@strapi/plugin-users-permissions 5.56.0 → 5.58.0

package/dist/server/graphql/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sources":["../../../server/src/graphql/utils.js"],"sourcesContent":["'use strict';\n\nconst { getOr } = require('lodash/fp');\n\n/**\n * Throws an ApolloError if context body contains a bad request\n * @param contextBody - body of the context object given to the resolver\n * @throws ApolloError if the body is a bad request\n */\nfunction checkBadRequest(contextBody) {\n  const statusCode = getOr(200, 'statusCode', contextBody);\n\n  if (statusCode !== 200) {\n    const errorMessage = getOr('Bad Request', 'error', contextBody);\n\n    const exception = new Error(errorMessage);\n\n    exception.code = statusCode || 400;\n    exception.data = contextBody;\n\n    throw exception;\n  }\n}\n\nmodule.exports = {\n  checkBadRequest,\n};\n"],"names":["getOr","require$$0","checkBadRequest","contextBody","statusCode","errorMessage","exception","Error","code","data","utils"],"mappings":";;;;;;;;;;;;;IAEA,MAAM,EAAEA,KAAK,EAAE,GAAGC,2BAAAA;AAElB;;;;KAKA,SAASC,gBAAgBC,WAAW,EAAA;QAClC,MAAMC,UAAAA,GAAaJ,KAAAA,CAAM,GAAA,EAAK,YAAA,EAAcG,WAAAA,CAAAA;AAE5C,QAAA,IAAIC,eAAe,GAAA,EAAK;YACtB,MAAMC,YAAAA,GAAeL,KAAAA,CAAM,aAAA,EAAe,OAAA,EAASG,WAAAA,CAAAA;YAEnD,MAAMG,SAAAA,GAAY,IAAIC,KAAAA,CAAMF,YAAAA,CAAAA;YAE5BC,SAAAA,CAAUE,IAAI,GAAGJ,UAAAA,IAAc,GAAA;AAC/BE,YAAAA,SAAAA,CAAUG,IAAI,GAAGN,WAAAA;YAEjB,MAAMG,SAAAA;AACV,QAAA;AACA,IAAA;IAEAI,KAAAA,GAAiB;AACfR,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"utils.js","sources":["../../../server/src/graphql/utils.js"],"sourcesContent":["'use strict';\n\nconst { get } = require('lodash');\n\n/**\n * Throws an ApolloError if context body contains a bad request\n * @param contextBody - body of the context object given to the resolver\n * @throws ApolloError if the body is a bad request\n */\nfunction checkBadRequest(contextBody) {\n  const statusCode = get(contextBody, 'statusCode', 200);\n\n  if (statusCode !== 200) {\n    const errorMessage = get(contextBody, 'error', 'Bad Request');\n\n    const exception = new Error(errorMessage);\n\n    exception.code = statusCode || 400;\n    exception.data = contextBody;\n\n    throw exception;\n  }\n}\n\nmodule.exports = {\n  checkBadRequest,\n};\n"],"names":["get","require$$0","checkBadRequest","contextBody","statusCode","errorMessage","exception","Error","code","data","utils"],"mappings":";;;;;;;;;;;;;IAEA,MAAM,EAAEA,GAAG,EAAE,GAAGC,2BAAAA;AAEhB;;;;KAKA,SAASC,gBAAgBC,WAAW,EAAA;QAClC,MAAMC,UAAAA,GAAaJ,GAAAA,CAAIG,WAAAA,EAAa,YAAA,EAAc,GAAA,CAAA;AAElD,QAAA,IAAIC,eAAe,GAAA,EAAK;YACtB,MAAMC,YAAAA,GAAeL,GAAAA,CAAIG,WAAAA,EAAa,OAAA,EAAS,aAAA,CAAA;YAE/C,MAAMG,SAAAA,GAAY,IAAIC,KAAAA,CAAMF,YAAAA,CAAAA;YAE5BC,SAAAA,CAAUE,IAAI,GAAGJ,UAAAA,IAAc,GAAA;AAC/BE,YAAAA,SAAAA,CAAUG,IAAI,GAAGN,WAAAA;YAEjB,MAAMG,SAAAA;AACV,QAAA;AACA,IAAA;IAEAI,KAAAA,GAAiB;AACfR,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/graphql/utils.mjs

@@ -1,19 +1,19 @@
-import require$$0 from 'lodash/fp';
+import require$$0 from 'lodash';
 
 var utils;
 var hasRequiredUtils;
 function requireUtils() {
     if (hasRequiredUtils) return utils;
     hasRequiredUtils = 1;
-    const { getOr } = require$$0;
+    const { get } = require$$0;
     /**
 	 * Throws an ApolloError if context body contains a bad request
 	 * @param contextBody - body of the context object given to the resolver
 	 * @throws ApolloError if the body is a bad request
 	 */ function checkBadRequest(contextBody) {
-        const statusCode = getOr(200, 'statusCode', contextBody);
+        const statusCode = get(contextBody, 'statusCode', 200);
         if (statusCode !== 200) {
-            const errorMessage = getOr('Bad Request', 'error', contextBody);
+            const errorMessage = get(contextBody, 'error', 'Bad Request');
             const exception = new Error(errorMessage);
             exception.code = statusCode || 400;
             exception.data = contextBody;

package/dist/server/graphql/utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"utils.mjs","sources":["../../../server/src/graphql/utils.js"],"sourcesContent":["'use strict';\n\nconst { getOr } = require('lodash/fp');\n\n/**\n * Throws an ApolloError if context body contains a bad request\n * @param contextBody - body of the context object given to the resolver\n * @throws ApolloError if the body is a bad request\n */\nfunction checkBadRequest(contextBody) {\n  const statusCode = getOr(200, 'statusCode', contextBody);\n\n  if (statusCode !== 200) {\n    const errorMessage = getOr('Bad Request', 'error', contextBody);\n\n    const exception = new Error(errorMessage);\n\n    exception.code = statusCode || 400;\n    exception.data = contextBody;\n\n    throw exception;\n  }\n}\n\nmodule.exports = {\n  checkBadRequest,\n};\n"],"names":["getOr","require$$0","checkBadRequest","contextBody","statusCode","errorMessage","exception","Error","code","data","utils"],"mappings":";;;;;;;IAEA,MAAM,EAAEA,KAAK,EAAE,GAAGC,UAAAA;AAElB;;;;KAKA,SAASC,gBAAgBC,WAAW,EAAA;QAClC,MAAMC,UAAAA,GAAaJ,KAAAA,CAAM,GAAA,EAAK,YAAA,EAAcG,WAAAA,CAAAA;AAE5C,QAAA,IAAIC,eAAe,GAAA,EAAK;YACtB,MAAMC,YAAAA,GAAeL,KAAAA,CAAM,aAAA,EAAe,OAAA,EAASG,WAAAA,CAAAA;YAEnD,MAAMG,SAAAA,GAAY,IAAIC,KAAAA,CAAMF,YAAAA,CAAAA;YAE5BC,SAAAA,CAAUE,IAAI,GAAGJ,UAAAA,IAAc,GAAA;AAC/BE,YAAAA,SAAAA,CAAUG,IAAI,GAAGN,WAAAA;YAEjB,MAAMG,SAAAA;AACV,QAAA;AACA,IAAA;IAEAI,KAAAA,GAAiB;AACfR,QAAAA;AACF,KAAA;;;;;;"}
+{"version":3,"file":"utils.mjs","sources":["../../../server/src/graphql/utils.js"],"sourcesContent":["'use strict';\n\nconst { get } = require('lodash');\n\n/**\n * Throws an ApolloError if context body contains a bad request\n * @param contextBody - body of the context object given to the resolver\n * @throws ApolloError if the body is a bad request\n */\nfunction checkBadRequest(contextBody) {\n  const statusCode = get(contextBody, 'statusCode', 200);\n\n  if (statusCode !== 200) {\n    const errorMessage = get(contextBody, 'error', 'Bad Request');\n\n    const exception = new Error(errorMessage);\n\n    exception.code = statusCode || 400;\n    exception.data = contextBody;\n\n    throw exception;\n  }\n}\n\nmodule.exports = {\n  checkBadRequest,\n};\n"],"names":["get","require$$0","checkBadRequest","contextBody","statusCode","errorMessage","exception","Error","code","data","utils"],"mappings":";;;;;;;IAEA,MAAM,EAAEA,GAAG,EAAE,GAAGC,UAAAA;AAEhB;;;;KAKA,SAASC,gBAAgBC,WAAW,EAAA;QAClC,MAAMC,UAAAA,GAAaJ,GAAAA,CAAIG,WAAAA,EAAa,YAAA,EAAc,GAAA,CAAA;AAElD,QAAA,IAAIC,eAAe,GAAA,EAAK;YACtB,MAAMC,YAAAA,GAAeL,GAAAA,CAAIG,WAAAA,EAAa,OAAA,EAAS,aAAA,CAAA;YAE/C,MAAMG,SAAAA,GAAY,IAAIC,KAAAA,CAAMF,YAAAA,CAAAA;YAE5BC,SAAAA,CAAUE,IAAI,GAAGJ,UAAAA,IAAc,GAAA;AAC/BE,YAAAA,SAAAA,CAAUG,IAAI,GAAGN,WAAAA;YAEjB,MAAMG,SAAAA;AACV,QAAA;AACA,IAAA;IAEAI,KAAAA,GAAiB;AACfR,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/middlewares/rateLimit.js

@@ -3,7 +3,7 @@
 var rateLimit = require('../_virtual/rateLimit.js');
 var require$$1$1 = require('path');
 var require$$1 = require('@strapi/utils');
-var require$$0 = require('lodash/fp');
+var require$$0 = require('lodash');
 var require$$3 = require('koa2-ratelimit');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -19,7 +19,7 @@ function requireRateLimit() {
     hasRequiredRateLimit = 1;
     const path = require$$1__default$1.default;
     const utils = require$$1__default.default;
-    const { isString, has, toLower } = require$$0__default.default;
+    const { toLower, isString, has } = require$$0__default.default;
     const { RateLimitError } = utils.errors;
     /**
 	 * Routes where the rate-limit key MUST NOT include a user identifier
@@ -60,7 +60,7 @@ function requireRateLimit() {
 	 * `/api/auth/local/` share one bucket.
 	 */ const normalizeRequestPathForRateLimit = (requestPath)=>{
         const normalized = path.posix.normalize(requestPath);
-        const lower = toLower(normalized);
+        const lower = normalized.toLowerCase();
         return lower.replace(/\/+$/, '') || '/';
     };
     const getEmailIdentifierForKey = (body)=>{
@@ -106,7 +106,7 @@ function requireRateLimit() {
                     enabled: true
                 };
             }
-            if (!has('enabled', rateLimitConfig)) {
+            if (!has(rateLimitConfig, 'enabled')) {
                 rateLimitConfig.enabled = true;
             }
             if (rateLimitConfig.enabled === true) {

package/dist/server/middlewares/rateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.js","sources":["../../../server/src/middlewares/rateLimit.js"],"sourcesContent":["'use strict';\n\nconst path = require('path');\nconst utils = require('@strapi/utils');\nconst { isString, has, toLower } = require('lodash/fp');\n\nconst { RateLimitError } = utils.errors;\n\n/**\n * Routes where the rate-limit key MUST NOT include a user identifier\n * derived from `ctx.request.body.email`.\n *\n * On these routes the request body either has no `email` field\n * (e.g. /auth/local uses `identifier`, /auth/reset-password uses\n * `code`, /auth/change-password uses `currentPassword`) or the\n * field is not part of the route contract. Including the\n * attacker-controlled `body.email` in the rate-limit key on these\n * routes lets a caller obtain a fresh key on every request by\n * varying that field, effectively bypassing per-IP throttling.\n *\n * Comparison uses endsWith so the check is stable under any router\n * mount prefix (e.g. `/api/auth/local`).\n *\n * @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw\n *\n * When adding a new `rateLimit`-protected auth route whose body does not\n * use `email` as the real identifier, add its path suffix here (or an\n * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split\n * with arbitrary `body.email` values.\n */\nconst ROUTES_WITHOUT_IDENTIFIER = ['/auth/local', '/auth/reset-password', '/auth/change-password'];\n\nconst isOAuthCallbackPath = (requestPath) => requestPath.includes('/connect/');\n\nconst routeUsesEmailIdentifier = (requestPath) => {\n  if (isOAuthCallbackPath(requestPath)) {\n    return false;\n  }\n\n  return !ROUTES_WITHOUT_IDENTIFIER.some((route) => requestPath.endsWith(route));\n};\n\n/**\n * Paths suitable for route matching and prefix keys: POSIX-normalized,\n * lower-cased, trailing slashes removed so `/api/auth/local` and\n * `/api/auth/local/` share one bucket.\n */\nconst normalizeRequestPathForRateLimit = (requestPath) => {\n  const normalized = path.posix.normalize(requestPath);\n  const lower = toLower(normalized);\n  return lower.replace(/\\/+$/, '') || '/';\n};\n\nconst getEmailIdentifierForKey = (body) => {\n  if (!body || !isString(body.email) || body.email === '') {\n    return 'unknownIdentifier';\n  }\n\n  return toLower(body.email);\n};\n\nconst buildPrefixKey = (ctx) => {\n  let requestPath;\n  if (!isString(ctx.request.path)) {\n    requestPath = 'invalidPath';\n  } else {\n    requestPath = normalizeRequestPathForRateLimit(ctx.request.path);\n    if (requestPath === '.' || requestPath === '..') {\n      requestPath = 'invalidPath';\n    }\n  }\n\n  if (!routeUsesEmailIdentifier(requestPath)) {\n    return `noIdentifier:${requestPath}:${ctx.request.ip}`;\n  }\n\n  const userIdentifier = getEmailIdentifierForKey(ctx.request.body);\n  return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;\n};\n\nconst buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig) => {\n  return {\n    interval: { min: 5 },\n    max: 5,\n    ...rateLimitConfig,\n    ...routeMiddlewareConfig,\n    handler() {\n      throw new RateLimitError();\n    },\n    prefixKey: buildPrefixKey(ctx),\n  };\n};\n\nmodule.exports =\n  (config, { strapi }) =>\n  async (ctx, next) => {\n    let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');\n\n    if (!rateLimitConfig) {\n      rateLimitConfig = {\n        enabled: true,\n      };\n    }\n\n    if (!has('enabled', rateLimitConfig)) {\n      rateLimitConfig.enabled = true;\n    }\n\n    if (rateLimitConfig.enabled === true) {\n      const rateLimit = require('koa2-ratelimit').RateLimit;\n\n      const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);\n\n      return rateLimit.middleware(loadConfig)(ctx, next);\n    }\n\n    return next();\n  };\n\nmodule.exports.buildPrefixKey = buildPrefixKey;\nmodule.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;\nmodule.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;\nmodule.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;\n"],"names":["path","require$$0","utils","require$$1","isString","has","toLower","require$$2","RateLimitError","errors","ROUTES_WITHOUT_IDENTIFIER","isOAuthCallbackPath","requestPath","includes","routeUsesEmailIdentifier","some","route","endsWith","normalizeRequestPathForRateLimit","normalized","posix","normalize","lower","replace","getEmailIdentifierForKey","body","email","buildPrefixKey","ctx","request","ip","userIdentifier","buildRateLimitLoadConfig","rateLimitConfig","routeMiddlewareConfig","interval","min","max","handler","prefixKey","rateLimitModule","exports","config","strapi","next","get","enabled","rateLimit","require$$3","RateLimit","loadConfig","middleware"],"mappings":";;;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAMA,IAAAA,GAAOC,6BAAAA;AACb,IAAA,MAAMC,KAAAA,GAAQC,2BAAAA;AACd,IAAA,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,OAAO,EAAE,GAAGC,2BAAAA;AAEnC,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGN,MAAMO,MAAM;AAEvC;;;;;;;;;;;;;;;;;;;;;AAqBA,KACA,MAAMC,yBAAAA,GAA4B;AAAC,QAAA,aAAA;AAAe,QAAA,sBAAA;AAAwB,QAAA;AAAwB,KAAA;AAElG,IAAA,MAAMC,mBAAAA,GAAsB,CAACC,WAAAA,GAAgBA,WAAAA,CAAYC,QAAQ,CAAC,WAAA,CAAA;AAElE,IAAA,MAAMC,2BAA2B,CAACF,WAAAA,GAAAA;AAChC,QAAA,IAAID,oBAAoBC,WAAAA,CAAAA,EAAc;YACpC,OAAO,KAAA;AACX,QAAA;QAEE,OAAO,CAACF,0BAA0BK,IAAI,CAAC,CAACC,KAAAA,GAAUJ,WAAAA,CAAYK,QAAQ,CAACD,KAAAA,CAAAA,CAAAA;AACzE,IAAA,CAAA;AAEA;;;;KAKA,MAAME,mCAAmC,CAACN,WAAAA,GAAAA;AACxC,QAAA,MAAMO,UAAAA,GAAanB,IAAAA,CAAKoB,KAAK,CAACC,SAAS,CAACT,WAAAA,CAAAA;AACxC,QAAA,MAAMU,QAAQhB,OAAAA,CAAQa,UAAAA,CAAAA;AACtB,QAAA,OAAOG,KAAAA,CAAMC,OAAO,CAAC,MAAA,EAAQ,EAAA,CAAA,IAAO,GAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMC,2BAA2B,CAACC,IAAAA,GAAAA;QAChC,IAAI,CAACA,IAAAA,IAAQ,CAACrB,QAAAA,CAASqB,IAAAA,CAAKC,KAAK,CAAA,IAAKD,IAAAA,CAAKC,KAAK,KAAK,EAAA,EAAI;YACvD,OAAO,mBAAA;AACX,QAAA;QAEE,OAAOpB,OAAAA,CAAQmB,KAAKC,KAAK,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;QACtB,IAAIhB,WAAAA;AACJ,QAAA,IAAI,CAACR,QAAAA,CAASwB,GAAAA,CAAIC,OAAO,CAAC7B,IAAI,CAAA,EAAG;YAC/BY,WAAAA,GAAc,aAAA;QAClB,CAAA,MAAS;AACLA,YAAAA,WAAAA,GAAcM,gCAAAA,CAAiCU,GAAAA,CAAIC,OAAO,CAAC7B,IAAI,CAAA;YAC/D,IAAIY,WAAAA,KAAgB,GAAA,IAAOA,WAAAA,KAAgB,IAAA,EAAM;gBAC/CA,WAAAA,GAAc,aAAA;AACpB,YAAA;AACA,QAAA;QAEE,IAAI,CAACE,yBAAyBF,WAAAA,CAAAA,EAAc;YAC1C,OAAO,CAAC,aAAa,EAAEA,WAAAA,CAAY,CAAC,EAAEgB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC1D,QAAA;AAEE,QAAA,MAAMC,cAAAA,GAAiBP,wBAAAA,CAAyBI,GAAAA,CAAIC,OAAO,CAACJ,IAAI,CAAA;QAChE,OAAO,CAAA,EAAGM,cAAAA,CAAe,CAAC,EAAEnB,WAAAA,CAAY,CAAC,EAAEgB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC7D,IAAA,CAAA;IAEA,MAAME,wBAAAA,GAA2B,CAACJ,GAAAA,EAAKK,eAAAA,EAAiBC,qBAAAA,GAAAA;QACtD,OAAO;YACLC,QAAAA,EAAU;gBAAEC,GAAAA,EAAK;AAAC,aAAA;YAClBC,GAAAA,EAAK,CAAA;AACL,YAAA,GAAGJ,eAAe;AAClB,YAAA,GAAGC,qBAAqB;AACxBI,YAAAA,OAAAA,CAAAA,GAAAA;AACE,gBAAA,MAAM,IAAI9B,cAAAA,EAAAA;AAChB,YAAA,CAAA;AACI+B,YAAAA,SAAAA,EAAWZ,cAAAA,CAAeC,GAAAA;AAC9B,SAAA;AACA,IAAA,CAAA;IAEAY,kBAAAA,CAAAC,OAAc,GACZ,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,OAAOf,GAAAA,EAAKgB,IAAAA,GAAAA;AACV,YAAA,IAAIX,eAAAA,GAAkBU,MAAAA,CAAOD,MAAM,CAACG,GAAG,CAAC,qCAAA,CAAA;AAExC,YAAA,IAAI,CAACZ,eAAAA,EAAiB;gBACpBA,eAAAA,GAAkB;oBAChBa,OAAAA,EAAS;AACjB,iBAAA;AACA,YAAA;YAEI,IAAI,CAACzC,GAAAA,CAAI,SAAA,EAAW4B,eAAAA,CAAAA,EAAkB;AACpCA,gBAAAA,eAAAA,CAAgBa,OAAO,GAAG,IAAA;AAChC,YAAA;YAEI,IAAIb,eAAAA,CAAgBa,OAAO,KAAK,IAAA,EAAM;gBACpC,MAAMC,SAAAA,GAAYC,4BAA0BC,SAAS;gBAErD,MAAMC,UAAAA,GAAalB,wBAAAA,CAAyBJ,GAAAA,EAAKK,eAAAA,EAAiBS,MAAAA,CAAAA;AAElE,gBAAA,OAAOK,SAAAA,CAAUI,UAAU,CAACD,UAAAA,CAAAA,CAAYtB,GAAAA,EAAKgB,IAAAA,CAAAA;AACnD,YAAA;YAEI,OAAOA,IAAAA,EAAAA;AACX,QAAA,CAAA;IAEAJ,kBAAAA,CAAAC,OAAA,CAAAd,cAA6B,GAAGA,cAAAA;IAChCa,kBAAAA,CAAAC,OAAA,CAAA/B,yBAAwC,GAAGA,yBAAAA;IAC3C8B,kBAAAA,CAAAC,OAAA,CAAAvB,gCAA+C,GAAGA,gCAAAA;IAClDsB,kBAAAA,CAAAC,OAAA,CAAAT,wBAAuC,GAAGA,wBAAAA;;;;;;"}
+{"version":3,"file":"rateLimit.js","sources":["../../../server/src/middlewares/rateLimit.js"],"sourcesContent":["'use strict';\n\nconst path = require('path');\nconst utils = require('@strapi/utils');\nconst { toLower, isString, has } = require('lodash');\n\nconst { RateLimitError } = utils.errors;\n\n/**\n * Routes where the rate-limit key MUST NOT include a user identifier\n * derived from `ctx.request.body.email`.\n *\n * On these routes the request body either has no `email` field\n * (e.g. /auth/local uses `identifier`, /auth/reset-password uses\n * `code`, /auth/change-password uses `currentPassword`) or the\n * field is not part of the route contract. Including the\n * attacker-controlled `body.email` in the rate-limit key on these\n * routes lets a caller obtain a fresh key on every request by\n * varying that field, effectively bypassing per-IP throttling.\n *\n * Comparison uses endsWith so the check is stable under any router\n * mount prefix (e.g. `/api/auth/local`).\n *\n * @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw\n *\n * When adding a new `rateLimit`-protected auth route whose body does not\n * use `email` as the real identifier, add its path suffix here (or an\n * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split\n * with arbitrary `body.email` values.\n */\nconst ROUTES_WITHOUT_IDENTIFIER = ['/auth/local', '/auth/reset-password', '/auth/change-password'];\n\nconst isOAuthCallbackPath = (requestPath) => requestPath.includes('/connect/');\n\nconst routeUsesEmailIdentifier = (requestPath) => {\n  if (isOAuthCallbackPath(requestPath)) {\n    return false;\n  }\n\n  return !ROUTES_WITHOUT_IDENTIFIER.some((route) => requestPath.endsWith(route));\n};\n\n/**\n * Paths suitable for route matching and prefix keys: POSIX-normalized,\n * lower-cased, trailing slashes removed so `/api/auth/local` and\n * `/api/auth/local/` share one bucket.\n */\nconst normalizeRequestPathForRateLimit = (requestPath) => {\n  const normalized = path.posix.normalize(requestPath);\n  const lower = normalized.toLowerCase();\n  return lower.replace(/\\/+$/, '') || '/';\n};\n\nconst getEmailIdentifierForKey = (body) => {\n  if (!body || !isString(body.email) || body.email === '') {\n    return 'unknownIdentifier';\n  }\n\n  return toLower(body.email);\n};\n\nconst buildPrefixKey = (ctx) => {\n  let requestPath;\n  if (!isString(ctx.request.path)) {\n    requestPath = 'invalidPath';\n  } else {\n    requestPath = normalizeRequestPathForRateLimit(ctx.request.path);\n    if (requestPath === '.' || requestPath === '..') {\n      requestPath = 'invalidPath';\n    }\n  }\n\n  if (!routeUsesEmailIdentifier(requestPath)) {\n    return `noIdentifier:${requestPath}:${ctx.request.ip}`;\n  }\n\n  const userIdentifier = getEmailIdentifierForKey(ctx.request.body);\n  return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;\n};\n\nconst buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig) => {\n  return {\n    interval: { min: 5 },\n    max: 5,\n    ...rateLimitConfig,\n    ...routeMiddlewareConfig,\n    handler() {\n      throw new RateLimitError();\n    },\n    prefixKey: buildPrefixKey(ctx),\n  };\n};\n\nmodule.exports =\n  (config, { strapi }) =>\n  async (ctx, next) => {\n    let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');\n\n    if (!rateLimitConfig) {\n      rateLimitConfig = {\n        enabled: true,\n      };\n    }\n\n    if (!has(rateLimitConfig, 'enabled')) {\n      rateLimitConfig.enabled = true;\n    }\n\n    if (rateLimitConfig.enabled === true) {\n      const rateLimit = require('koa2-ratelimit').RateLimit;\n\n      const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);\n\n      return rateLimit.middleware(loadConfig)(ctx, next);\n    }\n\n    return next();\n  };\n\nmodule.exports.buildPrefixKey = buildPrefixKey;\nmodule.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;\nmodule.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;\nmodule.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;\n"],"names":["path","require$$0","utils","require$$1","toLower","isString","has","require$$2","RateLimitError","errors","ROUTES_WITHOUT_IDENTIFIER","isOAuthCallbackPath","requestPath","includes","routeUsesEmailIdentifier","some","route","endsWith","normalizeRequestPathForRateLimit","normalized","posix","normalize","lower","toLowerCase","replace","getEmailIdentifierForKey","body","email","buildPrefixKey","ctx","request","ip","userIdentifier","buildRateLimitLoadConfig","rateLimitConfig","routeMiddlewareConfig","interval","min","max","handler","prefixKey","rateLimitModule","exports","config","strapi","next","get","enabled","rateLimit","require$$3","RateLimit","loadConfig","middleware"],"mappings":";;;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAMA,IAAAA,GAAOC,6BAAAA;AACb,IAAA,MAAMC,KAAAA,GAAQC,2BAAAA;AACd,IAAA,MAAM,EAAEC,OAAO,EAAEC,QAAQ,EAAEC,GAAG,EAAE,GAAGC,2BAAAA;AAEnC,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGN,MAAMO,MAAM;AAEvC;;;;;;;;;;;;;;;;;;;;;AAqBA,KACA,MAAMC,yBAAAA,GAA4B;AAAC,QAAA,aAAA;AAAe,QAAA,sBAAA;AAAwB,QAAA;AAAwB,KAAA;AAElG,IAAA,MAAMC,mBAAAA,GAAsB,CAACC,WAAAA,GAAgBA,WAAAA,CAAYC,QAAQ,CAAC,WAAA,CAAA;AAElE,IAAA,MAAMC,2BAA2B,CAACF,WAAAA,GAAAA;AAChC,QAAA,IAAID,oBAAoBC,WAAAA,CAAAA,EAAc;YACpC,OAAO,KAAA;AACX,QAAA;QAEE,OAAO,CAACF,0BAA0BK,IAAI,CAAC,CAACC,KAAAA,GAAUJ,WAAAA,CAAYK,QAAQ,CAACD,KAAAA,CAAAA,CAAAA;AACzE,IAAA,CAAA;AAEA;;;;KAKA,MAAME,mCAAmC,CAACN,WAAAA,GAAAA;AACxC,QAAA,MAAMO,UAAAA,GAAanB,IAAAA,CAAKoB,KAAK,CAACC,SAAS,CAACT,WAAAA,CAAAA;QACxC,MAAMU,KAAAA,GAAQH,WAAWI,WAAW,EAAA;AACpC,QAAA,OAAOD,KAAAA,CAAME,OAAO,CAAC,MAAA,EAAQ,EAAA,CAAA,IAAO,GAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMC,2BAA2B,CAACC,IAAAA,GAAAA;QAChC,IAAI,CAACA,IAAAA,IAAQ,CAACrB,QAAAA,CAASqB,IAAAA,CAAKC,KAAK,CAAA,IAAKD,IAAAA,CAAKC,KAAK,KAAK,EAAA,EAAI;YACvD,OAAO,mBAAA;AACX,QAAA;QAEE,OAAOvB,OAAAA,CAAQsB,KAAKC,KAAK,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;QACtB,IAAIjB,WAAAA;AACJ,QAAA,IAAI,CAACP,QAAAA,CAASwB,GAAAA,CAAIC,OAAO,CAAC9B,IAAI,CAAA,EAAG;YAC/BY,WAAAA,GAAc,aAAA;QAClB,CAAA,MAAS;AACLA,YAAAA,WAAAA,GAAcM,gCAAAA,CAAiCW,GAAAA,CAAIC,OAAO,CAAC9B,IAAI,CAAA;YAC/D,IAAIY,WAAAA,KAAgB,GAAA,IAAOA,WAAAA,KAAgB,IAAA,EAAM;gBAC/CA,WAAAA,GAAc,aAAA;AACpB,YAAA;AACA,QAAA;QAEE,IAAI,CAACE,yBAAyBF,WAAAA,CAAAA,EAAc;YAC1C,OAAO,CAAC,aAAa,EAAEA,WAAAA,CAAY,CAAC,EAAEiB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC1D,QAAA;AAEE,QAAA,MAAMC,cAAAA,GAAiBP,wBAAAA,CAAyBI,GAAAA,CAAIC,OAAO,CAACJ,IAAI,CAAA;QAChE,OAAO,CAAA,EAAGM,cAAAA,CAAe,CAAC,EAAEpB,WAAAA,CAAY,CAAC,EAAEiB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC7D,IAAA,CAAA;IAEA,MAAME,wBAAAA,GAA2B,CAACJ,GAAAA,EAAKK,eAAAA,EAAiBC,qBAAAA,GAAAA;QACtD,OAAO;YACLC,QAAAA,EAAU;gBAAEC,GAAAA,EAAK;AAAC,aAAA;YAClBC,GAAAA,EAAK,CAAA;AACL,YAAA,GAAGJ,eAAe;AAClB,YAAA,GAAGC,qBAAqB;AACxBI,YAAAA,OAAAA,CAAAA,GAAAA;AACE,gBAAA,MAAM,IAAI/B,cAAAA,EAAAA;AAChB,YAAA,CAAA;AACIgC,YAAAA,SAAAA,EAAWZ,cAAAA,CAAeC,GAAAA;AAC9B,SAAA;AACA,IAAA,CAAA;IAEAY,kBAAAA,CAAAC,OAAc,GACZ,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,OAAOf,GAAAA,EAAKgB,IAAAA,GAAAA;AACV,YAAA,IAAIX,eAAAA,GAAkBU,MAAAA,CAAOD,MAAM,CAACG,GAAG,CAAC,qCAAA,CAAA;AAExC,YAAA,IAAI,CAACZ,eAAAA,EAAiB;gBACpBA,eAAAA,GAAkB;oBAChBa,OAAAA,EAAS;AACjB,iBAAA;AACA,YAAA;YAEI,IAAI,CAACzC,GAAAA,CAAI4B,eAAAA,EAAiB,SAAA,CAAA,EAAY;AACpCA,gBAAAA,eAAAA,CAAgBa,OAAO,GAAG,IAAA;AAChC,YAAA;YAEI,IAAIb,eAAAA,CAAgBa,OAAO,KAAK,IAAA,EAAM;gBACpC,MAAMC,SAAAA,GAAYC,4BAA0BC,SAAS;gBAErD,MAAMC,UAAAA,GAAalB,wBAAAA,CAAyBJ,GAAAA,EAAKK,eAAAA,EAAiBS,MAAAA,CAAAA;AAElE,gBAAA,OAAOK,SAAAA,CAAUI,UAAU,CAACD,UAAAA,CAAAA,CAAYtB,GAAAA,EAAKgB,IAAAA,CAAAA;AACnD,YAAA;YAEI,OAAOA,IAAAA,EAAAA;AACX,QAAA,CAAA;IAEAJ,kBAAAA,CAAAC,OAAA,CAAAd,cAA6B,GAAGA,cAAAA;IAChCa,kBAAAA,CAAAC,OAAA,CAAAhC,yBAAwC,GAAGA,yBAAAA;IAC3C+B,kBAAAA,CAAAC,OAAA,CAAAxB,gCAA+C,GAAGA,gCAAAA;IAClDuB,kBAAAA,CAAAC,OAAA,CAAAT,wBAAuC,GAAGA,wBAAAA;;;;;;"}

package/dist/server/middlewares/rateLimit.mjs

@@ -1,7 +1,7 @@
 import { __module as rateLimit } from '../_virtual/rateLimit.mjs';
 import require$$1$1 from 'path';
 import require$$1 from '@strapi/utils';
-import require$$0 from 'lodash/fp';
+import require$$0 from 'lodash';
 import require$$3 from 'koa2-ratelimit';
 
 var hasRequiredRateLimit;
@@ -10,7 +10,7 @@ function requireRateLimit() {
     hasRequiredRateLimit = 1;
     const path = require$$1$1;
     const utils = require$$1;
-    const { isString, has, toLower } = require$$0;
+    const { toLower, isString, has } = require$$0;
     const { RateLimitError } = utils.errors;
     /**
 	 * Routes where the rate-limit key MUST NOT include a user identifier
@@ -51,7 +51,7 @@ function requireRateLimit() {
 	 * `/api/auth/local/` share one bucket.
 	 */ const normalizeRequestPathForRateLimit = (requestPath)=>{
         const normalized = path.posix.normalize(requestPath);
-        const lower = toLower(normalized);
+        const lower = normalized.toLowerCase();
         return lower.replace(/\/+$/, '') || '/';
     };
     const getEmailIdentifierForKey = (body)=>{
@@ -97,7 +97,7 @@ function requireRateLimit() {
                     enabled: true
                 };
             }
-            if (!has('enabled', rateLimitConfig)) {
+            if (!has(rateLimitConfig, 'enabled')) {
                 rateLimitConfig.enabled = true;
             }
             if (rateLimitConfig.enabled === true) {

package/dist/server/middlewares/rateLimit.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.mjs","sources":["../../../server/src/middlewares/rateLimit.js"],"sourcesContent":["'use strict';\n\nconst path = require('path');\nconst utils = require('@strapi/utils');\nconst { isString, has, toLower } = require('lodash/fp');\n\nconst { RateLimitError } = utils.errors;\n\n/**\n * Routes where the rate-limit key MUST NOT include a user identifier\n * derived from `ctx.request.body.email`.\n *\n * On these routes the request body either has no `email` field\n * (e.g. /auth/local uses `identifier`, /auth/reset-password uses\n * `code`, /auth/change-password uses `currentPassword`) or the\n * field is not part of the route contract. Including the\n * attacker-controlled `body.email` in the rate-limit key on these\n * routes lets a caller obtain a fresh key on every request by\n * varying that field, effectively bypassing per-IP throttling.\n *\n * Comparison uses endsWith so the check is stable under any router\n * mount prefix (e.g. `/api/auth/local`).\n *\n * @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw\n *\n * When adding a new `rateLimit`-protected auth route whose body does not\n * use `email` as the real identifier, add its path suffix here (or an\n * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split\n * with arbitrary `body.email` values.\n */\nconst ROUTES_WITHOUT_IDENTIFIER = ['/auth/local', '/auth/reset-password', '/auth/change-password'];\n\nconst isOAuthCallbackPath = (requestPath) => requestPath.includes('/connect/');\n\nconst routeUsesEmailIdentifier = (requestPath) => {\n  if (isOAuthCallbackPath(requestPath)) {\n    return false;\n  }\n\n  return !ROUTES_WITHOUT_IDENTIFIER.some((route) => requestPath.endsWith(route));\n};\n\n/**\n * Paths suitable for route matching and prefix keys: POSIX-normalized,\n * lower-cased, trailing slashes removed so `/api/auth/local` and\n * `/api/auth/local/` share one bucket.\n */\nconst normalizeRequestPathForRateLimit = (requestPath) => {\n  const normalized = path.posix.normalize(requestPath);\n  const lower = toLower(normalized);\n  return lower.replace(/\\/+$/, '') || '/';\n};\n\nconst getEmailIdentifierForKey = (body) => {\n  if (!body || !isString(body.email) || body.email === '') {\n    return 'unknownIdentifier';\n  }\n\n  return toLower(body.email);\n};\n\nconst buildPrefixKey = (ctx) => {\n  let requestPath;\n  if (!isString(ctx.request.path)) {\n    requestPath = 'invalidPath';\n  } else {\n    requestPath = normalizeRequestPathForRateLimit(ctx.request.path);\n    if (requestPath === '.' || requestPath === '..') {\n      requestPath = 'invalidPath';\n    }\n  }\n\n  if (!routeUsesEmailIdentifier(requestPath)) {\n    return `noIdentifier:${requestPath}:${ctx.request.ip}`;\n  }\n\n  const userIdentifier = getEmailIdentifierForKey(ctx.request.body);\n  return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;\n};\n\nconst buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig) => {\n  return {\n    interval: { min: 5 },\n    max: 5,\n    ...rateLimitConfig,\n    ...routeMiddlewareConfig,\n    handler() {\n      throw new RateLimitError();\n    },\n    prefixKey: buildPrefixKey(ctx),\n  };\n};\n\nmodule.exports =\n  (config, { strapi }) =>\n  async (ctx, next) => {\n    let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');\n\n    if (!rateLimitConfig) {\n      rateLimitConfig = {\n        enabled: true,\n      };\n    }\n\n    if (!has('enabled', rateLimitConfig)) {\n      rateLimitConfig.enabled = true;\n    }\n\n    if (rateLimitConfig.enabled === true) {\n      const rateLimit = require('koa2-ratelimit').RateLimit;\n\n      const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);\n\n      return rateLimit.middleware(loadConfig)(ctx, next);\n    }\n\n    return next();\n  };\n\nmodule.exports.buildPrefixKey = buildPrefixKey;\nmodule.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;\nmodule.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;\nmodule.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;\n"],"names":["path","require$$0","utils","require$$1","isString","has","toLower","require$$2","RateLimitError","errors","ROUTES_WITHOUT_IDENTIFIER","isOAuthCallbackPath","requestPath","includes","routeUsesEmailIdentifier","some","route","endsWith","normalizeRequestPathForRateLimit","normalized","posix","normalize","lower","replace","getEmailIdentifierForKey","body","email","buildPrefixKey","ctx","request","ip","userIdentifier","buildRateLimitLoadConfig","rateLimitConfig","routeMiddlewareConfig","interval","min","max","handler","prefixKey","rateLimitModule","exports","config","strapi","next","get","enabled","rateLimit","require$$3","RateLimit","loadConfig","middleware"],"mappings":";;;;;;;;;;AAEA,IAAA,MAAMA,IAAAA,GAAOC,YAAAA;AACb,IAAA,MAAMC,KAAAA,GAAQC,UAAAA;AACd,IAAA,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,OAAO,EAAE,GAAGC,UAAAA;AAEnC,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGN,MAAMO,MAAM;AAEvC;;;;;;;;;;;;;;;;;;;;;AAqBA,KACA,MAAMC,yBAAAA,GAA4B;AAAC,QAAA,aAAA;AAAe,QAAA,sBAAA;AAAwB,QAAA;AAAwB,KAAA;AAElG,IAAA,MAAMC,mBAAAA,GAAsB,CAACC,WAAAA,GAAgBA,WAAAA,CAAYC,QAAQ,CAAC,WAAA,CAAA;AAElE,IAAA,MAAMC,2BAA2B,CAACF,WAAAA,GAAAA;AAChC,QAAA,IAAID,oBAAoBC,WAAAA,CAAAA,EAAc;YACpC,OAAO,KAAA;AACX,QAAA;QAEE,OAAO,CAACF,0BAA0BK,IAAI,CAAC,CAACC,KAAAA,GAAUJ,WAAAA,CAAYK,QAAQ,CAACD,KAAAA,CAAAA,CAAAA;AACzE,IAAA,CAAA;AAEA;;;;KAKA,MAAME,mCAAmC,CAACN,WAAAA,GAAAA;AACxC,QAAA,MAAMO,UAAAA,GAAanB,IAAAA,CAAKoB,KAAK,CAACC,SAAS,CAACT,WAAAA,CAAAA;AACxC,QAAA,MAAMU,QAAQhB,OAAAA,CAAQa,UAAAA,CAAAA;AACtB,QAAA,OAAOG,KAAAA,CAAMC,OAAO,CAAC,MAAA,EAAQ,EAAA,CAAA,IAAO,GAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMC,2BAA2B,CAACC,IAAAA,GAAAA;QAChC,IAAI,CAACA,IAAAA,IAAQ,CAACrB,QAAAA,CAASqB,IAAAA,CAAKC,KAAK,CAAA,IAAKD,IAAAA,CAAKC,KAAK,KAAK,EAAA,EAAI;YACvD,OAAO,mBAAA;AACX,QAAA;QAEE,OAAOpB,OAAAA,CAAQmB,KAAKC,KAAK,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;QACtB,IAAIhB,WAAAA;AACJ,QAAA,IAAI,CAACR,QAAAA,CAASwB,GAAAA,CAAIC,OAAO,CAAC7B,IAAI,CAAA,EAAG;YAC/BY,WAAAA,GAAc,aAAA;QAClB,CAAA,MAAS;AACLA,YAAAA,WAAAA,GAAcM,gCAAAA,CAAiCU,GAAAA,CAAIC,OAAO,CAAC7B,IAAI,CAAA;YAC/D,IAAIY,WAAAA,KAAgB,GAAA,IAAOA,WAAAA,KAAgB,IAAA,EAAM;gBAC/CA,WAAAA,GAAc,aAAA;AACpB,YAAA;AACA,QAAA;QAEE,IAAI,CAACE,yBAAyBF,WAAAA,CAAAA,EAAc;YAC1C,OAAO,CAAC,aAAa,EAAEA,WAAAA,CAAY,CAAC,EAAEgB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC1D,QAAA;AAEE,QAAA,MAAMC,cAAAA,GAAiBP,wBAAAA,CAAyBI,GAAAA,CAAIC,OAAO,CAACJ,IAAI,CAAA;QAChE,OAAO,CAAA,EAAGM,cAAAA,CAAe,CAAC,EAAEnB,WAAAA,CAAY,CAAC,EAAEgB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC7D,IAAA,CAAA;IAEA,MAAME,wBAAAA,GAA2B,CAACJ,GAAAA,EAAKK,eAAAA,EAAiBC,qBAAAA,GAAAA;QACtD,OAAO;YACLC,QAAAA,EAAU;gBAAEC,GAAAA,EAAK;AAAC,aAAA;YAClBC,GAAAA,EAAK,CAAA;AACL,YAAA,GAAGJ,eAAe;AAClB,YAAA,GAAGC,qBAAqB;AACxBI,YAAAA,OAAAA,CAAAA,GAAAA;AACE,gBAAA,MAAM,IAAI9B,cAAAA,EAAAA;AAChB,YAAA,CAAA;AACI+B,YAAAA,SAAAA,EAAWZ,cAAAA,CAAeC,GAAAA;AAC9B,SAAA;AACA,IAAA,CAAA;IAEAY,SAAAA,CAAAC,OAAc,GACZ,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,OAAOf,GAAAA,EAAKgB,IAAAA,GAAAA;AACV,YAAA,IAAIX,eAAAA,GAAkBU,MAAAA,CAAOD,MAAM,CAACG,GAAG,CAAC,qCAAA,CAAA;AAExC,YAAA,IAAI,CAACZ,eAAAA,EAAiB;gBACpBA,eAAAA,GAAkB;oBAChBa,OAAAA,EAAS;AACjB,iBAAA;AACA,YAAA;YAEI,IAAI,CAACzC,GAAAA,CAAI,SAAA,EAAW4B,eAAAA,CAAAA,EAAkB;AACpCA,gBAAAA,eAAAA,CAAgBa,OAAO,GAAG,IAAA;AAChC,YAAA;YAEI,IAAIb,eAAAA,CAAgBa,OAAO,KAAK,IAAA,EAAM;gBACpC,MAAMC,SAAAA,GAAYC,WAA0BC,SAAS;gBAErD,MAAMC,UAAAA,GAAalB,wBAAAA,CAAyBJ,GAAAA,EAAKK,eAAAA,EAAiBS,MAAAA,CAAAA;AAElE,gBAAA,OAAOK,SAAAA,CAAUI,UAAU,CAACD,UAAAA,CAAAA,CAAYtB,GAAAA,EAAKgB,IAAAA,CAAAA;AACnD,YAAA;YAEI,OAAOA,IAAAA,EAAAA;AACX,QAAA,CAAA;IAEAJ,SAAAA,CAAAC,OAAA,CAAAd,cAA6B,GAAGA,cAAAA;IAChCa,SAAAA,CAAAC,OAAA,CAAA/B,yBAAwC,GAAGA,yBAAAA;IAC3C8B,SAAAA,CAAAC,OAAA,CAAAvB,gCAA+C,GAAGA,gCAAAA;IAClDsB,SAAAA,CAAAC,OAAA,CAAAT,wBAAuC,GAAGA,wBAAAA;;;;;;"}
+{"version":3,"file":"rateLimit.mjs","sources":["../../../server/src/middlewares/rateLimit.js"],"sourcesContent":["'use strict';\n\nconst path = require('path');\nconst utils = require('@strapi/utils');\nconst { toLower, isString, has } = require('lodash');\n\nconst { RateLimitError } = utils.errors;\n\n/**\n * Routes where the rate-limit key MUST NOT include a user identifier\n * derived from `ctx.request.body.email`.\n *\n * On these routes the request body either has no `email` field\n * (e.g. /auth/local uses `identifier`, /auth/reset-password uses\n * `code`, /auth/change-password uses `currentPassword`) or the\n * field is not part of the route contract. Including the\n * attacker-controlled `body.email` in the rate-limit key on these\n * routes lets a caller obtain a fresh key on every request by\n * varying that field, effectively bypassing per-IP throttling.\n *\n * Comparison uses endsWith so the check is stable under any router\n * mount prefix (e.g. `/api/auth/local`).\n *\n * @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw\n *\n * When adding a new `rateLimit`-protected auth route whose body does not\n * use `email` as the real identifier, add its path suffix here (or an\n * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split\n * with arbitrary `body.email` values.\n */\nconst ROUTES_WITHOUT_IDENTIFIER = ['/auth/local', '/auth/reset-password', '/auth/change-password'];\n\nconst isOAuthCallbackPath = (requestPath) => requestPath.includes('/connect/');\n\nconst routeUsesEmailIdentifier = (requestPath) => {\n  if (isOAuthCallbackPath(requestPath)) {\n    return false;\n  }\n\n  return !ROUTES_WITHOUT_IDENTIFIER.some((route) => requestPath.endsWith(route));\n};\n\n/**\n * Paths suitable for route matching and prefix keys: POSIX-normalized,\n * lower-cased, trailing slashes removed so `/api/auth/local` and\n * `/api/auth/local/` share one bucket.\n */\nconst normalizeRequestPathForRateLimit = (requestPath) => {\n  const normalized = path.posix.normalize(requestPath);\n  const lower = normalized.toLowerCase();\n  return lower.replace(/\\/+$/, '') || '/';\n};\n\nconst getEmailIdentifierForKey = (body) => {\n  if (!body || !isString(body.email) || body.email === '') {\n    return 'unknownIdentifier';\n  }\n\n  return toLower(body.email);\n};\n\nconst buildPrefixKey = (ctx) => {\n  let requestPath;\n  if (!isString(ctx.request.path)) {\n    requestPath = 'invalidPath';\n  } else {\n    requestPath = normalizeRequestPathForRateLimit(ctx.request.path);\n    if (requestPath === '.' || requestPath === '..') {\n      requestPath = 'invalidPath';\n    }\n  }\n\n  if (!routeUsesEmailIdentifier(requestPath)) {\n    return `noIdentifier:${requestPath}:${ctx.request.ip}`;\n  }\n\n  const userIdentifier = getEmailIdentifierForKey(ctx.request.body);\n  return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;\n};\n\nconst buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig) => {\n  return {\n    interval: { min: 5 },\n    max: 5,\n    ...rateLimitConfig,\n    ...routeMiddlewareConfig,\n    handler() {\n      throw new RateLimitError();\n    },\n    prefixKey: buildPrefixKey(ctx),\n  };\n};\n\nmodule.exports =\n  (config, { strapi }) =>\n  async (ctx, next) => {\n    let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');\n\n    if (!rateLimitConfig) {\n      rateLimitConfig = {\n        enabled: true,\n      };\n    }\n\n    if (!has(rateLimitConfig, 'enabled')) {\n      rateLimitConfig.enabled = true;\n    }\n\n    if (rateLimitConfig.enabled === true) {\n      const rateLimit = require('koa2-ratelimit').RateLimit;\n\n      const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);\n\n      return rateLimit.middleware(loadConfig)(ctx, next);\n    }\n\n    return next();\n  };\n\nmodule.exports.buildPrefixKey = buildPrefixKey;\nmodule.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;\nmodule.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;\nmodule.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;\n"],"names":["path","require$$0","utils","require$$1","toLower","isString","has","require$$2","RateLimitError","errors","ROUTES_WITHOUT_IDENTIFIER","isOAuthCallbackPath","requestPath","includes","routeUsesEmailIdentifier","some","route","endsWith","normalizeRequestPathForRateLimit","normalized","posix","normalize","lower","toLowerCase","replace","getEmailIdentifierForKey","body","email","buildPrefixKey","ctx","request","ip","userIdentifier","buildRateLimitLoadConfig","rateLimitConfig","routeMiddlewareConfig","interval","min","max","handler","prefixKey","rateLimitModule","exports","config","strapi","next","get","enabled","rateLimit","require$$3","RateLimit","loadConfig","middleware"],"mappings":";;;;;;;;;;AAEA,IAAA,MAAMA,IAAAA,GAAOC,YAAAA;AACb,IAAA,MAAMC,KAAAA,GAAQC,UAAAA;AACd,IAAA,MAAM,EAAEC,OAAO,EAAEC,QAAQ,EAAEC,GAAG,EAAE,GAAGC,UAAAA;AAEnC,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGN,MAAMO,MAAM;AAEvC;;;;;;;;;;;;;;;;;;;;;AAqBA,KACA,MAAMC,yBAAAA,GAA4B;AAAC,QAAA,aAAA;AAAe,QAAA,sBAAA;AAAwB,QAAA;AAAwB,KAAA;AAElG,IAAA,MAAMC,mBAAAA,GAAsB,CAACC,WAAAA,GAAgBA,WAAAA,CAAYC,QAAQ,CAAC,WAAA,CAAA;AAElE,IAAA,MAAMC,2BAA2B,CAACF,WAAAA,GAAAA;AAChC,QAAA,IAAID,oBAAoBC,WAAAA,CAAAA,EAAc;YACpC,OAAO,KAAA;AACX,QAAA;QAEE,OAAO,CAACF,0BAA0BK,IAAI,CAAC,CAACC,KAAAA,GAAUJ,WAAAA,CAAYK,QAAQ,CAACD,KAAAA,CAAAA,CAAAA;AACzE,IAAA,CAAA;AAEA;;;;KAKA,MAAME,mCAAmC,CAACN,WAAAA,GAAAA;AACxC,QAAA,MAAMO,UAAAA,GAAanB,IAAAA,CAAKoB,KAAK,CAACC,SAAS,CAACT,WAAAA,CAAAA;QACxC,MAAMU,KAAAA,GAAQH,WAAWI,WAAW,EAAA;AACpC,QAAA,OAAOD,KAAAA,CAAME,OAAO,CAAC,MAAA,EAAQ,EAAA,CAAA,IAAO,GAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMC,2BAA2B,CAACC,IAAAA,GAAAA;QAChC,IAAI,CAACA,IAAAA,IAAQ,CAACrB,QAAAA,CAASqB,IAAAA,CAAKC,KAAK,CAAA,IAAKD,IAAAA,CAAKC,KAAK,KAAK,EAAA,EAAI;YACvD,OAAO,mBAAA;AACX,QAAA;QAEE,OAAOvB,OAAAA,CAAQsB,KAAKC,KAAK,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;QACtB,IAAIjB,WAAAA;AACJ,QAAA,IAAI,CAACP,QAAAA,CAASwB,GAAAA,CAAIC,OAAO,CAAC9B,IAAI,CAAA,EAAG;YAC/BY,WAAAA,GAAc,aAAA;QAClB,CAAA,MAAS;AACLA,YAAAA,WAAAA,GAAcM,gCAAAA,CAAiCW,GAAAA,CAAIC,OAAO,CAAC9B,IAAI,CAAA;YAC/D,IAAIY,WAAAA,KAAgB,GAAA,IAAOA,WAAAA,KAAgB,IAAA,EAAM;gBAC/CA,WAAAA,GAAc,aAAA;AACpB,YAAA;AACA,QAAA;QAEE,IAAI,CAACE,yBAAyBF,WAAAA,CAAAA,EAAc;YAC1C,OAAO,CAAC,aAAa,EAAEA,WAAAA,CAAY,CAAC,EAAEiB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC1D,QAAA;AAEE,QAAA,MAAMC,cAAAA,GAAiBP,wBAAAA,CAAyBI,GAAAA,CAAIC,OAAO,CAACJ,IAAI,CAAA;QAChE,OAAO,CAAA,EAAGM,cAAAA,CAAe,CAAC,EAAEpB,WAAAA,CAAY,CAAC,EAAEiB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC7D,IAAA,CAAA;IAEA,MAAME,wBAAAA,GAA2B,CAACJ,GAAAA,EAAKK,eAAAA,EAAiBC,qBAAAA,GAAAA;QACtD,OAAO;YACLC,QAAAA,EAAU;gBAAEC,GAAAA,EAAK;AAAC,aAAA;YAClBC,GAAAA,EAAK,CAAA;AACL,YAAA,GAAGJ,eAAe;AAClB,YAAA,GAAGC,qBAAqB;AACxBI,YAAAA,OAAAA,CAAAA,GAAAA;AACE,gBAAA,MAAM,IAAI/B,cAAAA,EAAAA;AAChB,YAAA,CAAA;AACIgC,YAAAA,SAAAA,EAAWZ,cAAAA,CAAeC,GAAAA;AAC9B,SAAA;AACA,IAAA,CAAA;IAEAY,SAAAA,CAAAC,OAAc,GACZ,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,OAAOf,GAAAA,EAAKgB,IAAAA,GAAAA;AACV,YAAA,IAAIX,eAAAA,GAAkBU,MAAAA,CAAOD,MAAM,CAACG,GAAG,CAAC,qCAAA,CAAA;AAExC,YAAA,IAAI,CAACZ,eAAAA,EAAiB;gBACpBA,eAAAA,GAAkB;oBAChBa,OAAAA,EAAS;AACjB,iBAAA;AACA,YAAA;YAEI,IAAI,CAACzC,GAAAA,CAAI4B,eAAAA,EAAiB,SAAA,CAAA,EAAY;AACpCA,gBAAAA,eAAAA,CAAgBa,OAAO,GAAG,IAAA;AAChC,YAAA;YAEI,IAAIb,eAAAA,CAAgBa,OAAO,KAAK,IAAA,EAAM;gBACpC,MAAMC,SAAAA,GAAYC,WAA0BC,SAAS;gBAErD,MAAMC,UAAAA,GAAalB,wBAAAA,CAAyBJ,GAAAA,EAAKK,eAAAA,EAAiBS,MAAAA,CAAAA;AAElE,gBAAA,OAAOK,SAAAA,CAAUI,UAAU,CAACD,UAAAA,CAAAA,CAAYtB,GAAAA,EAAKgB,IAAAA,CAAAA;AACnD,YAAA;YAEI,OAAOA,IAAAA,EAAAA;AACX,QAAA,CAAA;IAEAJ,SAAAA,CAAAC,OAAA,CAAAd,cAA6B,GAAGA,cAAAA;IAChCa,SAAAA,CAAAC,OAAA,CAAAhC,yBAAwC,GAAGA,yBAAAA;IAC3C+B,SAAAA,CAAAC,OAAA,CAAAxB,gCAA+C,GAAGA,gCAAAA;IAClDuB,SAAAA,CAAAC,OAAA,CAAAT,wBAAuC,GAAGA,wBAAAA;;;;;;"}

package/dist/server/services/providers-registry.js

@@ -1,7 +1,7 @@
 'use strict';
 
 var require$$0 = require('assert');
-var require$$2 = require('url-join');
+var require$$1 = require('url-join');
 var verifyJwtWithJwks = require('../utils/verify-jwt-with-jwks.js');
 var providerHttp = require('../utils/provider-http.js');
 var oauth1 = require('../utils/oauth-connect/oauth1.js');
@@ -9,7 +9,7 @@ var oauth1 = require('../utils/oauth-connect/oauth1.js');
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var require$$0__default = /*#__PURE__*/_interopDefault(require$$0);
-var require$$2__default = /*#__PURE__*/_interopDefault(require$$2);
+var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
 
 var providersRegistry;
 var hasRequiredProvidersRegistry;
@@ -17,7 +17,7 @@ function requireProvidersRegistry() {
     if (hasRequiredProvidersRegistry) return providersRegistry;
     hasRequiredProvidersRegistry = 1;
     const { strict: assert } = require$$0__default.default;
-    const urljoin = require$$2__default.default;
+    const urljoin = require$$1__default.default;
     const { verifyJwtWithJwks: verifyJwtWithJwks$1 } = verifyJwtWithJwks.__require();
     const { bearerGet, fetchJson } = providerHttp.__require();
     const initProviders = ({ baseURL })=>({

package/dist/server/services/providers-registry.mjs

@@ -1,5 +1,5 @@
 import require$$0 from 'assert';
-import require$$2 from 'url-join';
+import require$$1 from 'url-join';
 import { __require as requireVerifyJwtWithJwks } from '../utils/verify-jwt-with-jwks.mjs';
 import { __require as requireProviderHttp } from '../utils/provider-http.mjs';
 import { __require as requireOauth1 } from '../utils/oauth-connect/oauth1.mjs';
@@ -10,7 +10,7 @@ function requireProvidersRegistry() {
     if (hasRequiredProvidersRegistry) return providersRegistry;
     hasRequiredProvidersRegistry = 1;
     const { strict: assert } = require$$0;
-    const urljoin = require$$2;
+    const urljoin = require$$1;
     const { verifyJwtWithJwks } = requireVerifyJwtWithJwks();
     const { bearerGet, fetchJson } = requireProviderHttp();
     const initProviders = ({ baseURL })=>({

package/dist/server/services/providers.js

@@ -1,13 +1,13 @@
 'use strict';
 
 var require$$0 = require('lodash');
-var require$$2 = require('url-join');
+var require$$1 = require('url-join');
 var index = require('../utils/index.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var require$$0__default = /*#__PURE__*/_interopDefault(require$$0);
-var require$$2__default = /*#__PURE__*/_interopDefault(require$$2);
+var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
 
 var providers;
 var hasRequiredProviders;
@@ -18,7 +18,7 @@ function requireProviders() {
 	 * Module dependencies
 	 */ // Public node modules.
     const _ = require$$0__default.default;
-    const urlJoin = require$$2__default.default;
+    const urlJoin = require$$1__default.default;
     const { getService, findValidUsername } = index.__require();
     providers = ({ strapi })=>{
         /**

package/dist/server/services/providers.mjs

@@ -1,5 +1,5 @@
 import require$$0 from 'lodash';
-import require$$2 from 'url-join';
+import require$$1 from 'url-join';
 import { __require as requireUtils } from '../utils/index.mjs';
 
 var providers;
@@ -11,7 +11,7 @@ function requireProviders() {
 	 * Module dependencies
 	 */ // Public node modules.
     const _ = require$$0;
-    const urlJoin = require$$2;
+    const urlJoin = require$$1;
     const { getService, findValidUsername } = requireUtils();
     providers = ({ strapi })=>{
         /**

package/dist/server/services/user.js

@@ -1,17 +1,17 @@
 'use strict';
 
 var require$$0$1 = require('crypto');
-var require$$1$1 = require('bcryptjs');
-var require$$2 = require('url-join');
+var require$$1$2 = require('bcryptjs');
+var require$$1$1 = require('url-join');
 var require$$1 = require('@strapi/utils');
-var require$$0 = require('lodash/fp');
+var require$$0 = require('lodash');
 var index = require('../utils/index.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var require$$0__default$1 = /*#__PURE__*/_interopDefault(require$$0$1);
+var require$$1__default$2 = /*#__PURE__*/_interopDefault(require$$1$2);
 var require$$1__default$1 = /*#__PURE__*/_interopDefault(require$$1$1);
-var require$$2__default = /*#__PURE__*/_interopDefault(require$$2);
 var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
 var require$$0__default = /*#__PURE__*/_interopDefault(require$$0);
 
@@ -25,13 +25,13 @@ function requireUser() {
 	 *
 	 * @description: A set of functions similar to controller's actions to avoid code duplication.
 	 */ const crypto = require$$0__default$1.default;
-    const bcrypt = require$$1__default$1.default;
-    const urlJoin = require$$2__default.default;
+    const bcrypt = require$$1__default$2.default;
+    const urlJoin = require$$1__default$1.default;
     const { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require$$1__default.default;
-    const { toNumber, getOr, pick } = require$$0__default.default;
+    const { pick, get, toNumber } = require$$0__default.default;
     const { getService } = index.__require();
     const USER_MODEL_UID = 'plugin::users-permissions.user';
-    const pickAllowedQueryParams = pick(ALLOWED_QUERY_PARAM_KEYS);
+    const pickAllowedQueryParams = (params)=>pick(params, ALLOWED_QUERY_PARAM_KEYS);
     const getSessionManager = ()=>{
         const manager = strapi.sessionManager;
         return manager ?? null;
@@ -57,7 +57,7 @@ function requireUser() {
                 for(const key in values){
                     if (attributes[key] && attributes[key].type === 'password') {
                         // Check if a custom encryption.rounds has been set on the password attribute
-                        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));
+                        const rounds = toNumber(get(attributes[key], 'encryption.rounds', 10));
                         values[key] = await bcrypt.hash(values[key], rounds);
                     }
                 }

package/dist/server/services/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sources":["../../../server/src/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require('@strapi/utils');\nconst { toNumber, getOr, pick } = require('lodash/fp');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst pickAllowedQueryParams = pick(ALLOWED_QUERY_PARAM_KEYS);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).count(query);\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","ALLOWED_QUERY_PARAM_KEYS","require$$3","toNumber","getOr","pick","require$$4","getService","require$$5","USER_MODEL_UID","pickAllowedQueryParams","getSessionManager","manager","strapi","sessionManager","user","count","params","query","get","transform","db","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","where","id","select","update","documentId","fetch","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,2BAAAA;AAEhB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,wBAAwB,EAAE,GAAGC,2BAAAA;AAC/C,IAAA,MAAM,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,2BAAAA;IAClC,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,yBAAyBL,IAAAA,CAAKJ,wBAAAA,CAAAA;AAEpC,IAAA,MAAMU,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMC,MAAM,EAAA;gBACV,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgBO,KAAK,CAACE,KAAAA,CAAAA;AACjD,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMI,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaX,OAAAA,CAAOY,QAAQ,CAAChB,gBAAgBe,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAASzB,QAAAA,CAASC,KAAAA,CAAM,IAAI,mBAAA,EAAqBoB,UAAU,CAACE,GAAAA,CAAI,CAAA,CAAA;wBACtEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM9B,MAAAA,CAAOiC,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOV,OAAAA,CAAOkB,SAAS,CAACtB,cAAAA,CAAAA,CAAgBuB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAEnB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMoB,KAAAA,GAAQ,MAAMxB,OAAAA,CAAOQ,EAAA,CACxBH,KAAK,CAACT,cAAAA,CAAAA,CACN6B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEC,EAAAA,EAAIJ;AAAM,qBAAA;oBAAIK,MAAAA,EAAQ;AAAC,wBAAA;AAAa;;AAE1D,gBAAA,IAAI,CAACJ,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOxB,OAAAA,CAAOkB,SAAS,CAACtB,cAAAA,CAAAA,CAAgBiC,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYN,MAAMM,UAAU;oBAC5BV,IAAAA,EAAMhB,MAAAA;oBACNiB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIEU,KAAAA,CAAAA,CAAMJ,EAAE,EAAEvB,MAAM,EAAA;gBACd,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB6B,OAAO,CAAC;AAC7C,oBAAA,GAAGpB,KAAK;oBACRqB,KAAAA,EAAO;wBACLM,IAAAA,EAAM;AAAC,4BAAA;AAAEL,gCAAAA;AAAE,6BAAA;4BAAItB,KAAAA,CAAMqB,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACEO,wBAAuBN,EAAE,EAAA;AACvB,gBAAA,OAAO3B,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB6B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEC,wBAAAA;AAAE,qBAAA;oBAAIN,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEa,UAAS9B,MAAM,EAAA;gBACb,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgBuC,QAAQ,CAAC9B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM+B,QAAOhC,MAAM,EAAA;;AAEjB,gBAAA,MAAMH,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAeoC,SAAS,CAAC,mBAAA,CAAA,IAAwBjC,MAAAA,CAAOuB,EAAE,EAAE;AAChF,oBAAA,MAAM1B,eAAe,mBAAA,CAAA,CAAqBqC,sBAAsB,CAACC,MAAAA,CAAOnC,OAAOuB,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAO3B,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB4C,MAAM,CAAC;oBAAEd,KAAAA,EAAOtB;;AAC3D,YAAA,CAAA;YAEEqC,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE1B,IAAI,EAAA;gBAC7B,OAAOjC,MAAAA,CAAO4D,OAAO,CAACD,QAAAA,EAAU1B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM4B,uBAAsB1C,IAAI,EAAA;AAC9B,gBAAA,MAAM2C,wBAAwBnD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMoD,WAAAA,GAAc,MAAM9C,OAAAA,CAAO+C,KAAK,CAAC;oBAAEjC,IAAAA,EAAM,QAAA;oBAAUkC,IAAAA,EAAM;;gBAC/D,MAAMC,UAAAA,GAAajD,OAAAA,CAAOY,QAAQ,CAAChB,cAAAA,CAAAA;AAEnC,gBAAA,MAAMsD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBxC,GAAG,CAAC;oBAAEO,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAClBsC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMpE,QAAAA,CAASqE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRrC,oBAAAA,QAAAA,EAAUZ,OAAAA,CAAOY,QAAQ,CAAC+C,IAAI,CAAC3D,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAM0D,oBAAoB/E,MAAAA,CAAOgF,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACxC,IAAI,CAACpB,IAAAA,CAAKyB,EAAE,EAAE;AAAEiC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY/D,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACF4C,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAKlF,QACHe,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,uBAClByD,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYpE,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,oBAAA,CAAA;AAC9B+D,wBAAAA,SAAAA,EAAWrE,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,mBAAA,CAAA;wBAC7BgE,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNvD,OAAAA,CAAOyE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAM1E,OAAAA,CACH2E,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI5E,KAAK6E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAA,GACjC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAA,GAC/CE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}
+{"version":3,"file":"user.js","sources":["../../../server/src/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require('@strapi/utils');\nconst { pick, get, toNumber } = require('lodash');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst pickAllowedQueryParams = (params) => pick(params, ALLOWED_QUERY_PARAM_KEYS);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).count(query);\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(get(attributes[key], 'encryption.rounds', 10));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","ALLOWED_QUERY_PARAM_KEYS","require$$3","pick","get","toNumber","require$$4","getService","require$$5","USER_MODEL_UID","pickAllowedQueryParams","params","getSessionManager","manager","strapi","sessionManager","user","count","query","transform","db","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","where","id","select","update","documentId","fetch","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,6BAAAA;AAEhB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,wBAAwB,EAAE,GAAGC,2BAAAA;AAC/C,IAAA,MAAM,EAAEC,IAAI,EAAEC,GAAG,EAAEC,QAAQ,EAAE,GAAGC,2BAAAA;IAChC,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,sBAAAA,GAAyB,CAACC,MAAAA,GAAWR,IAAAA,CAAKQ,MAAAA,EAAQV,wBAAAA,CAAAA;AAExD,IAAA,MAAMW,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMN,MAAM,EAAA;gBACV,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgBQ,KAAK,CAACC,KAAAA,CAAAA;AACjD,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMG,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaT,OAAAA,CAAOU,QAAQ,CAACf,gBAAgBc,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAAStB,QAAAA,CAASD,GAAAA,CAAImB,UAAU,CAACE,GAAAA,CAAI,EAAE,mBAAA,EAAqB,EAAA,CAAA,CAAA;wBAClEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM7B,MAAAA,CAAOgC,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOR,OAAAA,CAAOgB,SAAS,CAACrB,cAAAA,CAAAA,CAAgBsB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAExB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMyB,KAAAA,GAAQ,MAAMtB,OAAAA,CAAOM,EAAA,CACxBF,KAAK,CAACT,cAAAA,CAAAA,CACN4B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEC,EAAAA,EAAIJ;AAAM,qBAAA;oBAAIK,MAAAA,EAAQ;AAAC,wBAAA;AAAa;;AAE1D,gBAAA,IAAI,CAACJ,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOtB,OAAAA,CAAOgB,SAAS,CAACrB,cAAAA,CAAAA,CAAgBgC,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYN,MAAMM,UAAU;oBAC5BV,IAAAA,EAAMrB,MAAAA;oBACNsB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIEU,KAAAA,CAAAA,CAAMJ,EAAE,EAAE5B,MAAM,EAAA;gBACd,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB4B,OAAO,CAAC;AAC7C,oBAAA,GAAGnB,KAAK;oBACRoB,KAAAA,EAAO;wBACLM,IAAAA,EAAM;AAAC,4BAAA;AAAEL,gCAAAA;AAAE,6BAAA;4BAAIrB,KAAAA,CAAMoB,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACEO,wBAAuBN,EAAE,EAAA;AACvB,gBAAA,OAAOzB,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB4B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEC,wBAAAA;AAAE,qBAAA;oBAAIN,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEa,UAASnC,MAAM,EAAA;gBACb,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgBsC,QAAQ,CAAC7B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM8B,QAAOrC,MAAM,EAAA;;AAEjB,gBAAA,MAAMI,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAekC,SAAS,CAAC,mBAAA,CAAA,IAAwBtC,MAAAA,CAAO4B,EAAE,EAAE;AAChF,oBAAA,MAAMxB,eAAe,mBAAA,CAAA,CAAqBmC,sBAAsB,CAACC,MAAAA,CAAOxC,OAAO4B,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAOzB,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB2C,MAAM,CAAC;oBAAEd,KAAAA,EAAO3B;;AAC3D,YAAA,CAAA;YAEE0C,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE1B,IAAI,EAAA;gBAC7B,OAAOhC,MAAAA,CAAO2D,OAAO,CAACD,QAAAA,EAAU1B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM4B,uBAAsBxC,IAAI,EAAA;AAC9B,gBAAA,MAAMyC,wBAAwBlD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMmD,WAAAA,GAAc,MAAM5C,OAAAA,CAAO6C,KAAK,CAAC;oBAAEjC,IAAAA,EAAM,QAAA;oBAAUkC,IAAAA,EAAM;;gBAC/D,MAAMC,UAAAA,GAAa/C,OAAAA,CAAOU,QAAQ,CAACf,cAAAA,CAAAA;AAEnC,gBAAA,MAAMqD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBtD,GAAG,CAAC;oBAAEqB,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAClBsC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMnE,QAAAA,CAASoE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRrC,oBAAAA,QAAAA,EAAUV,OAAAA,CAAOU,QAAQ,CAAC+C,IAAI,CAACzD,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAMwD,oBAAoB9E,MAAAA,CAAO+E,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACxC,IAAI,CAAClB,IAAAA,CAAKuB,EAAE,EAAE;AAAEiC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY7D,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACF0D,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAKjF,QACHgB,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,uBAClBuE,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYlE,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,oBAAA,CAAA;AAC9B6E,wBAAAA,SAAAA,EAAWnE,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,mBAAA,CAAA;wBAC7B8E,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNrD,OAAAA,CAAOuE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAMxE,OAAAA,CACHyE,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI1E,KAAK2E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAA,GACjC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAA,GAC/CE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}

package/dist/server/services/user.mjs

@@ -1,8 +1,8 @@
 import require$$0$1 from 'crypto';
-import require$$1$1 from 'bcryptjs';
-import require$$2 from 'url-join';
+import require$$1$2 from 'bcryptjs';
+import require$$1$1 from 'url-join';
 import require$$1 from '@strapi/utils';
-import require$$0 from 'lodash/fp';
+import require$$0 from 'lodash';
 import { __require as requireUtils } from '../utils/index.mjs';
 
 var user;
@@ -15,13 +15,13 @@ function requireUser() {
 	 *
 	 * @description: A set of functions similar to controller's actions to avoid code duplication.
 	 */ const crypto = require$$0$1;
-    const bcrypt = require$$1$1;
-    const urlJoin = require$$2;
+    const bcrypt = require$$1$2;
+    const urlJoin = require$$1$1;
     const { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require$$1;
-    const { toNumber, getOr, pick } = require$$0;
+    const { pick, get, toNumber } = require$$0;
     const { getService } = requireUtils();
     const USER_MODEL_UID = 'plugin::users-permissions.user';
-    const pickAllowedQueryParams = pick(ALLOWED_QUERY_PARAM_KEYS);
+    const pickAllowedQueryParams = (params)=>pick(params, ALLOWED_QUERY_PARAM_KEYS);
     const getSessionManager = ()=>{
         const manager = strapi.sessionManager;
         return manager ?? null;
@@ -47,7 +47,7 @@ function requireUser() {
                 for(const key in values){
                     if (attributes[key] && attributes[key].type === 'password') {
                         // Check if a custom encryption.rounds has been set on the password attribute
-                        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));
+                        const rounds = toNumber(get(attributes[key], 'encryption.rounds', 10));
                         values[key] = await bcrypt.hash(values[key], rounds);
                     }
                 }

package/dist/server/services/user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"user.mjs","sources":["../../../server/src/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require('@strapi/utils');\nconst { toNumber, getOr, pick } = require('lodash/fp');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst pickAllowedQueryParams = pick(ALLOWED_QUERY_PARAM_KEYS);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).count(query);\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","ALLOWED_QUERY_PARAM_KEYS","require$$3","toNumber","getOr","pick","require$$4","getService","require$$5","USER_MODEL_UID","pickAllowedQueryParams","getSessionManager","manager","strapi","sessionManager","user","count","params","query","get","transform","db","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","where","id","select","update","documentId","fetch","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,UAAAA;AAEhB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,wBAAwB,EAAE,GAAGC,UAAAA;AAC/C,IAAA,MAAM,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,IAAI,EAAE,GAAGC,UAAAA;IAClC,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,yBAAyBL,IAAAA,CAAKJ,wBAAAA,CAAAA;AAEpC,IAAA,MAAMU,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMC,MAAM,EAAA;gBACV,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgBO,KAAK,CAACE,KAAAA,CAAAA;AACjD,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMI,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaX,OAAAA,CAAOY,QAAQ,CAAChB,gBAAgBe,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAASzB,QAAAA,CAASC,KAAAA,CAAM,IAAI,mBAAA,EAAqBoB,UAAU,CAACE,GAAAA,CAAI,CAAA,CAAA;wBACtEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM9B,MAAAA,CAAOiC,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOV,OAAAA,CAAOkB,SAAS,CAACtB,cAAAA,CAAAA,CAAgBuB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAEnB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMoB,KAAAA,GAAQ,MAAMxB,OAAAA,CAAOQ,EAAA,CACxBH,KAAK,CAACT,cAAAA,CAAAA,CACN6B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEC,EAAAA,EAAIJ;AAAM,qBAAA;oBAAIK,MAAAA,EAAQ;AAAC,wBAAA;AAAa;;AAE1D,gBAAA,IAAI,CAACJ,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOxB,OAAAA,CAAOkB,SAAS,CAACtB,cAAAA,CAAAA,CAAgBiC,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYN,MAAMM,UAAU;oBAC5BV,IAAAA,EAAMhB,MAAAA;oBACNiB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIEU,KAAAA,CAAAA,CAAMJ,EAAE,EAAEvB,MAAM,EAAA;gBACd,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB6B,OAAO,CAAC;AAC7C,oBAAA,GAAGpB,KAAK;oBACRqB,KAAAA,EAAO;wBACLM,IAAAA,EAAM;AAAC,4BAAA;AAAEL,gCAAAA;AAAE,6BAAA;4BAAItB,KAAAA,CAAMqB,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACEO,wBAAuBN,EAAE,EAAA;AACvB,gBAAA,OAAO3B,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB6B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEC,wBAAAA;AAAE,qBAAA;oBAAIN,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEa,UAAS9B,MAAM,EAAA;gBACb,MAAMC,KAAAA,GAAQL,OAAAA,CACXM,GAAG,CAAC,cAAA,CAAA,CACJC,SAAS,CAACX,cAAAA,EAAgBC,sBAAAA,CAAuBO,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOJ,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgBuC,QAAQ,CAAC9B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM+B,QAAOhC,MAAM,EAAA;;AAEjB,gBAAA,MAAMH,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAeoC,SAAS,CAAC,mBAAA,CAAA,IAAwBjC,MAAAA,CAAOuB,EAAE,EAAE;AAChF,oBAAA,MAAM1B,eAAe,mBAAA,CAAA,CAAqBqC,sBAAsB,CAACC,MAAAA,CAAOnC,OAAOuB,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAO3B,QAAOQ,EAAE,CAACH,KAAK,CAACT,cAAAA,CAAAA,CAAgB4C,MAAM,CAAC;oBAAEd,KAAAA,EAAOtB;;AAC3D,YAAA,CAAA;YAEEqC,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE1B,IAAI,EAAA;gBAC7B,OAAOjC,MAAAA,CAAO4D,OAAO,CAACD,QAAAA,EAAU1B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM4B,uBAAsB1C,IAAI,EAAA;AAC9B,gBAAA,MAAM2C,wBAAwBnD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMoD,WAAAA,GAAc,MAAM9C,OAAAA,CAAO+C,KAAK,CAAC;oBAAEjC,IAAAA,EAAM,QAAA;oBAAUkC,IAAAA,EAAM;;gBAC/D,MAAMC,UAAAA,GAAajD,OAAAA,CAAOY,QAAQ,CAAChB,cAAAA,CAAAA;AAEnC,gBAAA,MAAMsD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBxC,GAAG,CAAC;oBAAEO,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAClBsC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMpE,QAAAA,CAASqE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRrC,oBAAAA,QAAAA,EAAUZ,OAAAA,CAAOY,QAAQ,CAAC+C,IAAI,CAAC3D,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAM0D,oBAAoB/E,MAAAA,CAAOgF,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACxC,IAAI,CAACpB,IAAAA,CAAKyB,EAAE,EAAE;AAAEiC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY/D,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACF4C,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAKlF,QACHe,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,uBAClByD,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYpE,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,oBAAA,CAAA;AAC9B+D,wBAAAA,SAAAA,EAAWrE,OAAAA,CAAOgE,MAAM,CAAC1D,GAAG,CAAC,mBAAA,CAAA;wBAC7BgE,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNvD,OAAAA,CAAOyE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAM1E,OAAAA,CACH2E,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI5E,KAAK6E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAA,GACjC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAA,GAC/CE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}
+{"version":3,"file":"user.mjs","sources":["../../../server/src/services/user.js"],"sourcesContent":["'use strict';\n\n/**\n * User.js service\n *\n * @description: A set of functions similar to controller's actions to avoid code duplication.\n */\n\nconst crypto = require('crypto');\nconst bcrypt = require('bcryptjs');\nconst urlJoin = require('url-join');\n\nconst { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require('@strapi/utils');\nconst { pick, get, toNumber } = require('lodash');\nconst { getService } = require('../utils');\n\nconst USER_MODEL_UID = 'plugin::users-permissions.user';\n\nconst pickAllowedQueryParams = (params) => pick(params, ALLOWED_QUERY_PARAM_KEYS);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\nmodule.exports = ({ strapi }) => ({\n  /**\n   * Promise to count users\n   *\n   * @return {Promise}\n   */\n\n  count(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).count(query);\n  },\n\n  /**\n   * Hashes password fields in the provided values object if they are present.\n   * It checks each key in the values object against the model's attributes and\n   * hashes it if the attribute type is 'password',\n   *\n   * @param {object} values - The object containing the fields to be hashed.\n   * @return {object} The values object with hashed password fields if they were present.\n   */\n  async ensureHashedPasswords(values) {\n    const attributes = strapi.getModel(USER_MODEL_UID).attributes;\n\n    for (const key in values) {\n      if (attributes[key] && attributes[key].type === 'password') {\n        // Check if a custom encryption.rounds has been set on the password attribute\n        const rounds = toNumber(get(attributes[key], 'encryption.rounds', 10));\n        values[key] = await bcrypt.hash(values[key], rounds);\n      }\n    }\n\n    return values;\n  },\n\n  /**\n   * Promise to add a/an user.\n   * @return {Promise}\n   */\n  async add(values) {\n    // Use the Document Service so relation inputs accept both the internal\n    // numeric id (legacy) and the documentId (v5 default) syntax, consistent\n    // with every other content-type endpoint. The Document Service hashes\n    // `password` attributes itself, so we must not pre-hash here.\n    return strapi.documents(USER_MODEL_UID).create({\n      data: values,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to edit a/an user.\n   * @param {string} userId\n   * @param {object} params\n   * @return {Promise}\n   */\n  async edit(userId, params = {}) {\n    // The user is addressed by its numeric id (e.g. the `/users/:id` route),\n    // but the Document Service updates by documentId. Resolve it first so the\n    // relation inputs are processed by the Document Service, which accepts both\n    // numeric ids (legacy) and documentIds (v5 default). The Document Service\n    // hashes `password` attributes itself, so we must not pre-hash here.\n    const entry = await strapi.db\n      .query(USER_MODEL_UID)\n      .findOne({ where: { id: userId }, select: ['documentId'] });\n\n    if (!entry) {\n      return null;\n    }\n\n    return strapi.documents(USER_MODEL_UID).update({\n      documentId: entry.documentId,\n      data: params,\n      populate: ['role'],\n    });\n  },\n\n  /**\n   * Promise to fetch a/an user.\n   * @return {Promise}\n   */\n  fetch(id, params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findOne({\n      ...query,\n      where: {\n        $and: [{ id }, query.where || {}],\n      },\n    });\n  },\n\n  /**\n   * Promise to fetch authenticated user.\n   * @return {Promise}\n   */\n  fetchAuthenticatedUser(id) {\n    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });\n  },\n\n  /**\n   * Promise to fetch all users.\n   * @return {Promise}\n   */\n  fetchAll(params) {\n    const query = strapi\n      .get('query-params')\n      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));\n\n    return strapi.db.query(USER_MODEL_UID).findMany(query);\n  },\n\n  /**\n   * Promise to remove a/an user.\n   * @return {Promise}\n   */\n  async remove(params) {\n    // Invalidate sessions for all affected users\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {\n      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));\n    }\n\n    return strapi.db.query(USER_MODEL_UID).delete({ where: params });\n  },\n\n  validatePassword(password, hash) {\n    return bcrypt.compare(password, hash);\n  },\n\n  async sendConfirmationEmail(user) {\n    const userPermissionService = getService('users-permissions');\n    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n    const userSchema = strapi.getModel(USER_MODEL_UID);\n\n    const settings = await pluginStore\n      .get({ key: 'email' })\n      .then((storeEmail) => storeEmail.email_confirmation.options);\n\n    // Sanitize the template's user information\n    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(\n      {\n        schema: userSchema,\n        getModel: strapi.getModel.bind(strapi),\n      },\n      user\n    );\n\n    const confirmationToken = crypto.randomBytes(20).toString('hex');\n\n    await this.edit(user.id, { confirmationToken });\n\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n\n    try {\n      settings.message = await userPermissionService.template(settings.message, {\n        URL: urlJoin(\n          strapi.config.get('server.absoluteUrl'),\n          apiPrefix,\n          '/auth/email-confirmation'\n        ),\n        SERVER_URL: strapi.config.get('server.absoluteUrl'),\n        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n        USER: sanitizedUserInfo,\n        CODE: confirmationToken,\n      });\n\n      settings.object = await userPermissionService.template(settings.object, {\n        USER: sanitizedUserInfo,\n      });\n    } catch {\n      strapi.log.error(\n        '[plugin::users-permissions.sendConfirmationEmail]: Failed to generate a template for \"user confirmation email\". Please make sure your email template is valid and does not contain invalid characters or patterns'\n      );\n      return;\n    }\n\n    // Send an email to the user.\n    await strapi\n      .plugin('email')\n      .service('email')\n      .send({\n        to: user.email,\n        from:\n          settings.from.email && settings.from.name\n            ? `${settings.from.name} <${settings.from.email}>`\n            : undefined,\n        replyTo: settings.response_email,\n        subject: settings.object,\n        text: settings.message,\n        html: settings.message,\n      });\n  },\n});\n"],"names":["crypto","require$$0","bcrypt","require$$1","urlJoin","require$$2","sanitize","ALLOWED_QUERY_PARAM_KEYS","require$$3","pick","get","toNumber","require$$4","getService","require$$5","USER_MODEL_UID","pickAllowedQueryParams","params","getSessionManager","manager","strapi","sessionManager","user","count","query","transform","db","ensureHashedPasswords","values","attributes","getModel","key","type","rounds","hash","add","documents","create","data","populate","edit","userId","entry","findOne","where","id","select","update","documentId","fetch","$and","fetchAuthenticatedUser","fetchAll","findMany","remove","hasOrigin","invalidateRefreshToken","String","delete","validatePassword","password","compare","sendConfirmationEmail","userPermissionService","pluginStore","store","name","userSchema","settings","then","storeEmail","email_confirmation","options","sanitizedUserInfo","sanitizers","defaultSanitizeOutput","schema","bind","confirmationToken","randomBytes","toString","apiPrefix","config","message","template","URL","SERVER_URL","ADMIN_URL","USER","CODE","object","log","error","plugin","service","send","to","email","from","undefined","replyTo","response_email","subject","text","html"],"mappings":";;;;;;;;;;;;AAEA;;;;AAIA,KAEA,MAAMA,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,OAAAA,GAAUC,YAAAA;AAEhB,IAAA,MAAM,EAAEC,QAAQ,EAAEC,wBAAwB,EAAE,GAAGC,UAAAA;AAC/C,IAAA,MAAM,EAAEC,IAAI,EAAEC,GAAG,EAAEC,QAAQ,EAAE,GAAGC,UAAAA;IAChC,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AAEvB,IAAA,MAAMC,cAAAA,GAAiB,gCAAA;AAEvB,IAAA,MAAMC,sBAAAA,GAAyB,CAACC,MAAAA,GAAWR,IAAAA,CAAKQ,MAAAA,EAAQV,wBAAAA,CAAAA;AAExD,IAAA,MAAMW,iBAAAA,GAAoB,IAAA;QACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,QAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,IAAA,CAAA;AAEAG,IAAAA,IAAAA,GAAiB,CAAC,EAAEF,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAClC;;;;AAIA,OAEEG,OAAMN,MAAM,EAAA;gBACV,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgBQ,KAAK,CAACC,KAAAA,CAAAA;AACjD,YAAA,CAAA;AAEA;;;;;;;OAQE,MAAMG,uBAAsBC,MAAM,EAAA;AAChC,gBAAA,MAAMC,UAAAA,GAAaT,OAAAA,CAAOU,QAAQ,CAACf,gBAAgBc,UAAU;gBAE7D,IAAK,MAAME,OAAOH,MAAAA,CAAQ;oBACxB,IAAIC,UAAU,CAACE,GAAAA,CAAI,IAAIF,UAAU,CAACE,GAAAA,CAAI,CAACC,IAAI,KAAK,UAAA,EAAY;;AAE1D,wBAAA,MAAMC,SAAStB,QAAAA,CAASD,GAAAA,CAAImB,UAAU,CAACE,GAAAA,CAAI,EAAE,mBAAA,EAAqB,EAAA,CAAA,CAAA;wBAClEH,MAAM,CAACG,GAAAA,CAAI,GAAG,MAAM7B,MAAAA,CAAOgC,IAAI,CAACN,MAAM,CAACG,GAAAA,CAAI,EAAEE,MAAAA,CAAAA;AACrD,oBAAA;AACA,gBAAA;gBAEI,OAAOL,MAAAA;AACX,YAAA,CAAA;AAEA;;;OAIE,MAAMO,KAAIP,MAAM,EAAA;;;;;AAKd,gBAAA,OAAOR,OAAAA,CAAOgB,SAAS,CAACrB,cAAAA,CAAAA,CAAgBsB,MAAM,CAAC;oBAC7CC,IAAAA,EAAMV,MAAAA;oBACNW,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;;;AAKA,OACE,MAAMC,IAAAA,CAAAA,CAAKC,MAAM,EAAExB,MAAAA,GAAS,EAAE,EAAA;;;;;;gBAM5B,MAAMyB,KAAAA,GAAQ,MAAMtB,OAAAA,CAAOM,EAAA,CACxBF,KAAK,CAACT,cAAAA,CAAAA,CACN4B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEC,EAAAA,EAAIJ;AAAM,qBAAA;oBAAIK,MAAAA,EAAQ;AAAC,wBAAA;AAAa;;AAE1D,gBAAA,IAAI,CAACJ,KAAAA,EAAO;oBACV,OAAO,IAAA;AACb,gBAAA;AAEI,gBAAA,OAAOtB,OAAAA,CAAOgB,SAAS,CAACrB,cAAAA,CAAAA,CAAgBgC,MAAM,CAAC;AAC7CC,oBAAAA,UAAAA,EAAYN,MAAMM,UAAU;oBAC5BV,IAAAA,EAAMrB,MAAAA;oBACNsB,QAAAA,EAAU;AAAC,wBAAA;AAAO;AACxB,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;OAIEU,KAAAA,CAAAA,CAAMJ,EAAE,EAAE5B,MAAM,EAAA;gBACd,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB4B,OAAO,CAAC;AAC7C,oBAAA,GAAGnB,KAAK;oBACRoB,KAAAA,EAAO;wBACLM,IAAAA,EAAM;AAAC,4BAAA;AAAEL,gCAAAA;AAAE,6BAAA;4BAAIrB,KAAAA,CAAMoB,KAAK,IAAI;AAAG;AACzC;AACA,iBAAA,CAAA;AACA,YAAA,CAAA;AAEA;;;AAGA,OACEO,wBAAuBN,EAAE,EAAA;AACvB,gBAAA,OAAOzB,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB4B,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEC,wBAAAA;AAAE,qBAAA;oBAAIN,QAAAA,EAAU;AAAC,wBAAA;AAAO;AAAA,iBAAA,CAAA;AACtF,YAAA,CAAA;AAEA;;;AAGA,OACEa,UAASnC,MAAM,EAAA;gBACb,MAAMO,KAAAA,GAAQJ,OAAAA,CACXV,GAAG,CAAC,cAAA,CAAA,CACJe,SAAS,CAACV,cAAAA,EAAgBC,sBAAAA,CAAuBC,MAAAA,IAAU,EAAA,CAAA,CAAA;AAE9D,gBAAA,OAAOG,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgBsC,QAAQ,CAAC7B,KAAAA,CAAAA;AACpD,YAAA,CAAA;AAEA;;;OAIE,MAAM8B,QAAOrC,MAAM,EAAA;;AAEjB,gBAAA,MAAMI,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,gBAAA,IAAIG,kBAAkBA,cAAAA,CAAekC,SAAS,CAAC,mBAAA,CAAA,IAAwBtC,MAAAA,CAAO4B,EAAE,EAAE;AAChF,oBAAA,MAAMxB,eAAe,mBAAA,CAAA,CAAqBmC,sBAAsB,CAACC,MAAAA,CAAOxC,OAAO4B,EAAE,CAAA,CAAA;AACvF,gBAAA;AAEI,gBAAA,OAAOzB,QAAOM,EAAE,CAACF,KAAK,CAACT,cAAAA,CAAAA,CAAgB2C,MAAM,CAAC;oBAAEd,KAAAA,EAAO3B;;AAC3D,YAAA,CAAA;YAEE0C,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAE1B,IAAI,EAAA;gBAC7B,OAAOhC,MAAAA,CAAO2D,OAAO,CAACD,QAAAA,EAAU1B,IAAAA,CAAAA;AACpC,YAAA,CAAA;AAEE,YAAA,MAAM4B,uBAAsBxC,IAAI,EAAA;AAC9B,gBAAA,MAAMyC,wBAAwBlD,UAAAA,CAAW,mBAAA,CAAA;AACzC,gBAAA,MAAMmD,WAAAA,GAAc,MAAM5C,OAAAA,CAAO6C,KAAK,CAAC;oBAAEjC,IAAAA,EAAM,QAAA;oBAAUkC,IAAAA,EAAM;;gBAC/D,MAAMC,UAAAA,GAAa/C,OAAAA,CAAOU,QAAQ,CAACf,cAAAA,CAAAA;AAEnC,gBAAA,MAAMqD,QAAAA,GAAW,MAAMJ,WAAAA,CACpBtD,GAAG,CAAC;oBAAEqB,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAClBsC,IAAI,CAAC,CAACC,aAAeA,UAAAA,CAAWC,kBAAkB,CAACC,OAAO,CAAA;;AAG7D,gBAAA,MAAMC,oBAAoB,MAAMnE,QAAAA,CAASoE,UAAU,CAACC,qBAAqB,CACvE;oBACEC,MAAAA,EAAQT,UAAAA;AACRrC,oBAAAA,QAAAA,EAAUV,OAAAA,CAAOU,QAAQ,CAAC+C,IAAI,CAACzD,OAAAA;iBACvC,EACME,IAAAA,CAAAA;AAGF,gBAAA,MAAMwD,oBAAoB9E,MAAAA,CAAO+E,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE1D,gBAAA,MAAM,IAAI,CAACxC,IAAI,CAAClB,IAAAA,CAAKuB,EAAE,EAAE;AAAEiC,oBAAAA;AAAiB,iBAAA,CAAA;AAE5C,gBAAA,MAAMG,SAAAA,GAAY7D,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,iBAAA,CAAA;gBAEpC,IAAI;oBACF0D,QAAAA,CAASe,OAAO,GAAG,MAAMpB,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASe,OAAO,EAAE;AACxEE,wBAAAA,GAAAA,EAAKjF,QACHgB,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,uBAClBuE,SAAAA,EACA,0BAAA,CAAA;AAEFK,wBAAAA,UAAAA,EAAYlE,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,oBAAA,CAAA;AAC9B6E,wBAAAA,SAAAA,EAAWnE,OAAAA,CAAO8D,MAAM,CAACxE,GAAG,CAAC,mBAAA,CAAA;wBAC7B8E,IAAAA,EAAMf,iBAAAA;wBACNgB,IAAAA,EAAMX;AACd,qBAAA,CAAA;oBAEMV,QAAAA,CAASsB,MAAM,GAAG,MAAM3B,qBAAAA,CAAsBqB,QAAQ,CAAChB,QAAAA,CAASsB,MAAM,EAAE;wBACtEF,IAAAA,EAAMf;AACd,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAM;oBACNrD,OAAAA,CAAOuE,GAAG,CAACC,KAAK,CACd,mNAAA,CAAA;AAEF,oBAAA;AACN,gBAAA;;gBAGI,MAAMxE,OAAAA,CACHyE,MAAM,CAAC,OAAA,CAAA,CACPC,OAAO,CAAC,OAAA,CAAA,CACRC,IAAI,CAAC;AACJC,oBAAAA,EAAAA,EAAI1E,KAAK2E,KAAK;oBACdC,IAAAA,EACE9B,QAAAA,CAAS8B,IAAI,CAACD,KAAK,IAAI7B,SAAS8B,IAAI,CAAChC,IAAA,GACjC,CAAA,EAAGE,QAAAA,CAAS8B,IAAI,CAAChC,IAAI,CAAC,EAAE,EAAEE,QAAAA,CAAS8B,IAAI,CAACD,KAAK,CAAC,CAAC,CAAA,GAC/CE,SAAAA;AACNC,oBAAAA,OAAAA,EAAShC,SAASiC,cAAc;AAChCC,oBAAAA,OAAAA,EAASlC,SAASsB,MAAM;AACxBa,oBAAAA,IAAAA,EAAMnC,SAASe,OAAO;AACtBqB,oBAAAA,IAAAA,EAAMpC,SAASe;AACvB,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}

package/dist/server/services/users-permissions.js

@@ -1,16 +1,14 @@
 'use strict';
 
-var require$$0$1 = require('lodash');
-var require$$0 = require('lodash/fp');
-var require$$2 = require('url-join');
+var require$$0 = require('lodash');
+var require$$1$1 = require('url-join');
 var require$$1 = require('@strapi/utils');
 var index = require('../utils/index.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
-var require$$0__default$1 = /*#__PURE__*/_interopDefault(require$$0$1);
 var require$$0__default = /*#__PURE__*/_interopDefault(require$$0);
-var require$$2__default = /*#__PURE__*/_interopDefault(require$$2);
+var require$$1__default$1 = /*#__PURE__*/_interopDefault(require$$1$1);
 var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
 
 var usersPermissions;
@@ -18,9 +16,8 @@ var hasRequiredUsersPermissions;
 function requireUsersPermissions() {
     if (hasRequiredUsersPermissions) return usersPermissions;
     hasRequiredUsersPermissions = 1;
-    const _ = require$$0__default$1.default;
-    const { filter, map, pipe, prop } = require$$0__default.default;
-    const urlJoin = require$$2__default.default;
+    const _ = require$$0__default.default;
+    const urlJoin = require$$1__default$1.default;
     const { template: { createStrictInterpolationRegExp }, errors, objects, sanitizeRoutesMapForSerialization } = require$$1__default.default;
     const { getService } = index.__require();
     const DEFAULT_PERMISSIONS = [
@@ -207,7 +204,7 @@ function requireUsersPermissions() {
                 if (permissionsFoundInDB.length === 0) {
                     // create default permissions
                     for (const role of roles){
-                        const toCreate = pipe(filter(({ roleType })=>roleType === role.type || roleType === null), map(prop('action')))(DEFAULT_PERMISSIONS);
+                        const toCreate = DEFAULT_PERMISSIONS.filter(({ roleType })=>roleType === role.type || roleType === null).map(({ action })=>action);
                         await Promise.all(toCreate.map((action)=>{
                             return strapi.db.query('plugin::users-permissions.permission').create({
                                 data: {