ability have been generated, then consider auth is missing\n  if (!ability) {\n    throw new UnauthorizedError();\n  }\n\n  const scopes = Array.isArray(config.scope) ? config.scope : [config.scope];\n  const isAllowed = every(scopes, (scope) => ability.can(scope));\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nmodule.exports = {\n  name: 'users-permissions',\n  authenticate,\n  verify,\n};\n"],"names":["map","every","require$$0","ForbiddenError","UnauthorizedError","require$$1","errors","getService","require$$2","getAdvancedSettings","strapi","store","type","name","get","key","authenticate","ctx","token","getToken","id","sessionId","undefined","authenticated","user","fetchAuthenticatedUser","error","advancedSettings","email_confirmation","confirmed","blocked","permissions","Promise","resolve","role","then","findRolePermissions","permission","toContentAPIPermission","ability","contentAPI","engine","generateAbility","state","session","credentials","publicPermissions","findPublicPermissions","length","verify","auth","config","scope","scopes","Array","isArray","isAllowed","can","usersPermissions"],"mappings":";;;;;;;;;;;;;;;;AAEA,IAAA,MAAM,EAAEA,GAAG,EAAEC,KAAK,EAAE,GAAGC,2BAAAA;AACvB,IAAA,MAAM,EAAEC,cAAc,EAAEC,iBAAiB,EAAE,GAAGC,4BAAyBC,MAAM;IAE7E,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB,IAAA;QAC1B,OAAOC,MAAAA,CAAOC,KAAK,CAAC;YAAEC,IAAAA,EAAM,QAAA;YAAUC,IAAAA,EAAM;AAAmB,SAAA,CAAA,CAAIC,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAU,SAAA,CAAA;AAC1F,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,OAAOC,GAAAA,GAAAA;QAC1B,IAAI;AACF,YAAA,MAAMC,KAAAA,GAAQ,MAAMX,UAAAA,CAAW,KAAA,CAAA,CAAOY,QAAQ,CAACF,GAAAA,CAAAA;AAE/C,YAAA,IAAIC,KAAAA,EAAO;AACT,gBAAA,MAAM,EAAEE,EAAE,EAAEC,SAAS,EAAE,GAAGH,KAAAA;;AAG1B,gBAAA,IAAIE,OAAOE,SAAAA,EAAW;oBACpB,OAAO;wBAAEC,aAAAA,EAAe;AAAK,qBAAA;AACrC,gBAAA;AAEM,gBAAA,MAAMC,IAAAA,GAAO,MAAMjB,UAAAA,CAAW,MAAA,CAAA,CAAQkB,sBAAsB,CAACL,EAAAA,CAAAA;;AAG7D,gBAAA,IAAI,CAACI,IAAAA,EAAM;oBACT,OAAO;wBAAEE,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;AAEM,gBAAA,MAAMC,mBAAmB,MAAMlB,mBAAAA,EAAAA;;AAG/B,gBAAA,IAAIkB,iBAAiBC,kBAAkB,IAAI,CAACJ,IAAAA,CAAKK,SAAS,EAAE;oBAC1D,OAAO;wBAAEH,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;;gBAGM,IAAIF,IAAAA,CAAKM,OAAO,EAAE;oBAChB,OAAO;wBAAEJ,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;;gBAGM,MAAMK,WAAAA,GAAc,MAAMC,OAAAA,CAAQC,OAAO,CAACT,IAAAA,CAAKU,IAAI,CAACd,EAAE,CAAA,CACnDe,IAAI,CAAC5B,UAAAA,CAAW,YAAA,CAAA,CAAc6B,mBAAmB,CAAA,CACjDD,IAAI,CAAC,CAACJ,WAAAA,GACL/B,GAAAA,CAAI+B,WAAAA,EAAa,CAACM,UAAAA,GAChB9B,UAAAA,CAAW,YAAA,CAAA,CAAc+B,sBAAsB,CAACD,UAAAA,CAAAA,CAAAA,CAAAA;;gBAKtD,MAAME,OAAAA,GAAU,MAAM7B,MAAAA,CAAO8B,UAAU,CAACT,WAAW,CAACU,MAAM,CAACC,eAAe,CAACX,WAAAA,CAAAA;gBAE3Ed,GAAAA,CAAI0B,KAAK,CAACnB,IAAI,GAAGA,IAAAA;;;AAGjB,gBAAA,IAAIH,SAAAA,EAAW;oBACbJ,GAAAA,CAAI0B,KAAK,CAACC,OAAO,GAAG;wBAAExB,EAAAA,EAAIC;AAAS,qBAAA;AAC3C,gBAAA;gBAEM,OAAO;oBACLE,aAAAA,EAAe,IAAA;oBACfsB,WAAAA,EAAarB,IAAAA;AACbe,oBAAAA;AACR,iBAAA;AACA,YAAA;AAEI,YAAA,MAAMO,oBAAoB,MAAMvC,UAAAA,CAAW,YAAA,CAAA,CACxCwC,qBAAqB,GACrBZ,IAAI,CAAC,CAACJ,WAAAA,GACL/B,IAAI+B,WAAAA,EAAa,CAACM,aAChB9B,UAAAA,CAAW,YAAA,CAAA,CAAc+B,sBAAsB,CAACD,UAAAA,CAAAA,CAAAA,CAAAA;YAItD,IAAIS,iBAAAA,CAAkBE,MAAM,KAAK,CAAA,EAAG;gBAClC,OAAO;oBAAEzB,aAAAA,EAAe;AAAK,iBAAA;AACnC,YAAA;YAEI,MAAMgB,OAAAA,GAAU,MAAM7B,MAAAA,CAAO8B,UAAU,CAACT,WAAW,CAACU,MAAM,CAACC,eAAe,CAACI,iBAAAA,CAAAA;YAE3E,OAAO;gBACLvB,aAAAA,EAAe,IAAA;gBACfsB,WAAAA,EAAa,IAAA;AACbN,gBAAAA;AACN,aAAA;AACA,QAAA,CAAA,CAAI,OAAM;YACN,OAAO;gBAAEhB,aAAAA,EAAe;AAAK,aAAA;AACjC,QAAA;AACA,IAAA,CAAA;IAEA,MAAM0B,MAAAA,GAAS,OAAOC,IAAAA,EAAMC,MAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEN,WAAAA,EAAarB,IAAI,EAAEe,OAAO,EAAE,GAAGW,IAAAA;QAEvC,IAAI,CAACC,MAAAA,CAAOC,KAAK,EAAE;AACjB,YAAA,IAAI,CAAC5B,IAAAA,EAAM;;AAET,gBAAA,MAAM,IAAIpB,iBAAAA,EAAAA;YAChB,CAAA,MAAW;;AAEL,gBAAA;AACN,YAAA;AACA,QAAA;;AAGE,QAAA,IAAI,CAACmC,OAAAA,EAAS;AACZ,YAAA,MAAM,IAAInC,iBAAAA,EAAAA;AACd,QAAA;QAEE,MAAMiD,MAAAA,GAASC,MAAMC,OAAO,CAACJ,OAAOC,KAAK,CAAA,GAAID,MAAAA,CAAOC,KAAK,GAAG;AAACD,YAAAA,MAAAA,CAAOC;AAAM,SAAA;AAC1E,QAAA,MAAMI,YAAYvD,KAAAA,CAAMoD,MAAAA,EAAQ,CAACD,KAAAA,GAAUb,OAAAA,CAAQkB,GAAG,CAACL,KAAAA,CAAAA,CAAAA;AAEvD,QAAA,IAAI,CAACI,SAAAA,EAAW;AACd,YAAA,MAAM,IAAIrD,cAAAA,EAAAA;AACd,QAAA;AACA,IAAA,CAAA;IAEAuD,gBAAAA,GAAiB;QACf7C,IAAAA,EAAM,mBAAA;AACNG,QAAAA,YAAAA;AACAiC,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/strategies/users-permissions.mjs

@@ -1,4 +1,4 @@
-import require$$0 from 'lodash/fp';
+import require$$0 from 'lodash';
 import require$$1 from '@strapi/utils';
 import { __require as requireUtils } from '../utils/index.mjs';
 
@@ -7,7 +7,7 @@ var hasRequiredUsersPermissions;
 function requireUsersPermissions() {
     if (hasRequiredUsersPermissions) return usersPermissions;
     hasRequiredUsersPermissions = 1;
-    const { castArray, map, every, pipe } = require$$0;
+    const { map, every } = require$$0;
     const { ForbiddenError, UnauthorizedError } = require$$1.errors;
     const { getService } = requireUtils();
     const getAdvancedSettings = ()=>{
@@ -50,7 +50,7 @@ function requireUsersPermissions() {
                     };
                 }
                 // Fetch user's permissions
-                const permissions = await Promise.resolve(user.role.id).then(getService('permission').findRolePermissions).then(map(getService('permission').toContentAPIPermission));
+                const permissions = await Promise.resolve(user.role.id).then(getService('permission').findRolePermissions).then((permissions)=>map(permissions, (permission)=>getService('permission').toContentAPIPermission(permission)));
                 // Generate an ability (content API engine) based on the given permissions
                 const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);
                 ctx.state.user = user;
@@ -67,7 +67,7 @@ function requireUsersPermissions() {
                     ability
                 };
             }
-            const publicPermissions = await getService('permission').findPublicPermissions().then(map(getService('permission').toContentAPIPermission));
+            const publicPermissions = await getService('permission').findPublicPermissions().then((permissions)=>map(permissions, (permission)=>getService('permission').toContentAPIPermission(permission)));
             if (publicPermissions.length === 0) {
                 return {
                     authenticated: false
@@ -100,9 +100,10 @@ function requireUsersPermissions() {
         if (!ability) {
             throw new UnauthorizedError();
         }
-        const isAllowed = pipe(// Make sure we're dealing with an array
-        castArray, // Transform the scope array into an action array
-        every((scope)=>ability.can(scope)))(config.scope);
+        const scopes = Array.isArray(config.scope) ? config.scope : [
+            config.scope
+        ];
+        const isAllowed = every(scopes, (scope)=>ability.can(scope));
         if (!isAllowed) {
             throw new ForbiddenError();
         }

package/dist/server/strategies/users-permissions.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"users-permissions.mjs","sources":["../../../server/src/strategies/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst { castArray, map, every, pipe } = require('lodash/fp');\nconst { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;\n\nconst { getService } = require('../utils');\n\nconst getAdvancedSettings = () => {\n  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });\n};\n\nconst authenticate = async (ctx) => {\n  try {\n    const token = await getService('jwt').getToken(ctx);\n\n    if (token) {\n      const { id, sessionId } = token;\n\n      // Invalid token\n      if (id === undefined) {\n        return { authenticated: false };\n      }\n\n      const user = await getService('user').fetchAuthenticatedUser(id);\n\n      // No user associated to the token\n      if (!user) {\n        return { error: 'Invalid credentials' };\n      }\n\n      const advancedSettings = await getAdvancedSettings();\n\n      // User not confirmed\n      if (advancedSettings.email_confirmation && !user.confirmed) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // User blocked\n      if (user.blocked) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // Fetch user's permissions\n      const permissions = await Promise.resolve(user.role.id)\n        .then(getService('permission').findRolePermissions)\n        .then(map(getService('permission').toContentAPIPermission));\n\n      // Generate an ability (content API engine) based on the given permissions\n      const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);\n\n      ctx.state.user = user;\n      // Expose the session backing this request (refresh mode only) so endpoints\n      // can flag the \"current\" session when listing active sessions.\n      if (sessionId) {\n        ctx.state.session = { id: sessionId };\n      }\n\n      return {\n        authenticated: true,\n        credentials: user,\n        ability,\n      };\n    }\n\n    const publicPermissions = await getService('permission')\n      .findPublicPermissions()\n      .then(map(getService('permission').toContentAPIPermission));\n\n    if (publicPermissions.length === 0) {\n      return { authenticated: false };\n    }\n\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(publicPermissions);\n\n    return {\n      authenticated: true,\n      credentials: null,\n      ability,\n    };\n  } catch {\n    return { authenticated: false };\n  }\n};\n\nconst verify = async (auth, config) => {\n  const { credentials: user, ability } = auth;\n\n  if (!config.scope) {\n    if (!user) {\n      // A non authenticated user cannot access routes that do not have a scope\n      throw new UnauthorizedError();\n    } else {\n      // An authenticated user can access non scoped routes\n      return;\n    }\n  }\n\n  // If no ability have been generated, then consider auth is missing\n  if (!ability) {\n    throw new UnauthorizedError();\n  }\n\n  const isAllowed = pipe(\n    // Make sure we're dealing with an array\n    castArray,\n    // Transform the scope array into an action array\n    every((scope) => ability.can(scope))\n  )(config.scope);\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nmodule.exports = {\n  name: 'users-permissions',\n  authenticate,\n  verify,\n};\n"],"names":["castArray","map","every","pipe","require$$0","ForbiddenError","UnauthorizedError","require$$1","errors","getService","require$$2","getAdvancedSettings","strapi","store","type","name","get","key","authenticate","ctx","token","getToken","id","sessionId","undefined","authenticated","user","fetchAuthenticatedUser","error","advancedSettings","email_confirmation","confirmed","blocked","permissions","Promise","resolve","role","then","findRolePermissions","toContentAPIPermission","ability","contentAPI","engine","generateAbility","state","session","credentials","publicPermissions","findPublicPermissions","length","verify","auth","config","scope","isAllowed","can","usersPermissions"],"mappings":";;;;;;;;;IAEA,MAAM,EAAEA,SAAS,EAAEC,GAAG,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,UAAAA;AACxC,IAAA,MAAM,EAAEC,cAAc,EAAEC,iBAAiB,EAAE,GAAGC,WAAyBC,MAAM;IAE7E,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB,IAAA;QAC1B,OAAOC,MAAAA,CAAOC,KAAK,CAAC;YAAEC,IAAAA,EAAM,QAAA;YAAUC,IAAAA,EAAM;AAAmB,SAAA,CAAA,CAAIC,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAU,SAAA,CAAA;AAC1F,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,OAAOC,GAAAA,GAAAA;QAC1B,IAAI;AACF,YAAA,MAAMC,KAAAA,GAAQ,MAAMX,UAAAA,CAAW,KAAA,CAAA,CAAOY,QAAQ,CAACF,GAAAA,CAAAA;AAE/C,YAAA,IAAIC,KAAAA,EAAO;AACT,gBAAA,MAAM,EAAEE,EAAE,EAAEC,SAAS,EAAE,GAAGH,KAAAA;;AAG1B,gBAAA,IAAIE,OAAOE,SAAAA,EAAW;oBACpB,OAAO;wBAAEC,aAAAA,EAAe;AAAK,qBAAA;AACrC,gBAAA;AAEM,gBAAA,MAAMC,IAAAA,GAAO,MAAMjB,UAAAA,CAAW,MAAA,CAAA,CAAQkB,sBAAsB,CAACL,EAAAA,CAAAA;;AAG7D,gBAAA,IAAI,CAACI,IAAAA,EAAM;oBACT,OAAO;wBAAEE,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;AAEM,gBAAA,MAAMC,mBAAmB,MAAMlB,mBAAAA,EAAAA;;AAG/B,gBAAA,IAAIkB,iBAAiBC,kBAAkB,IAAI,CAACJ,IAAAA,CAAKK,SAAS,EAAE;oBAC1D,OAAO;wBAAEH,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;;gBAGM,IAAIF,IAAAA,CAAKM,OAAO,EAAE;oBAChB,OAAO;wBAAEJ,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;;gBAGM,MAAMK,WAAAA,GAAc,MAAMC,OAAAA,CAAQC,OAAO,CAACT,IAAAA,CAAKU,IAAI,CAACd,EAAE,CAAA,CACnDe,IAAI,CAAC5B,UAAAA,CAAW,cAAc6B,mBAAmB,CAAA,CACjDD,IAAI,CAACpC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc8B,sBAAsB,CAAA,CAAA;;gBAG3D,MAAMC,OAAAA,GAAU,MAAM5B,MAAAA,CAAO6B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACV,WAAAA,CAAAA;gBAE3Ed,GAAAA,CAAIyB,KAAK,CAAClB,IAAI,GAAGA,IAAAA;;;AAGjB,gBAAA,IAAIH,SAAAA,EAAW;oBACbJ,GAAAA,CAAIyB,KAAK,CAACC,OAAO,GAAG;wBAAEvB,EAAAA,EAAIC;AAAS,qBAAA;AAC3C,gBAAA;gBAEM,OAAO;oBACLE,aAAAA,EAAe,IAAA;oBACfqB,WAAAA,EAAapB,IAAAA;AACbc,oBAAAA;AACR,iBAAA;AACA,YAAA;YAEI,MAAMO,iBAAAA,GAAoB,MAAMtC,UAAAA,CAAW,YAAA,CAAA,CACxCuC,qBAAqB,EAAA,CACrBX,IAAI,CAACpC,GAAAA,CAAIQ,UAAAA,CAAW,YAAA,CAAA,CAAc8B,sBAAsB,CAAA,CAAA;YAE3D,IAAIQ,iBAAAA,CAAkBE,MAAM,KAAK,CAAA,EAAG;gBAClC,OAAO;oBAAExB,aAAAA,EAAe;AAAK,iBAAA;AACnC,YAAA;YAEI,MAAMe,OAAAA,GAAU,MAAM5B,MAAAA,CAAO6B,UAAU,CAACR,WAAW,CAACS,MAAM,CAACC,eAAe,CAACI,iBAAAA,CAAAA;YAE3E,OAAO;gBACLtB,aAAAA,EAAe,IAAA;gBACfqB,WAAAA,EAAa,IAAA;AACbN,gBAAAA;AACN,aAAA;AACA,QAAA,CAAA,CAAI,OAAM;YACN,OAAO;gBAAEf,aAAAA,EAAe;AAAK,aAAA;AACjC,QAAA;AACA,IAAA,CAAA;IAEA,MAAMyB,MAAAA,GAAS,OAAOC,IAAAA,EAAMC,MAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEN,WAAAA,EAAapB,IAAI,EAAEc,OAAO,EAAE,GAAGW,IAAAA;QAEvC,IAAI,CAACC,MAAAA,CAAOC,KAAK,EAAE;AACjB,YAAA,IAAI,CAAC3B,IAAAA,EAAM;;AAET,gBAAA,MAAM,IAAIpB,iBAAAA,EAAAA;YAChB,CAAA,MAAW;;AAEL,gBAAA;AACN,YAAA;AACA,QAAA;;AAGE,QAAA,IAAI,CAACkC,OAAAA,EAAS;AACZ,YAAA,MAAM,IAAIlC,iBAAAA,EAAAA;AACd,QAAA;QAEE,MAAMgD,SAAAA,GAAYnD;AAEhBH,QAAAA,SAAAA;AAEAE,QAAAA,KAAAA,CAAM,CAACmD,KAAAA,GAAUb,OAAAA,CAAQe,GAAG,CAACF,KAAAA,CAAAA,CAAAA,CAAAA,CAC7BD,OAAOC,KAAK,CAAA;AAEd,QAAA,IAAI,CAACC,SAAAA,EAAW;AACd,YAAA,MAAM,IAAIjD,cAAAA,EAAAA;AACd,QAAA;AACA,IAAA,CAAA;IAEAmD,gBAAAA,GAAiB;QACfzC,IAAAA,EAAM,mBAAA;AACNG,QAAAA,YAAAA;AACAgC,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"users-permissions.mjs","sources":["../../../server/src/strategies/users-permissions.js"],"sourcesContent":["'use strict';\n\nconst { map, every } = require('lodash');\nconst { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;\n\nconst { getService } = require('../utils');\n\nconst getAdvancedSettings = () => {\n  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });\n};\n\nconst authenticate = async (ctx) => {\n  try {\n    const token = await getService('jwt').getToken(ctx);\n\n    if (token) {\n      const { id, sessionId } = token;\n\n      // Invalid token\n      if (id === undefined) {\n        return { authenticated: false };\n      }\n\n      const user = await getService('user').fetchAuthenticatedUser(id);\n\n      // No user associated to the token\n      if (!user) {\n        return { error: 'Invalid credentials' };\n      }\n\n      const advancedSettings = await getAdvancedSettings();\n\n      // User not confirmed\n      if (advancedSettings.email_confirmation && !user.confirmed) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // User blocked\n      if (user.blocked) {\n        return { error: 'Invalid credentials' };\n      }\n\n      // Fetch user's permissions\n      const permissions = await Promise.resolve(user.role.id)\n        .then(getService('permission').findRolePermissions)\n        .then((permissions) =>\n          map(permissions, (permission) =>\n            getService('permission').toContentAPIPermission(permission)\n          )\n        );\n\n      // Generate an ability (content API engine) based on the given permissions\n      const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);\n\n      ctx.state.user = user;\n      // Expose the session backing this request (refresh mode only) so endpoints\n      // can flag the \"current\" session when listing active sessions.\n      if (sessionId) {\n        ctx.state.session = { id: sessionId };\n      }\n\n      return {\n        authenticated: true,\n        credentials: user,\n        ability,\n      };\n    }\n\n    const publicPermissions = await getService('permission')\n      .findPublicPermissions()\n      .then((permissions) =>\n        map(permissions, (permission) =>\n          getService('permission').toContentAPIPermission(permission)\n        )\n      );\n\n    if (publicPermissions.length === 0) {\n      return { authenticated: false };\n    }\n\n    const ability = await strapi.contentAPI.permissions.engine.generateAbility(publicPermissions);\n\n    return {\n      authenticated: true,\n      credentials: null,\n      ability,\n    };\n  } catch {\n    return { authenticated: false };\n  }\n};\n\nconst verify = async (auth, config) => {\n  const { credentials: user, ability } = auth;\n\n  if (!config.scope) {\n    if (!user) {\n      // A non authenticated user cannot access routes that do not have a scope\n      throw new UnauthorizedError();\n    } else {\n      // An authenticated user can access non scoped routes\n      return;\n    }\n  }\n\n  // If no ability have been generated, then consider auth is missing\n  if (!ability) {\n    throw new UnauthorizedError();\n  }\n\n  const scopes = Array.isArray(config.scope) ? config.scope : [config.scope];\n  const isAllowed = every(scopes, (scope) => ability.can(scope));\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nmodule.exports = {\n  name: 'users-permissions',\n  authenticate,\n  verify,\n};\n"],"names":["map","every","require$$0","ForbiddenError","UnauthorizedError","require$$1","errors","getService","require$$2","getAdvancedSettings","strapi","store","type","name","get","key","authenticate","ctx","token","getToken","id","sessionId","undefined","authenticated","user","fetchAuthenticatedUser","error","advancedSettings","email_confirmation","confirmed","blocked","permissions","Promise","resolve","role","then","findRolePermissions","permission","toContentAPIPermission","ability","contentAPI","engine","generateAbility","state","session","credentials","publicPermissions","findPublicPermissions","length","verify","auth","config","scope","scopes","Array","isArray","isAllowed","can","usersPermissions"],"mappings":";;;;;;;;;AAEA,IAAA,MAAM,EAAEA,GAAG,EAAEC,KAAK,EAAE,GAAGC,UAAAA;AACvB,IAAA,MAAM,EAAEC,cAAc,EAAEC,iBAAiB,EAAE,GAAGC,WAAyBC,MAAM;IAE7E,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,mBAAAA,GAAsB,IAAA;QAC1B,OAAOC,MAAAA,CAAOC,KAAK,CAAC;YAAEC,IAAAA,EAAM,QAAA;YAAUC,IAAAA,EAAM;AAAmB,SAAA,CAAA,CAAIC,GAAG,CAAC;YAAEC,GAAAA,EAAK;AAAU,SAAA,CAAA;AAC1F,IAAA,CAAA;AAEA,IAAA,MAAMC,eAAe,OAAOC,GAAAA,GAAAA;QAC1B,IAAI;AACF,YAAA,MAAMC,KAAAA,GAAQ,MAAMX,UAAAA,CAAW,KAAA,CAAA,CAAOY,QAAQ,CAACF,GAAAA,CAAAA;AAE/C,YAAA,IAAIC,KAAAA,EAAO;AACT,gBAAA,MAAM,EAAEE,EAAE,EAAEC,SAAS,EAAE,GAAGH,KAAAA;;AAG1B,gBAAA,IAAIE,OAAOE,SAAAA,EAAW;oBACpB,OAAO;wBAAEC,aAAAA,EAAe;AAAK,qBAAA;AACrC,gBAAA;AAEM,gBAAA,MAAMC,IAAAA,GAAO,MAAMjB,UAAAA,CAAW,MAAA,CAAA,CAAQkB,sBAAsB,CAACL,EAAAA,CAAAA;;AAG7D,gBAAA,IAAI,CAACI,IAAAA,EAAM;oBACT,OAAO;wBAAEE,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;AAEM,gBAAA,MAAMC,mBAAmB,MAAMlB,mBAAAA,EAAAA;;AAG/B,gBAAA,IAAIkB,iBAAiBC,kBAAkB,IAAI,CAACJ,IAAAA,CAAKK,SAAS,EAAE;oBAC1D,OAAO;wBAAEH,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;;gBAGM,IAAIF,IAAAA,CAAKM,OAAO,EAAE;oBAChB,OAAO;wBAAEJ,KAAAA,EAAO;AAAqB,qBAAA;AAC7C,gBAAA;;gBAGM,MAAMK,WAAAA,GAAc,MAAMC,OAAAA,CAAQC,OAAO,CAACT,IAAAA,CAAKU,IAAI,CAACd,EAAE,CAAA,CACnDe,IAAI,CAAC5B,UAAAA,CAAW,YAAA,CAAA,CAAc6B,mBAAmB,CAAA,CACjDD,IAAI,CAAC,CAACJ,WAAAA,GACL/B,GAAAA,CAAI+B,WAAAA,EAAa,CAACM,UAAAA,GAChB9B,UAAAA,CAAW,YAAA,CAAA,CAAc+B,sBAAsB,CAACD,UAAAA,CAAAA,CAAAA,CAAAA;;gBAKtD,MAAME,OAAAA,GAAU,MAAM7B,MAAAA,CAAO8B,UAAU,CAACT,WAAW,CAACU,MAAM,CAACC,eAAe,CAACX,WAAAA,CAAAA;gBAE3Ed,GAAAA,CAAI0B,KAAK,CAACnB,IAAI,GAAGA,IAAAA;;;AAGjB,gBAAA,IAAIH,SAAAA,EAAW;oBACbJ,GAAAA,CAAI0B,KAAK,CAACC,OAAO,GAAG;wBAAExB,EAAAA,EAAIC;AAAS,qBAAA;AAC3C,gBAAA;gBAEM,OAAO;oBACLE,aAAAA,EAAe,IAAA;oBACfsB,WAAAA,EAAarB,IAAAA;AACbe,oBAAAA;AACR,iBAAA;AACA,YAAA;AAEI,YAAA,MAAMO,oBAAoB,MAAMvC,UAAAA,CAAW,YAAA,CAAA,CACxCwC,qBAAqB,GACrBZ,IAAI,CAAC,CAACJ,WAAAA,GACL/B,IAAI+B,WAAAA,EAAa,CAACM,aAChB9B,UAAAA,CAAW,YAAA,CAAA,CAAc+B,sBAAsB,CAACD,UAAAA,CAAAA,CAAAA,CAAAA;YAItD,IAAIS,iBAAAA,CAAkBE,MAAM,KAAK,CAAA,EAAG;gBAClC,OAAO;oBAAEzB,aAAAA,EAAe;AAAK,iBAAA;AACnC,YAAA;YAEI,MAAMgB,OAAAA,GAAU,MAAM7B,MAAAA,CAAO8B,UAAU,CAACT,WAAW,CAACU,MAAM,CAACC,eAAe,CAACI,iBAAAA,CAAAA;YAE3E,OAAO;gBACLvB,aAAAA,EAAe,IAAA;gBACfsB,WAAAA,EAAa,IAAA;AACbN,gBAAAA;AACN,aAAA;AACA,QAAA,CAAA,CAAI,OAAM;YACN,OAAO;gBAAEhB,aAAAA,EAAe;AAAK,aAAA;AACjC,QAAA;AACA,IAAA,CAAA;IAEA,MAAM0B,MAAAA,GAAS,OAAOC,IAAAA,EAAMC,MAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEN,WAAAA,EAAarB,IAAI,EAAEe,OAAO,EAAE,GAAGW,IAAAA;QAEvC,IAAI,CAACC,MAAAA,CAAOC,KAAK,EAAE;AACjB,YAAA,IAAI,CAAC5B,IAAAA,EAAM;;AAET,gBAAA,MAAM,IAAIpB,iBAAAA,EAAAA;YAChB,CAAA,MAAW;;AAEL,gBAAA;AACN,YAAA;AACA,QAAA;;AAGE,QAAA,IAAI,CAACmC,OAAAA,EAAS;AACZ,YAAA,MAAM,IAAInC,iBAAAA,EAAAA;AACd,QAAA;QAEE,MAAMiD,MAAAA,GAASC,MAAMC,OAAO,CAACJ,OAAOC,KAAK,CAAA,GAAID,MAAAA,CAAOC,KAAK,GAAG;AAACD,YAAAA,MAAAA,CAAOC;AAAM,SAAA;AAC1E,QAAA,MAAMI,YAAYvD,KAAAA,CAAMoD,MAAAA,EAAQ,CAACD,KAAAA,GAAUb,OAAAA,CAAQkB,GAAG,CAACL,KAAAA,CAAAA,CAAAA;AAEvD,QAAA,IAAI,CAACI,SAAAA,EAAW;AACd,YAAA,MAAM,IAAIrD,cAAAA,EAAAA;AACd,QAAA;AACA,IAAA,CAAA;IAEAuD,gBAAAA,GAAiB;QACf7C,IAAAA,EAAM,mBAAA;AACNG,QAAAA,YAAAA;AACAiC,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/sanitize/sanitizers.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var require$$0 = require('lodash/fp');
+var require$$0 = require('lodash');
 var require$$1 = require('@strapi/utils');
 var index = require('./visitors/index.js');
 

package/dist/server/utils/sanitize/sanitizers.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizers.js","sources":["../../../../server/src/utils/sanitize/sanitizers.js"],"sourcesContent":["'use strict';\n\nconst { curry } = require('lodash/fp');\nconst { traverseEntity, async } = require('@strapi/utils');\n\nconst { removeUserRelationFromRoleEntities } = require('./visitors');\n\nconst sanitizeUserRelationFromRoleEntities = curry((schema, entity) => {\n  return traverseEntity(\n    removeUserRelationFromRoleEntities,\n    { schema, getModel: strapi.getModel.bind(strapi) },\n    entity\n  );\n});\n\nconst defaultSanitizeOutput = curry((schema, entity) => {\n  return async.pipe(sanitizeUserRelationFromRoleEntities(schema))(entity);\n});\n\nmodule.exports = {\n  sanitizeUserRelationFromRoleEntities,\n  defaultSanitizeOutput,\n};\n"],"names":["curry","require$$0","traverseEntity","async","require$$1","removeUserRelationFromRoleEntities","require$$2","sanitizeUserRelationFromRoleEntities","schema","entity","getModel","strapi","bind","defaultSanitizeOutput","pipe","sanitizers"],"mappings":";;;;;;;;;;;;;;;;IAEA,MAAM,EAAEA,KAAK,EAAE,GAAGC,2BAAAA;AAClB,IAAA,MAAM,EAAEC,cAAc,EAAEC,KAAK,EAAE,GAAGC,2BAAAA;IAElC,MAAM,EAAEC,kCAAkC,EAAE,GAAGC,eAAAA,EAAAA;IAE/C,MAAMC,oCAAAA,GAAuCP,KAAAA,CAAM,CAACQ,MAAAA,EAAQC,MAAAA,GAAAA;AAC1D,QAAA,OAAOP,eACLG,kCAAAA,EACA;AAAEG,YAAAA,MAAAA;AAAQE,YAAAA,QAAAA,EAAUC,MAAAA,CAAOD,QAAQ,CAACE,IAAI,CAACD,MAAAA;SAAO,EAChDF,MAAAA,CAAAA;AAEJ,IAAA,CAAA,CAAA;IAEA,MAAMI,qBAAAA,GAAwBb,KAAAA,CAAM,CAACQ,MAAAA,EAAQC,MAAAA,GAAAA;AAC3C,QAAA,OAAON,KAAAA,CAAMW,IAAI,CAACP,oCAAAA,CAAqCC,MAAAA,CAAAA,CAAAA,CAASC,MAAAA,CAAAA;AAClE,IAAA,CAAA,CAAA;IAEAM,UAAAA,GAAiB;AACfR,QAAAA,oCAAAA;AACAM,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"sanitizers.js","sources":["../../../../server/src/utils/sanitize/sanitizers.js"],"sourcesContent":["'use strict';\n\nconst { curry } = require('lodash');\nconst { traverseEntity, async } = require('@strapi/utils');\n\nconst { removeUserRelationFromRoleEntities } = require('./visitors');\n\nconst sanitizeUserRelationFromRoleEntities = curry((schema, entity) => {\n  return traverseEntity(\n    removeUserRelationFromRoleEntities,\n    { schema, getModel: strapi.getModel.bind(strapi) },\n    entity\n  );\n});\n\nconst defaultSanitizeOutput = curry((schema, entity) => {\n  return async.pipe(sanitizeUserRelationFromRoleEntities(schema))(entity);\n});\n\nmodule.exports = {\n  sanitizeUserRelationFromRoleEntities,\n  defaultSanitizeOutput,\n};\n"],"names":["curry","require$$0","traverseEntity","async","require$$1","removeUserRelationFromRoleEntities","require$$2","sanitizeUserRelationFromRoleEntities","schema","entity","getModel","strapi","bind","defaultSanitizeOutput","pipe","sanitizers"],"mappings":";;;;;;;;;;;;;;;;IAEA,MAAM,EAAEA,KAAK,EAAE,GAAGC,2BAAAA;AAClB,IAAA,MAAM,EAAEC,cAAc,EAAEC,KAAK,EAAE,GAAGC,2BAAAA;IAElC,MAAM,EAAEC,kCAAkC,EAAE,GAAGC,eAAAA,EAAAA;IAE/C,MAAMC,oCAAAA,GAAuCP,KAAAA,CAAM,CAACQ,MAAAA,EAAQC,MAAAA,GAAAA;AAC1D,QAAA,OAAOP,eACLG,kCAAAA,EACA;AAAEG,YAAAA,MAAAA;AAAQE,YAAAA,QAAAA,EAAUC,MAAAA,CAAOD,QAAQ,CAACE,IAAI,CAACD,MAAAA;SAAO,EAChDF,MAAAA,CAAAA;AAEJ,IAAA,CAAA,CAAA;IAEA,MAAMI,qBAAAA,GAAwBb,KAAAA,CAAM,CAACQ,MAAAA,EAAQC,MAAAA,GAAAA;AAC3C,QAAA,OAAON,KAAAA,CAAMW,IAAI,CAACP,oCAAAA,CAAqCC,MAAAA,CAAAA,CAAAA,CAASC,MAAAA,CAAAA;AAClE,IAAA,CAAA,CAAA;IAEAM,UAAAA,GAAiB;AACfR,QAAAA,oCAAAA;AACAM,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/sanitize/sanitizers.mjs

@@ -1,4 +1,4 @@
-import require$$0 from 'lodash/fp';
+import require$$0 from 'lodash';
 import require$$1 from '@strapi/utils';
 import { __require as requireVisitors } from './visitors/index.mjs';
 

package/dist/server/utils/sanitize/sanitizers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizers.mjs","sources":["../../../../server/src/utils/sanitize/sanitizers.js"],"sourcesContent":["'use strict';\n\nconst { curry } = require('lodash/fp');\nconst { traverseEntity, async } = require('@strapi/utils');\n\nconst { removeUserRelationFromRoleEntities } = require('./visitors');\n\nconst sanitizeUserRelationFromRoleEntities = curry((schema, entity) => {\n  return traverseEntity(\n    removeUserRelationFromRoleEntities,\n    { schema, getModel: strapi.getModel.bind(strapi) },\n    entity\n  );\n});\n\nconst defaultSanitizeOutput = curry((schema, entity) => {\n  return async.pipe(sanitizeUserRelationFromRoleEntities(schema))(entity);\n});\n\nmodule.exports = {\n  sanitizeUserRelationFromRoleEntities,\n  defaultSanitizeOutput,\n};\n"],"names":["curry","require$$0","traverseEntity","async","require$$1","removeUserRelationFromRoleEntities","require$$2","sanitizeUserRelationFromRoleEntities","schema","entity","getModel","strapi","bind","defaultSanitizeOutput","pipe","sanitizers"],"mappings":";;;;;;;;;IAEA,MAAM,EAAEA,KAAK,EAAE,GAAGC,UAAAA;AAClB,IAAA,MAAM,EAAEC,cAAc,EAAEC,KAAK,EAAE,GAAGC,UAAAA;IAElC,MAAM,EAAEC,kCAAkC,EAAE,GAAGC,eAAAA,EAAAA;IAE/C,MAAMC,oCAAAA,GAAuCP,KAAAA,CAAM,CAACQ,MAAAA,EAAQC,MAAAA,GAAAA;AAC1D,QAAA,OAAOP,eACLG,kCAAAA,EACA;AAAEG,YAAAA,MAAAA;AAAQE,YAAAA,QAAAA,EAAUC,MAAAA,CAAOD,QAAQ,CAACE,IAAI,CAACD,MAAAA;SAAO,EAChDF,MAAAA,CAAAA;AAEJ,IAAA,CAAA,CAAA;IAEA,MAAMI,qBAAAA,GAAwBb,KAAAA,CAAM,CAACQ,MAAAA,EAAQC,MAAAA,GAAAA;AAC3C,QAAA,OAAON,KAAAA,CAAMW,IAAI,CAACP,oCAAAA,CAAqCC,MAAAA,CAAAA,CAAAA,CAASC,MAAAA,CAAAA;AAClE,IAAA,CAAA,CAAA;IAEAM,UAAAA,GAAiB;AACfR,QAAAA,oCAAAA;AACAM,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"sanitizers.mjs","sources":["../../../../server/src/utils/sanitize/sanitizers.js"],"sourcesContent":["'use strict';\n\nconst { curry } = require('lodash');\nconst { traverseEntity, async } = require('@strapi/utils');\n\nconst { removeUserRelationFromRoleEntities } = require('./visitors');\n\nconst sanitizeUserRelationFromRoleEntities = curry((schema, entity) => {\n  return traverseEntity(\n    removeUserRelationFromRoleEntities,\n    { schema, getModel: strapi.getModel.bind(strapi) },\n    entity\n  );\n});\n\nconst defaultSanitizeOutput = curry((schema, entity) => {\n  return async.pipe(sanitizeUserRelationFromRoleEntities(schema))(entity);\n});\n\nmodule.exports = {\n  sanitizeUserRelationFromRoleEntities,\n  defaultSanitizeOutput,\n};\n"],"names":["curry","require$$0","traverseEntity","async","require$$1","removeUserRelationFromRoleEntities","require$$2","sanitizeUserRelationFromRoleEntities","schema","entity","getModel","strapi","bind","defaultSanitizeOutput","pipe","sanitizers"],"mappings":";;;;;;;;;IAEA,MAAM,EAAEA,KAAK,EAAE,GAAGC,UAAAA;AAClB,IAAA,MAAM,EAAEC,cAAc,EAAEC,KAAK,EAAE,GAAGC,UAAAA;IAElC,MAAM,EAAEC,kCAAkC,EAAE,GAAGC,eAAAA,EAAAA;IAE/C,MAAMC,oCAAAA,GAAuCP,KAAAA,CAAM,CAACQ,MAAAA,EAAQC,MAAAA,GAAAA;AAC1D,QAAA,OAAOP,eACLG,kCAAAA,EACA;AAAEG,YAAAA,MAAAA;AAAQE,YAAAA,QAAAA,EAAUC,MAAAA,CAAOD,QAAQ,CAACE,IAAI,CAACD,MAAAA;SAAO,EAChDF,MAAAA,CAAAA;AAEJ,IAAA,CAAA,CAAA;IAEA,MAAMI,qBAAAA,GAAwBb,KAAAA,CAAM,CAACQ,MAAAA,EAAQC,MAAAA,GAAAA;AAC3C,QAAA,OAAON,KAAAA,CAAMW,IAAI,CAACP,oCAAAA,CAAqCC,MAAAA,CAAAA,CAAAA,CAASC,MAAAA,CAAAA;AAClE,IAAA,CAAA,CAAA;IAEAM,UAAAA,GAAiB;AACfR,QAAAA,oCAAAA;AACAM,QAAAA;AACF,KAAA;;;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/plugin-users-permissions",
-  "version": "5.56.0",
+  "version": "5.57.0",
   "description": "Protect your API with a full-authentication process based on JWT",
   "homepage": "https://strapi.io",
   "bugs": {
@@ -55,7 +55,7 @@
   "dependencies": {
     "@strapi/design-system": "2.2.4",
     "@strapi/icons": "2.2.4",
-    "@strapi/utils": "5.56.0",
+    "@strapi/utils": "5.57.0",
     "bcryptjs": "2.4.3",
     "formik": "2.4.9",
     "immer": "9.0.21",
@@ -72,8 +72,8 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@strapi/admin": "5.56.0",
-    "@strapi/strapi": "5.56.0",
+    "@strapi/admin": "5.57.0",
+    "@strapi/strapi": "5.57.0",
     "@testing-library/dom": "10.4.1",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.2",

package/server/src/controllers/auth.js

@@ -9,7 +9,6 @@
 /* eslint-disable no-useless-escape */
 const crypto = require('crypto');
 const _ = require('lodash');
-const { concat, compact, isArray } = require('lodash/fp');
 const utils = require('@strapi/utils');
 const { getService } = require('../utils');
 const { buildRefreshCookieOptions } = require('../utils/refresh-cookie-options');
@@ -556,9 +555,10 @@ module.exports = ({ strapi }) => ({
     const alwaysAllowedKeys = ['username', 'password', 'email'];
 
     // Note that we intentionally do not filter allowedFields to allow a project to explicitly accept private or other Strapi field on registration
-    const allowedKeys = compact(
-      concat(alwaysAllowedKeys, isArray(register?.allowedFields) ? register.allowedFields : [])
-    );
+    const allowedKeys = [
+      ...alwaysAllowedKeys,
+      ...(Array.isArray(register?.allowedFields) ? register.allowedFields : []),
+    ].filter((field) => Boolean(field));
 
     // Check if there are any keys in requestBody that are not in allowedKeys
     const invalidKeys = Object.keys(ctx.request.body).filter((key) => !allowedKeys.includes(key));

package/server/src/controllers/validation/email-template.js

@@ -1,6 +1,5 @@
 'use strict';
 
-const { trim } = require('lodash/fp');
 const {
   template: { createLooseInterpolationRegExp, createStrictInterpolationRegExp },
 } = require('@strapi/utils');
@@ -33,7 +32,7 @@ const matchAll = (pattern, src) => {
   while ((match = regexPatternWithGlobal.exec(src))) {
     const [, group] = match;
 
-    matches.push(trim(group));
+    matches.push(group.trim());
   }
 
   return matches;

package/server/src/graphql/mutations/auth/change-password.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
 const { createRateLimitRunner } = require('./rate-limit');

package/server/src/graphql/mutations/auth/email-confirmation.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
 

package/server/src/graphql/mutations/auth/forgot-password.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
 const { createRateLimitRunner } = require('./rate-limit');

package/server/src/graphql/mutations/auth/login.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
 const { createRateLimitRunner } = require('./rate-limit');

package/server/src/graphql/mutations/auth/register.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
 const { createRateLimitRunner } = require('./rate-limit');

package/server/src/graphql/mutations/auth/reset-password.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
 const { createRateLimitRunner } = require('./rate-limit');

package/server/src/graphql/mutations/crud/role/create-role.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const usersPermissionsRoleUID = 'plugin::users-permissions.role';
 

package/server/src/graphql/mutations/crud/user/create-user.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../../utils');
 

package/server/src/graphql/mutations/crud/user/update-user.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../../utils');