@strapi/review-workflows 0.0.0-next.f6dca5adf05ef6bed9605a1535999ab0bbbf063e → 0.0.0-next.fb92031f3d90f3d2a2d191ba65725b6c8e329a5d

package/dist/server/controllers/assignees.js

@@ -0,0 +1,57 @@
+'use strict';
+
+var index = require('../utils/index.js');
+var reviewWorkflows = require('../validation/review-workflows.js');
+var workflows = require('../constants/workflows.js');
+
+var assignees = {
+    /**
+   * Updates an entity's assignee.
+   * @async
+   * @param {Object} ctx - The Koa context object.
+   * @param {Object} ctx.params - An object containing the parameters from the request URL.
+   * @param {string} ctx.params.model_uid - The model UID of the entity.
+   * @param {string} ctx.params.id - The ID of the entity to update.
+   * @param {Object} ctx.request.body.data - Optional data object containing the new assignee ID for the entity.
+   * @param {string} ctx.request.body.data.id - The ID of the new assignee for the entity.
+   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.
+   * @throws {ValidationError} If the `data` object in the request body fails to pass validation.
+   * @returns {Promise<void>} A promise that resolves when the entity's assignee has been updated.
+   */ async updateEntity (ctx) {
+        const assigneeService = index.getService('assignees');
+        const workflowService = index.getService('workflows');
+        const stagePermissions = index.getService('stage-permissions');
+        const { model_uid: model, id: documentId } = ctx.params;
+        const locale = await reviewWorkflows.validateLocale(ctx.request.query?.locale) ?? undefined;
+        const { sanitizeOutput } = strapi.plugin('content-manager').service('permission-checker').create({
+            userAbility: ctx.state.userAbility,
+            model
+        });
+        // Retrieve the entity so we can get its current stage
+        const entity = await strapi.documents(model).findOne({
+            documentId,
+            locale,
+            populate: [
+                workflows.ENTITY_STAGE_ATTRIBUTE
+            ]
+        });
+        if (!entity) {
+            ctx.throw(404, 'Entity not found');
+        }
+        // Only allow users who can update the current stage to change the assignee
+        const canTransitionStage = stagePermissions.can(workflows.STAGE_TRANSITION_UID, entity[workflows.ENTITY_STAGE_ATTRIBUTE]?.id);
+        if (!canTransitionStage) {
+            ctx.throw(403, 'Stage transition permission is required');
+        }
+        // TODO: check if user has update permission on the entity
+        const { id: assigneeId } = await reviewWorkflows.validateUpdateAssigneeOnEntity(ctx.request?.body?.data, 'You should pass a valid id to the body of the put request.');
+        await workflowService.assertContentTypeBelongsToWorkflow(model);
+        const updatedEntity = await assigneeService.updateEntityAssignee(entity, model, assigneeId);
+        ctx.body = {
+            data: await sanitizeOutput(updatedEntity)
+        };
+    }
+};
+
+module.exports = assignees;
+//# sourceMappingURL=assignees.js.map

package/dist/server/controllers/assignees.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignees.js","sources":["../../../server/src/controllers/assignees.ts"],"sourcesContent":["import type { Context } from 'koa';\n\nimport { getService } from '../utils';\nimport { validateUpdateAssigneeOnEntity, validateLocale } from '../validation/review-workflows';\nimport { ENTITY_STAGE_ATTRIBUTE, STAGE_TRANSITION_UID } from '../constants/workflows';\n\nexport default {\n  /**\n   * Updates an entity's assignee.\n   * @async\n   * @param {Object} ctx - The Koa context object.\n   * @param {Object} ctx.params - An object containing the parameters from the request URL.\n   * @param {string} ctx.params.model_uid - The model UID of the entity.\n   * @param {string} ctx.params.id - The ID of the entity to update.\n   * @param {Object} ctx.request.body.data - Optional data object containing the new assignee ID for the entity.\n   * @param {string} ctx.request.body.data.id - The ID of the new assignee for the entity.\n   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.\n   * @throws {ValidationError} If the `data` object in the request body fails to pass validation.\n   * @returns {Promise<void>} A promise that resolves when the entity's assignee has been updated.\n   */\n  async updateEntity(ctx: Context) {\n    const assigneeService = getService('assignees');\n    const workflowService = getService('workflows');\n    const stagePermissions = getService('stage-permissions');\n\n    const { model_uid: model, id: documentId } = ctx.params;\n    const locale = (await validateLocale(ctx.request.query?.locale)) ?? undefined;\n\n    const { sanitizeOutput } = strapi\n      .plugin('content-manager')\n      .service('permission-checker')\n      .create({ userAbility: ctx.state.userAbility, model });\n\n    // Retrieve the entity so we can get its current stage\n    const entity = await strapi.documents(model).findOne({\n      documentId,\n      locale,\n      populate: [ENTITY_STAGE_ATTRIBUTE],\n    });\n\n    if (!entity) {\n      ctx.throw(404, 'Entity not found');\n    }\n\n    // Only allow users who can update the current stage to change the assignee\n    const canTransitionStage = stagePermissions.can(\n      STAGE_TRANSITION_UID,\n      entity[ENTITY_STAGE_ATTRIBUTE]?.id\n    );\n\n    if (!canTransitionStage) {\n      ctx.throw(403, 'Stage transition permission is required');\n    }\n\n    // TODO: check if user has update permission on the entity\n    const { id: assigneeId } = await validateUpdateAssigneeOnEntity(\n      ctx.request?.body?.data,\n      'You should pass a valid id to the body of the put request.'\n    );\n\n    await workflowService.assertContentTypeBelongsToWorkflow(model);\n\n    const updatedEntity = await assigneeService.updateEntityAssignee(entity, model, assigneeId);\n\n    ctx.body = { data: await sanitizeOutput(updatedEntity) };\n  },\n};\n"],"names":["updateEntity","ctx","assigneeService","getService","workflowService","stagePermissions","model_uid","model","id","documentId","params","locale","validateLocale","request","query","undefined","sanitizeOutput","strapi","plugin","service","create","userAbility","state","entity","documents","findOne","populate","ENTITY_STAGE_ATTRIBUTE","throw","canTransitionStage","can","STAGE_TRANSITION_UID","assigneeId","validateUpdateAssigneeOnEntity","body","data","assertContentTypeBelongsToWorkflow","updatedEntity","updateEntityAssignee"],"mappings":";;;;;;AAMA,gBAAe;AACb;;;;;;;;;;;;MAaA,MAAMA,cAAaC,GAAY,EAAA;AAC7B,QAAA,MAAMC,kBAAkBC,gBAAW,CAAA,WAAA,CAAA;AACnC,QAAA,MAAMC,kBAAkBD,gBAAW,CAAA,WAAA,CAAA;AACnC,QAAA,MAAME,mBAAmBF,gBAAW,CAAA,mBAAA,CAAA;QAEpC,MAAM,EAAEG,WAAWC,KAAK,EAAEC,IAAIC,UAAU,EAAE,GAAGR,GAAAA,CAAIS,MAAM;QACvD,MAAMC,MAAAA,GAAS,MAAOC,8BAAAA,CAAeX,IAAIY,OAAO,CAACC,KAAK,EAAEH,MAAYI,CAAAA,IAAAA,SAAAA;AAEpE,QAAA,MAAM,EAAEC,cAAc,EAAE,GAAGC,MACxBC,CAAAA,MAAM,CAAC,iBAAA,CAAA,CACPC,OAAO,CAAC,oBACRC,CAAAA,CAAAA,MAAM,CAAC;YAAEC,WAAapB,EAAAA,GAAAA,CAAIqB,KAAK,CAACD,WAAW;AAAEd,YAAAA;AAAM,SAAA,CAAA;;AAGtD,QAAA,MAAMgB,SAAS,MAAMN,MAAAA,CAAOO,SAAS,CAACjB,KAAAA,CAAAA,CAAOkB,OAAO,CAAC;AACnDhB,YAAAA,UAAAA;AACAE,YAAAA,MAAAA;YACAe,QAAU,EAAA;AAACC,gBAAAA;AAAuB;AACpC,SAAA,CAAA;AAEA,QAAA,IAAI,CAACJ,MAAQ,EAAA;YACXtB,GAAI2B,CAAAA,KAAK,CAAC,GAAK,EAAA,kBAAA,CAAA;AACjB;;QAGA,MAAMC,kBAAAA,GAAqBxB,iBAAiByB,GAAG,CAC7CC,gCACAR,MAAM,CAACI,iCAAuB,EAAEnB,EAAAA,CAAAA;AAGlC,QAAA,IAAI,CAACqB,kBAAoB,EAAA;YACvB5B,GAAI2B,CAAAA,KAAK,CAAC,GAAK,EAAA,yCAAA,CAAA;AACjB;;QAGA,MAAM,EAAEpB,EAAIwB,EAAAA,UAAU,EAAE,GAAG,MAAMC,8CAAAA,CAC/BhC,GAAIY,CAAAA,OAAO,EAAEqB,IAAAA,EAAMC,IACnB,EAAA,4DAAA,CAAA;QAGF,MAAM/B,eAAAA,CAAgBgC,kCAAkC,CAAC7B,KAAAA,CAAAA;AAEzD,QAAA,MAAM8B,gBAAgB,MAAMnC,eAAAA,CAAgBoC,oBAAoB,CAACf,QAAQhB,KAAOyB,EAAAA,UAAAA,CAAAA;AAEhF/B,QAAAA,GAAAA,CAAIiC,IAAI,GAAG;AAAEC,YAAAA,IAAAA,EAAM,MAAMnB,cAAeqB,CAAAA,aAAAA;AAAe,SAAA;AACzD;AACF,CAAE;;;;"}

package/dist/server/controllers/assignees.mjs

@@ -0,0 +1,55 @@
+import { getService } from '../utils/index.mjs';
+import { validateLocale, validateUpdateAssigneeOnEntity } from '../validation/review-workflows.mjs';
+import { ENTITY_STAGE_ATTRIBUTE, STAGE_TRANSITION_UID } from '../constants/workflows.mjs';
+
+var assignees = {
+    /**
+   * Updates an entity's assignee.
+   * @async
+   * @param {Object} ctx - The Koa context object.
+   * @param {Object} ctx.params - An object containing the parameters from the request URL.
+   * @param {string} ctx.params.model_uid - The model UID of the entity.
+   * @param {string} ctx.params.id - The ID of the entity to update.
+   * @param {Object} ctx.request.body.data - Optional data object containing the new assignee ID for the entity.
+   * @param {string} ctx.request.body.data.id - The ID of the new assignee for the entity.
+   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.
+   * @throws {ValidationError} If the `data` object in the request body fails to pass validation.
+   * @returns {Promise<void>} A promise that resolves when the entity's assignee has been updated.
+   */ async updateEntity (ctx) {
+        const assigneeService = getService('assignees');
+        const workflowService = getService('workflows');
+        const stagePermissions = getService('stage-permissions');
+        const { model_uid: model, id: documentId } = ctx.params;
+        const locale = await validateLocale(ctx.request.query?.locale) ?? undefined;
+        const { sanitizeOutput } = strapi.plugin('content-manager').service('permission-checker').create({
+            userAbility: ctx.state.userAbility,
+            model
+        });
+        // Retrieve the entity so we can get its current stage
+        const entity = await strapi.documents(model).findOne({
+            documentId,
+            locale,
+            populate: [
+                ENTITY_STAGE_ATTRIBUTE
+            ]
+        });
+        if (!entity) {
+            ctx.throw(404, 'Entity not found');
+        }
+        // Only allow users who can update the current stage to change the assignee
+        const canTransitionStage = stagePermissions.can(STAGE_TRANSITION_UID, entity[ENTITY_STAGE_ATTRIBUTE]?.id);
+        if (!canTransitionStage) {
+            ctx.throw(403, 'Stage transition permission is required');
+        }
+        // TODO: check if user has update permission on the entity
+        const { id: assigneeId } = await validateUpdateAssigneeOnEntity(ctx.request?.body?.data, 'You should pass a valid id to the body of the put request.');
+        await workflowService.assertContentTypeBelongsToWorkflow(model);
+        const updatedEntity = await assigneeService.updateEntityAssignee(entity, model, assigneeId);
+        ctx.body = {
+            data: await sanitizeOutput(updatedEntity)
+        };
+    }
+};
+
+export { assignees as default };
+//# sourceMappingURL=assignees.mjs.map

package/dist/server/controllers/assignees.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignees.mjs","sources":["../../../server/src/controllers/assignees.ts"],"sourcesContent":["import type { Context } from 'koa';\n\nimport { getService } from '../utils';\nimport { validateUpdateAssigneeOnEntity, validateLocale } from '../validation/review-workflows';\nimport { ENTITY_STAGE_ATTRIBUTE, STAGE_TRANSITION_UID } from '../constants/workflows';\n\nexport default {\n  /**\n   * Updates an entity's assignee.\n   * @async\n   * @param {Object} ctx - The Koa context object.\n   * @param {Object} ctx.params - An object containing the parameters from the request URL.\n   * @param {string} ctx.params.model_uid - The model UID of the entity.\n   * @param {string} ctx.params.id - The ID of the entity to update.\n   * @param {Object} ctx.request.body.data - Optional data object containing the new assignee ID for the entity.\n   * @param {string} ctx.request.body.data.id - The ID of the new assignee for the entity.\n   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.\n   * @throws {ValidationError} If the `data` object in the request body fails to pass validation.\n   * @returns {Promise<void>} A promise that resolves when the entity's assignee has been updated.\n   */\n  async updateEntity(ctx: Context) {\n    const assigneeService = getService('assignees');\n    const workflowService = getService('workflows');\n    const stagePermissions = getService('stage-permissions');\n\n    const { model_uid: model, id: documentId } = ctx.params;\n    const locale = (await validateLocale(ctx.request.query?.locale)) ?? undefined;\n\n    const { sanitizeOutput } = strapi\n      .plugin('content-manager')\n      .service('permission-checker')\n      .create({ userAbility: ctx.state.userAbility, model });\n\n    // Retrieve the entity so we can get its current stage\n    const entity = await strapi.documents(model).findOne({\n      documentId,\n      locale,\n      populate: [ENTITY_STAGE_ATTRIBUTE],\n    });\n\n    if (!entity) {\n      ctx.throw(404, 'Entity not found');\n    }\n\n    // Only allow users who can update the current stage to change the assignee\n    const canTransitionStage = stagePermissions.can(\n      STAGE_TRANSITION_UID,\n      entity[ENTITY_STAGE_ATTRIBUTE]?.id\n    );\n\n    if (!canTransitionStage) {\n      ctx.throw(403, 'Stage transition permission is required');\n    }\n\n    // TODO: check if user has update permission on the entity\n    const { id: assigneeId } = await validateUpdateAssigneeOnEntity(\n      ctx.request?.body?.data,\n      'You should pass a valid id to the body of the put request.'\n    );\n\n    await workflowService.assertContentTypeBelongsToWorkflow(model);\n\n    const updatedEntity = await assigneeService.updateEntityAssignee(entity, model, assigneeId);\n\n    ctx.body = { data: await sanitizeOutput(updatedEntity) };\n  },\n};\n"],"names":["updateEntity","ctx","assigneeService","getService","workflowService","stagePermissions","model_uid","model","id","documentId","params","locale","validateLocale","request","query","undefined","sanitizeOutput","strapi","plugin","service","create","userAbility","state","entity","documents","findOne","populate","ENTITY_STAGE_ATTRIBUTE","throw","canTransitionStage","can","STAGE_TRANSITION_UID","assigneeId","validateUpdateAssigneeOnEntity","body","data","assertContentTypeBelongsToWorkflow","updatedEntity","updateEntityAssignee"],"mappings":";;;;AAMA,gBAAe;AACb;;;;;;;;;;;;MAaA,MAAMA,cAAaC,GAAY,EAAA;AAC7B,QAAA,MAAMC,kBAAkBC,UAAW,CAAA,WAAA,CAAA;AACnC,QAAA,MAAMC,kBAAkBD,UAAW,CAAA,WAAA,CAAA;AACnC,QAAA,MAAME,mBAAmBF,UAAW,CAAA,mBAAA,CAAA;QAEpC,MAAM,EAAEG,WAAWC,KAAK,EAAEC,IAAIC,UAAU,EAAE,GAAGR,GAAAA,CAAIS,MAAM;QACvD,MAAMC,MAAAA,GAAS,MAAOC,cAAAA,CAAeX,IAAIY,OAAO,CAACC,KAAK,EAAEH,MAAYI,CAAAA,IAAAA,SAAAA;AAEpE,QAAA,MAAM,EAAEC,cAAc,EAAE,GAAGC,MACxBC,CAAAA,MAAM,CAAC,iBAAA,CAAA,CACPC,OAAO,CAAC,oBACRC,CAAAA,CAAAA,MAAM,CAAC;YAAEC,WAAapB,EAAAA,GAAAA,CAAIqB,KAAK,CAACD,WAAW;AAAEd,YAAAA;AAAM,SAAA,CAAA;;AAGtD,QAAA,MAAMgB,SAAS,MAAMN,MAAAA,CAAOO,SAAS,CAACjB,KAAAA,CAAAA,CAAOkB,OAAO,CAAC;AACnDhB,YAAAA,UAAAA;AACAE,YAAAA,MAAAA;YACAe,QAAU,EAAA;AAACC,gBAAAA;AAAuB;AACpC,SAAA,CAAA;AAEA,QAAA,IAAI,CAACJ,MAAQ,EAAA;YACXtB,GAAI2B,CAAAA,KAAK,CAAC,GAAK,EAAA,kBAAA,CAAA;AACjB;;QAGA,MAAMC,kBAAAA,GAAqBxB,iBAAiByB,GAAG,CAC7CC,sBACAR,MAAM,CAACI,uBAAuB,EAAEnB,EAAAA,CAAAA;AAGlC,QAAA,IAAI,CAACqB,kBAAoB,EAAA;YACvB5B,GAAI2B,CAAAA,KAAK,CAAC,GAAK,EAAA,yCAAA,CAAA;AACjB;;QAGA,MAAM,EAAEpB,EAAIwB,EAAAA,UAAU,EAAE,GAAG,MAAMC,8BAAAA,CAC/BhC,GAAIY,CAAAA,OAAO,EAAEqB,IAAAA,EAAMC,IACnB,EAAA,4DAAA,CAAA;QAGF,MAAM/B,eAAAA,CAAgBgC,kCAAkC,CAAC7B,KAAAA,CAAAA;AAEzD,QAAA,MAAM8B,gBAAgB,MAAMnC,eAAAA,CAAgBoC,oBAAoB,CAACf,QAAQhB,KAAOyB,EAAAA,UAAAA,CAAAA;AAEhF/B,QAAAA,GAAAA,CAAIiC,IAAI,GAAG;AAAEC,YAAAA,IAAAA,EAAM,MAAMnB,cAAeqB,CAAAA,aAAAA;AAAe,SAAA;AACzD;AACF,CAAE;;;;"}

package/dist/server/controllers/index.js

@@ -0,0 +1,14 @@
+'use strict';
+
+var workflows = require('./workflows.js');
+var stages = require('./stages.js');
+var assignees = require('./assignees.js');
+
+var controllers = {
+    workflows,
+    stages,
+    assignees
+};
+
+module.exports = controllers;
+//# sourceMappingURL=index.js.map

package/dist/server/controllers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../server/src/controllers/index.ts"],"sourcesContent":["import type {} from 'koa-body';\n\nimport workflows from './workflows';\nimport stages from './stages';\nimport assignees from './assignees';\n\nexport default {\n  workflows,\n  stages,\n  assignees,\n};\n"],"names":["workflows","stages","assignees"],"mappings":";;;;;;AAMA,kBAAe;AACbA,IAAAA,SAAAA;AACAC,IAAAA,MAAAA;AACAC,IAAAA;AACF,CAAE;;;;"}

package/dist/server/controllers/index.mjs

@@ -0,0 +1,12 @@
+import workflows from './workflows.mjs';
+import stages from './stages.mjs';
+import assignees from './assignees.mjs';
+
+var controllers = {
+    workflows,
+    stages,
+    assignees
+};
+
+export { controllers as default };
+//# sourceMappingURL=index.mjs.map

package/dist/server/controllers/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sources":["../../../server/src/controllers/index.ts"],"sourcesContent":["import type {} from 'koa-body';\n\nimport workflows from './workflows';\nimport stages from './stages';\nimport assignees from './assignees';\n\nexport default {\n  workflows,\n  stages,\n  assignees,\n};\n"],"names":["workflows","stages","assignees"],"mappings":";;;;AAMA,kBAAe;AACbA,IAAAA,SAAAA;AACAC,IAAAA,MAAAA;AACAC,IAAAA;AACF,CAAE;;;;"}

package/dist/server/controllers/stages.js

@@ -0,0 +1,167 @@
+'use strict';
+
+var utils = require('@strapi/utils');
+var index = require('../utils/index.js');
+var reviewWorkflows = require('../validation/review-workflows.js');
+var workflows = require('../constants/workflows.js');
+
+/**
+ *
+ * @param { Core.Strapi } strapi - Strapi instance
+ * @param userAbility
+ * @return { (Stage) => SanitizedStage }
+ */ function sanitizeStage({ strapi: strapi1 }, userAbility) {
+    const permissionChecker = strapi1.plugin('content-manager').service('permission-checker').create({
+        userAbility,
+        model: workflows.STAGE_MODEL_UID
+    });
+    return (entity)=>permissionChecker.sanitizeOutput(entity);
+}
+var stages = {
+    /**
+   * List all stages
+   * @param {import('koa').BaseContext} ctx - koa context
+   */ async find (ctx) {
+        const { workflow_id: workflowId } = ctx.params;
+        const { populate } = ctx.query;
+        const stagesService = index.getService('stages');
+        const sanitizer = sanitizeStage({
+            strapi
+        }, ctx.state.userAbility);
+        const stages = await stagesService.find({
+            workflowId,
+            populate
+        });
+        ctx.body = {
+            data: await utils.async.map(stages, sanitizer)
+        };
+    },
+    /**
+   * Get one stage
+   * @param {import('koa').BaseContext} ctx - koa context
+   */ async findById (ctx) {
+        const { id, workflow_id: workflowId } = ctx.params;
+        const { populate } = ctx.query;
+        const stagesService = index.getService('stages');
+        const sanitizer = sanitizeStage({
+            strapi
+        }, ctx.state.userAbility);
+        const stage = await stagesService.findById(id, {
+            workflowId,
+            populate
+        });
+        ctx.body = {
+            data: await sanitizer(stage)
+        };
+    },
+    /**
+   * Updates an entity's stage.
+   * @async
+   * @param {Object} ctx - The Koa context object.
+   * @param {Object} ctx.params - An object containing the parameters from the request URL.
+   * @param {string} ctx.params.model_uid - The model UID of the entity.
+   * @param {string} ctx.params.id - The ID of the entity to update.
+   * @param {Object} ctx.request.body.data - Optional data object containing the new stage ID for the entity.
+   * @param {string} ctx.request.body.data.id - The ID of the new stage for the entity.
+   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.
+   * @throws {ValidationError} If the `data` object in the request body fails to pass validation.
+   * @returns {Promise<void>} A promise that resolves when the entity's stage has been updated.
+   */ async updateEntity (ctx) {
+        const stagesService = index.getService('stages');
+        const stagePermissions = index.getService('stage-permissions');
+        const workflowService = index.getService('workflows');
+        const { model_uid: modelUID, id: documentId } = ctx.params;
+        const { body, query = {} } = ctx.request;
+        const { sanitizeOutput } = strapi.plugin('content-manager').service('permission-checker').create({
+            userAbility: ctx.state.userAbility,
+            model: modelUID
+        });
+        // Load entity
+        const locale = await reviewWorkflows.validateLocale(query?.locale);
+        const entity = await strapi.documents(modelUID).findOne({
+            documentId,
+            // @ts-expect-error - locale should be also null in the doc service types
+            locale,
+            populate: [
+                workflows.ENTITY_STAGE_ATTRIBUTE
+            ]
+        });
+        if (!entity) {
+            ctx.throw(404, 'Entity not found');
+        }
+        // Validate if entity stage can be updated
+        const canTransition = stagePermissions.can(workflows.STAGE_TRANSITION_UID, entity[workflows.ENTITY_STAGE_ATTRIBUTE]?.id);
+        if (!canTransition) {
+            ctx.throw(403, 'Forbidden stage transition');
+        }
+        const { id: stageId } = await reviewWorkflows.validateUpdateStageOnEntity({
+            id: Number(body?.data?.id)
+        }, 'You should pass an id to the body of the put request.');
+        const workflow = await workflowService.assertContentTypeBelongsToWorkflow(modelUID);
+        workflowService.assertStageBelongsToWorkflow(stageId, workflow);
+        const updatedEntity = await stagesService.updateEntity(entity, modelUID, stageId);
+        ctx.body = {
+            data: await sanitizeOutput(updatedEntity)
+        };
+    },
+    /**
+   * List all the stages that are available for a user to transition an entity to.
+   * If the user has permission to change the current stage of the entity every other stage in the workflow is returned
+   * @async
+   * @param {*} ctx
+   * @param {string} ctx.params.model_uid - The model UID of the entity.
+   * @param {string} ctx.params.id - The ID of the entity.
+   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.
+   */ async listAvailableStages (ctx) {
+        const stagePermissions = index.getService('stage-permissions');
+        const workflowService = index.getService('workflows');
+        const { model_uid: modelUID, id: documentId } = ctx.params;
+        const { query = {} } = ctx.request;
+        if (strapi.plugin('content-manager').service('permission-checker').create({
+            userAbility: ctx.state.userAbility,
+            model: modelUID
+        }).cannot.read()) {
+            return ctx.forbidden();
+        }
+        // Load entity
+        const locale = await reviewWorkflows.validateLocale(query?.locale) ?? undefined;
+        const entity = await strapi.documents(modelUID).findOne({
+            documentId,
+            locale,
+            populate: [
+                workflows.ENTITY_STAGE_ATTRIBUTE
+            ]
+        });
+        if (!entity) {
+            ctx.throw(404, 'Entity not found');
+        }
+        const entityStageId = entity[workflows.ENTITY_STAGE_ATTRIBUTE]?.id;
+        const canTransition = stagePermissions.can(workflows.STAGE_TRANSITION_UID, entityStageId);
+        const [workflowCount, workflowResult] = await Promise.all([
+            workflowService.count(),
+            workflowService.getAssignedWorkflow(modelUID, {
+                populate: 'stages'
+            })
+        ]);
+        const workflowStages = workflowResult ? workflowResult.stages : [];
+        const meta = {
+            stageCount: workflowStages.length,
+            workflowCount
+        };
+        if (!canTransition) {
+            ctx.body = {
+                data: [],
+                meta
+            };
+            return;
+        }
+        const data = workflowStages.filter((stage)=>stage.id !== entityStageId);
+        ctx.body = {
+            data,
+            meta
+        };
+    }
+};
+
+module.exports = stages;
+//# sourceMappingURL=stages.js.map

package/dist/server/controllers/stages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages.js","sources":["../../../server/src/controllers/stages.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport type { Core } from '@strapi/types';\n\nimport { async, validate } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { validateUpdateStageOnEntity, validateLocale } from '../validation/review-workflows';\nimport {\n  STAGE_MODEL_UID,\n  ENTITY_STAGE_ATTRIBUTE,\n  STAGE_TRANSITION_UID,\n} from '../constants/workflows';\n\n/**\n *\n * @param { Core.Strapi } strapi - Strapi instance\n * @param userAbility\n * @return { (Stage) => SanitizedStage }\n */\nfunction sanitizeStage({ strapi }: { strapi: Core.Strapi }, userAbility: unknown) {\n  const permissionChecker = strapi\n    .plugin('content-manager')\n    .service('permission-checker')\n    .create({ userAbility, model: STAGE_MODEL_UID });\n\n  return (entity: unknown) => permissionChecker.sanitizeOutput(entity);\n}\n\nexport default {\n  /**\n   * List all stages\n   * @param {import('koa').BaseContext} ctx - koa context\n   */\n  async find(ctx: Context) {\n    const { workflow_id: workflowId } = ctx.params;\n    const { populate } = ctx.query;\n    const stagesService = getService('stages');\n    const sanitizer = sanitizeStage({ strapi }, ctx.state.userAbility);\n\n    const stages = await stagesService.find({\n      workflowId,\n      populate,\n    });\n\n    ctx.body = {\n      data: await async.map(stages, sanitizer),\n    };\n  },\n  /**\n   * Get one stage\n   * @param {import('koa').BaseContext} ctx - koa context\n   */\n  async findById(ctx: Context) {\n    const { id, workflow_id: workflowId } = ctx.params;\n    const { populate } = ctx.query;\n    const stagesService = getService('stages');\n    const sanitizer = sanitizeStage({ strapi }, ctx.state.userAbility);\n\n    const stage = await stagesService.findById(id, {\n      workflowId,\n      populate,\n    });\n\n    ctx.body = {\n      data: await sanitizer(stage),\n    };\n  },\n\n  /**\n   * Updates an entity's stage.\n   * @async\n   * @param {Object} ctx - The Koa context object.\n   * @param {Object} ctx.params - An object containing the parameters from the request URL.\n   * @param {string} ctx.params.model_uid - The model UID of the entity.\n   * @param {string} ctx.params.id - The ID of the entity to update.\n   * @param {Object} ctx.request.body.data - Optional data object containing the new stage ID for the entity.\n   * @param {string} ctx.request.body.data.id - The ID of the new stage for the entity.\n   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.\n   * @throws {ValidationError} If the `data` object in the request body fails to pass validation.\n   * @returns {Promise<void>} A promise that resolves when the entity's stage has been updated.\n   */\n  async updateEntity(ctx: Context) {\n    const stagesService = getService('stages');\n    const stagePermissions = getService('stage-permissions');\n    const workflowService = getService('workflows');\n\n    const { model_uid: modelUID, id: documentId } = ctx.params;\n    const { body, query = {} } = ctx.request;\n\n    const { sanitizeOutput } = strapi\n      .plugin('content-manager')\n      .service('permission-checker')\n      .create({ userAbility: ctx.state.userAbility, model: modelUID });\n\n    // Load entity\n    const locale = await validateLocale(query?.locale);\n    const entity = await strapi.documents(modelUID).findOne({\n      documentId,\n      // @ts-expect-error - locale should be also null in the doc service types\n      locale,\n      populate: [ENTITY_STAGE_ATTRIBUTE],\n    });\n\n    if (!entity) {\n      ctx.throw(404, 'Entity not found');\n    }\n\n    // Validate if entity stage can be updated\n    const canTransition = stagePermissions.can(\n      STAGE_TRANSITION_UID,\n      entity[ENTITY_STAGE_ATTRIBUTE]?.id\n    );\n\n    if (!canTransition) {\n      ctx.throw(403, 'Forbidden stage transition');\n    }\n\n    const { id: stageId } = await validateUpdateStageOnEntity(\n      { id: Number(body?.data?.id) },\n      'You should pass an id to the body of the put request.'\n    );\n\n    const workflow = await workflowService.assertContentTypeBelongsToWorkflow(modelUID);\n    workflowService.assertStageBelongsToWorkflow(stageId, workflow);\n\n    const updatedEntity = await stagesService.updateEntity(entity, modelUID, stageId);\n\n    ctx.body = { data: await sanitizeOutput(updatedEntity) };\n  },\n\n  /**\n   * List all the stages that are available for a user to transition an entity to.\n   * If the user has permission to change the current stage of the entity every other stage in the workflow is returned\n   * @async\n   * @param {*} ctx\n   * @param {string} ctx.params.model_uid - The model UID of the entity.\n   * @param {string} ctx.params.id - The ID of the entity.\n   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.\n   */\n  async listAvailableStages(ctx: Context) {\n    const stagePermissions = getService('stage-permissions');\n    const workflowService = getService('workflows');\n\n    const { model_uid: modelUID, id: documentId } = ctx.params;\n    const { query = {} } = ctx.request;\n\n    if (\n      strapi\n        .plugin('content-manager')\n        .service('permission-checker')\n        .create({ userAbility: ctx.state.userAbility, model: modelUID })\n        .cannot.read()\n    ) {\n      return ctx.forbidden();\n    }\n\n    // Load entity\n    const locale = (await validateLocale(query?.locale)) ?? undefined;\n    const entity = await strapi.documents(modelUID).findOne({\n      documentId,\n      locale,\n      populate: [ENTITY_STAGE_ATTRIBUTE],\n    });\n\n    if (!entity) {\n      ctx.throw(404, 'Entity not found');\n    }\n\n    const entityStageId = entity[ENTITY_STAGE_ATTRIBUTE]?.id;\n    const canTransition = stagePermissions.can(STAGE_TRANSITION_UID, entityStageId);\n\n    const [workflowCount, workflowResult] = await Promise.all([\n      workflowService.count(),\n      workflowService.getAssignedWorkflow(modelUID, {\n        populate: 'stages',\n      }),\n    ]);\n\n    const workflowStages = workflowResult ? workflowResult.stages : [];\n\n    const meta = {\n      stageCount: workflowStages.length,\n      workflowCount,\n    };\n\n    if (!canTransition) {\n      ctx.body = {\n        data: [],\n        meta,\n      };\n\n      return;\n    }\n\n    const data = workflowStages.filter((stage: any) => stage.id !== entityStageId);\n    ctx.body = {\n      data,\n      meta,\n    };\n  },\n};\n"],"names":["sanitizeStage","strapi","userAbility","permissionChecker","plugin","service","create","model","STAGE_MODEL_UID","entity","sanitizeOutput","find","ctx","workflow_id","workflowId","params","populate","query","stagesService","getService","sanitizer","state","stages","body","data","async","map","findById","id","stage","updateEntity","stagePermissions","workflowService","model_uid","modelUID","documentId","request","locale","validateLocale","documents","findOne","ENTITY_STAGE_ATTRIBUTE","throw","canTransition","can","STAGE_TRANSITION_UID","stageId","validateUpdateStageOnEntity","Number","workflow","assertContentTypeBelongsToWorkflow","assertStageBelongsToWorkflow","updatedEntity","listAvailableStages","cannot","read","forbidden","undefined","entityStageId","workflowCount","workflowResult","Promise","all","count","getAssignedWorkflow","workflowStages","meta","stageCount","length","filter"],"mappings":";;;;;;;AAYA;;;;;AAKC,IACD,SAASA,aAAc,CAAA,EAAEC,QAAAA,OAAM,EAA2B,EAAEC,WAAoB,EAAA;IAC9E,MAAMC,iBAAAA,GAAoBF,QACvBG,MAAM,CAAC,mBACPC,OAAO,CAAC,oBACRC,CAAAA,CAAAA,MAAM,CAAC;AAAEJ,QAAAA,WAAAA;QAAaK,KAAOC,EAAAA;AAAgB,KAAA,CAAA;AAEhD,IAAA,OAAO,CAACC,MAAAA,GAAoBN,iBAAkBO,CAAAA,cAAc,CAACD,MAAAA,CAAAA;AAC/D;AAEA,aAAe;AACb;;;MAIA,MAAME,MAAKC,GAAY,EAAA;AACrB,QAAA,MAAM,EAAEC,WAAaC,EAAAA,UAAU,EAAE,GAAGF,IAAIG,MAAM;AAC9C,QAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGJ,IAAIK,KAAK;AAC9B,QAAA,MAAMC,gBAAgBC,gBAAW,CAAA,QAAA,CAAA;AACjC,QAAA,MAAMC,YAAYpB,aAAc,CAAA;AAAEC,YAAAA;SAAUW,EAAAA,GAAAA,CAAIS,KAAK,CAACnB,WAAW,CAAA;AAEjE,QAAA,MAAMoB,MAAS,GAAA,MAAMJ,aAAcP,CAAAA,IAAI,CAAC;AACtCG,YAAAA,UAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEAJ,QAAAA,GAAAA,CAAIW,IAAI,GAAG;AACTC,YAAAA,IAAAA,EAAM,MAAMC,WAAAA,CAAMC,GAAG,CAACJ,MAAQF,EAAAA,SAAAA;AAChC,SAAA;AACF,KAAA;AACA;;;MAIA,MAAMO,UAASf,GAAY,EAAA;QACzB,MAAM,EAAEgB,EAAE,EAAEf,WAAAA,EAAaC,UAAU,EAAE,GAAGF,IAAIG,MAAM;AAClD,QAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGJ,IAAIK,KAAK;AAC9B,QAAA,MAAMC,gBAAgBC,gBAAW,CAAA,QAAA,CAAA;AACjC,QAAA,MAAMC,YAAYpB,aAAc,CAAA;AAAEC,YAAAA;SAAUW,EAAAA,GAAAA,CAAIS,KAAK,CAACnB,WAAW,CAAA;AAEjE,QAAA,MAAM2B,KAAQ,GAAA,MAAMX,aAAcS,CAAAA,QAAQ,CAACC,EAAI,EAAA;AAC7Cd,YAAAA,UAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEAJ,QAAAA,GAAAA,CAAIW,IAAI,GAAG;AACTC,YAAAA,IAAAA,EAAM,MAAMJ,SAAUS,CAAAA,KAAAA;AACxB,SAAA;AACF,KAAA;AAEA;;;;;;;;;;;;MAaA,MAAMC,cAAalB,GAAY,EAAA;AAC7B,QAAA,MAAMM,gBAAgBC,gBAAW,CAAA,QAAA,CAAA;AACjC,QAAA,MAAMY,mBAAmBZ,gBAAW,CAAA,mBAAA,CAAA;AACpC,QAAA,MAAMa,kBAAkBb,gBAAW,CAAA,WAAA,CAAA;QAEnC,MAAM,EAAEc,WAAWC,QAAQ,EAAEN,IAAIO,UAAU,EAAE,GAAGvB,GAAAA,CAAIG,MAAM;QAC1D,MAAM,EAAEQ,IAAI,EAAEN,KAAAA,GAAQ,EAAE,EAAE,GAAGL,GAAAA,CAAIwB,OAAO;AAExC,QAAA,MAAM,EAAE1B,cAAc,EAAE,GAAGT,MACxBG,CAAAA,MAAM,CAAC,iBAAA,CAAA,CACPC,OAAO,CAAC,oBACRC,CAAAA,CAAAA,MAAM,CAAC;YAAEJ,WAAaU,EAAAA,GAAAA,CAAIS,KAAK,CAACnB,WAAW;YAAEK,KAAO2B,EAAAA;AAAS,SAAA,CAAA;;QAGhE,MAAMG,MAAAA,GAAS,MAAMC,8BAAAA,CAAerB,KAAOoB,EAAAA,MAAAA,CAAAA;AAC3C,QAAA,MAAM5B,SAAS,MAAMR,MAAAA,CAAOsC,SAAS,CAACL,QAAAA,CAAAA,CAAUM,OAAO,CAAC;AACtDL,YAAAA,UAAAA;;AAEAE,YAAAA,MAAAA;YACArB,QAAU,EAAA;AAACyB,gBAAAA;AAAuB;AACpC,SAAA,CAAA;AAEA,QAAA,IAAI,CAAChC,MAAQ,EAAA;YACXG,GAAI8B,CAAAA,KAAK,CAAC,GAAK,EAAA,kBAAA,CAAA;AACjB;;QAGA,MAAMC,aAAAA,GAAgBZ,iBAAiBa,GAAG,CACxCC,gCACApC,MAAM,CAACgC,iCAAuB,EAAEb,EAAAA,CAAAA;AAGlC,QAAA,IAAI,CAACe,aAAe,EAAA;YAClB/B,GAAI8B,CAAAA,KAAK,CAAC,GAAK,EAAA,4BAAA,CAAA;AACjB;AAEA,QAAA,MAAM,EAAEd,EAAIkB,EAAAA,OAAO,EAAE,GAAG,MAAMC,2CAC5B,CAAA;YAAEnB,EAAIoB,EAAAA,MAAAA,CAAOzB,MAAMC,IAAMI,EAAAA,EAAAA;SACzB,EAAA,uDAAA,CAAA;AAGF,QAAA,MAAMqB,QAAW,GAAA,MAAMjB,eAAgBkB,CAAAA,kCAAkC,CAAChB,QAAAA,CAAAA;QAC1EF,eAAgBmB,CAAAA,4BAA4B,CAACL,OAASG,EAAAA,QAAAA,CAAAA;AAEtD,QAAA,MAAMG,gBAAgB,MAAMlC,aAAAA,CAAcY,YAAY,CAACrB,QAAQyB,QAAUY,EAAAA,OAAAA,CAAAA;AAEzElC,QAAAA,GAAAA,CAAIW,IAAI,GAAG;AAAEC,YAAAA,IAAAA,EAAM,MAAMd,cAAe0C,CAAAA,aAAAA;AAAe,SAAA;AACzD,KAAA;AAEA;;;;;;;;MASA,MAAMC,qBAAoBzC,GAAY,EAAA;AACpC,QAAA,MAAMmB,mBAAmBZ,gBAAW,CAAA,mBAAA,CAAA;AACpC,QAAA,MAAMa,kBAAkBb,gBAAW,CAAA,WAAA,CAAA;QAEnC,MAAM,EAAEc,WAAWC,QAAQ,EAAEN,IAAIO,UAAU,EAAE,GAAGvB,GAAAA,CAAIG,MAAM;AAC1D,QAAA,MAAM,EAAEE,KAAQ,GAAA,EAAE,EAAE,GAAGL,IAAIwB,OAAO;QAElC,IACEnC,MAAAA,CACGG,MAAM,CAAC,iBAAA,CAAA,CACPC,OAAO,CAAC,oBAAA,CAAA,CACRC,MAAM,CAAC;YAAEJ,WAAaU,EAAAA,GAAAA,CAAIS,KAAK,CAACnB,WAAW;YAAEK,KAAO2B,EAAAA;SACpDoB,CAAAA,CAAAA,MAAM,CAACC,IAAI,EACd,EAAA;AACA,YAAA,OAAO3C,IAAI4C,SAAS,EAAA;AACtB;;AAGA,QAAA,MAAMnB,MAAS,GAAC,MAAMC,8BAAAA,CAAerB,OAAOoB,MAAYoB,CAAAA,IAAAA,SAAAA;AACxD,QAAA,MAAMhD,SAAS,MAAMR,MAAAA,CAAOsC,SAAS,CAACL,QAAAA,CAAAA,CAAUM,OAAO,CAAC;AACtDL,YAAAA,UAAAA;AACAE,YAAAA,MAAAA;YACArB,QAAU,EAAA;AAACyB,gBAAAA;AAAuB;AACpC,SAAA,CAAA;AAEA,QAAA,IAAI,CAAChC,MAAQ,EAAA;YACXG,GAAI8B,CAAAA,KAAK,CAAC,GAAK,EAAA,kBAAA,CAAA;AACjB;AAEA,QAAA,MAAMgB,aAAgBjD,GAAAA,MAAM,CAACgC,gCAAAA,CAAuB,EAAEb,EAAAA;AACtD,QAAA,MAAMe,aAAgBZ,GAAAA,gBAAAA,CAAiBa,GAAG,CAACC,8BAAsBa,EAAAA,aAAAA,CAAAA;AAEjE,QAAA,MAAM,CAACC,aAAeC,EAAAA,cAAAA,CAAe,GAAG,MAAMC,OAAAA,CAAQC,GAAG,CAAC;AACxD9B,YAAAA,eAAAA,CAAgB+B,KAAK,EAAA;YACrB/B,eAAgBgC,CAAAA,mBAAmB,CAAC9B,QAAU,EAAA;gBAC5ClB,QAAU,EAAA;AACZ,aAAA;AACD,SAAA,CAAA;AAED,QAAA,MAAMiD,cAAiBL,GAAAA,cAAAA,GAAiBA,cAAetC,CAAAA,MAAM,GAAG,EAAE;AAElE,QAAA,MAAM4C,IAAO,GAAA;AACXC,YAAAA,UAAAA,EAAYF,eAAeG,MAAM;AACjCT,YAAAA;AACF,SAAA;AAEA,QAAA,IAAI,CAAChB,aAAe,EAAA;AAClB/B,YAAAA,GAAAA,CAAIW,IAAI,GAAG;AACTC,gBAAAA,IAAAA,EAAM,EAAE;AACR0C,gBAAAA;AACF,aAAA;AAEA,YAAA;AACF;QAEA,MAAM1C,IAAAA,GAAOyC,eAAeI,MAAM,CAAC,CAACxC,KAAeA,GAAAA,KAAAA,CAAMD,EAAE,KAAK8B,aAAAA,CAAAA;AAChE9C,QAAAA,GAAAA,CAAIW,IAAI,GAAG;AACTC,YAAAA,IAAAA;AACA0C,YAAAA;AACF,SAAA;AACF;AACF,CAAE;;;;"}

package/dist/server/controllers/stages.mjs

@@ -0,0 +1,165 @@
+import { async } from '@strapi/utils';
+import { getService } from '../utils/index.mjs';
+import { validateLocale, validateUpdateStageOnEntity } from '../validation/review-workflows.mjs';
+import { ENTITY_STAGE_ATTRIBUTE, STAGE_TRANSITION_UID, STAGE_MODEL_UID } from '../constants/workflows.mjs';
+
+/**
+ *
+ * @param { Core.Strapi } strapi - Strapi instance
+ * @param userAbility
+ * @return { (Stage) => SanitizedStage }
+ */ function sanitizeStage({ strapi: strapi1 }, userAbility) {
+    const permissionChecker = strapi1.plugin('content-manager').service('permission-checker').create({
+        userAbility,
+        model: STAGE_MODEL_UID
+    });
+    return (entity)=>permissionChecker.sanitizeOutput(entity);
+}
+var stages = {
+    /**
+   * List all stages
+   * @param {import('koa').BaseContext} ctx - koa context
+   */ async find (ctx) {
+        const { workflow_id: workflowId } = ctx.params;
+        const { populate } = ctx.query;
+        const stagesService = getService('stages');
+        const sanitizer = sanitizeStage({
+            strapi
+        }, ctx.state.userAbility);
+        const stages = await stagesService.find({
+            workflowId,
+            populate
+        });
+        ctx.body = {
+            data: await async.map(stages, sanitizer)
+        };
+    },
+    /**
+   * Get one stage
+   * @param {import('koa').BaseContext} ctx - koa context
+   */ async findById (ctx) {
+        const { id, workflow_id: workflowId } = ctx.params;
+        const { populate } = ctx.query;
+        const stagesService = getService('stages');
+        const sanitizer = sanitizeStage({
+            strapi
+        }, ctx.state.userAbility);
+        const stage = await stagesService.findById(id, {
+            workflowId,
+            populate
+        });
+        ctx.body = {
+            data: await sanitizer(stage)
+        };
+    },
+    /**
+   * Updates an entity's stage.
+   * @async
+   * @param {Object} ctx - The Koa context object.
+   * @param {Object} ctx.params - An object containing the parameters from the request URL.
+   * @param {string} ctx.params.model_uid - The model UID of the entity.
+   * @param {string} ctx.params.id - The ID of the entity to update.
+   * @param {Object} ctx.request.body.data - Optional data object containing the new stage ID for the entity.
+   * @param {string} ctx.request.body.data.id - The ID of the new stage for the entity.
+   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.
+   * @throws {ValidationError} If the `data` object in the request body fails to pass validation.
+   * @returns {Promise<void>} A promise that resolves when the entity's stage has been updated.
+   */ async updateEntity (ctx) {
+        const stagesService = getService('stages');
+        const stagePermissions = getService('stage-permissions');
+        const workflowService = getService('workflows');
+        const { model_uid: modelUID, id: documentId } = ctx.params;
+        const { body, query = {} } = ctx.request;
+        const { sanitizeOutput } = strapi.plugin('content-manager').service('permission-checker').create({
+            userAbility: ctx.state.userAbility,
+            model: modelUID
+        });
+        // Load entity
+        const locale = await validateLocale(query?.locale);
+        const entity = await strapi.documents(modelUID).findOne({
+            documentId,
+            // @ts-expect-error - locale should be also null in the doc service types
+            locale,
+            populate: [
+                ENTITY_STAGE_ATTRIBUTE
+            ]
+        });
+        if (!entity) {
+            ctx.throw(404, 'Entity not found');
+        }
+        // Validate if entity stage can be updated
+        const canTransition = stagePermissions.can(STAGE_TRANSITION_UID, entity[ENTITY_STAGE_ATTRIBUTE]?.id);
+        if (!canTransition) {
+            ctx.throw(403, 'Forbidden stage transition');
+        }
+        const { id: stageId } = await validateUpdateStageOnEntity({
+            id: Number(body?.data?.id)
+        }, 'You should pass an id to the body of the put request.');
+        const workflow = await workflowService.assertContentTypeBelongsToWorkflow(modelUID);
+        workflowService.assertStageBelongsToWorkflow(stageId, workflow);
+        const updatedEntity = await stagesService.updateEntity(entity, modelUID, stageId);
+        ctx.body = {
+            data: await sanitizeOutput(updatedEntity)
+        };
+    },
+    /**
+   * List all the stages that are available for a user to transition an entity to.
+   * If the user has permission to change the current stage of the entity every other stage in the workflow is returned
+   * @async
+   * @param {*} ctx
+   * @param {string} ctx.params.model_uid - The model UID of the entity.
+   * @param {string} ctx.params.id - The ID of the entity.
+   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.
+   */ async listAvailableStages (ctx) {
+        const stagePermissions = getService('stage-permissions');
+        const workflowService = getService('workflows');
+        const { model_uid: modelUID, id: documentId } = ctx.params;
+        const { query = {} } = ctx.request;
+        if (strapi.plugin('content-manager').service('permission-checker').create({
+            userAbility: ctx.state.userAbility,
+            model: modelUID
+        }).cannot.read()) {
+            return ctx.forbidden();
+        }
+        // Load entity
+        const locale = await validateLocale(query?.locale) ?? undefined;
+        const entity = await strapi.documents(modelUID).findOne({
+            documentId,
+            locale,
+            populate: [
+                ENTITY_STAGE_ATTRIBUTE
+            ]
+        });
+        if (!entity) {
+            ctx.throw(404, 'Entity not found');
+        }
+        const entityStageId = entity[ENTITY_STAGE_ATTRIBUTE]?.id;
+        const canTransition = stagePermissions.can(STAGE_TRANSITION_UID, entityStageId);
+        const [workflowCount, workflowResult] = await Promise.all([
+            workflowService.count(),
+            workflowService.getAssignedWorkflow(modelUID, {
+                populate: 'stages'
+            })
+        ]);
+        const workflowStages = workflowResult ? workflowResult.stages : [];
+        const meta = {
+            stageCount: workflowStages.length,
+            workflowCount
+        };
+        if (!canTransition) {
+            ctx.body = {
+                data: [],
+                meta
+            };
+            return;
+        }
+        const data = workflowStages.filter((stage)=>stage.id !== entityStageId);
+        ctx.body = {
+            data,
+            meta
+        };
+    }
+};
+
+export { stages as default };
+//# sourceMappingURL=stages.mjs.map

package/dist/server/controllers/stages.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages.mjs","sources":["../../../server/src/controllers/stages.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport type { Core } from '@strapi/types';\n\nimport { async, validate } from '@strapi/utils';\nimport { getService } from '../utils';\nimport { validateUpdateStageOnEntity, validateLocale } from '../validation/review-workflows';\nimport {\n  STAGE_MODEL_UID,\n  ENTITY_STAGE_ATTRIBUTE,\n  STAGE_TRANSITION_UID,\n} from '../constants/workflows';\n\n/**\n *\n * @param { Core.Strapi } strapi - Strapi instance\n * @param userAbility\n * @return { (Stage) => SanitizedStage }\n */\nfunction sanitizeStage({ strapi }: { strapi: Core.Strapi }, userAbility: unknown) {\n  const permissionChecker = strapi\n    .plugin('content-manager')\n    .service('permission-checker')\n    .create({ userAbility, model: STAGE_MODEL_UID });\n\n  return (entity: unknown) => permissionChecker.sanitizeOutput(entity);\n}\n\nexport default {\n  /**\n   * List all stages\n   * @param {import('koa').BaseContext} ctx - koa context\n   */\n  async find(ctx: Context) {\n    const { workflow_id: workflowId } = ctx.params;\n    const { populate } = ctx.query;\n    const stagesService = getService('stages');\n    const sanitizer = sanitizeStage({ strapi }, ctx.state.userAbility);\n\n    const stages = await stagesService.find({\n      workflowId,\n      populate,\n    });\n\n    ctx.body = {\n      data: await async.map(stages, sanitizer),\n    };\n  },\n  /**\n   * Get one stage\n   * @param {import('koa').BaseContext} ctx - koa context\n   */\n  async findById(ctx: Context) {\n    const { id, workflow_id: workflowId } = ctx.params;\n    const { populate } = ctx.query;\n    const stagesService = getService('stages');\n    const sanitizer = sanitizeStage({ strapi }, ctx.state.userAbility);\n\n    const stage = await stagesService.findById(id, {\n      workflowId,\n      populate,\n    });\n\n    ctx.body = {\n      data: await sanitizer(stage),\n    };\n  },\n\n  /**\n   * Updates an entity's stage.\n   * @async\n   * @param {Object} ctx - The Koa context object.\n   * @param {Object} ctx.params - An object containing the parameters from the request URL.\n   * @param {string} ctx.params.model_uid - The model UID of the entity.\n   * @param {string} ctx.params.id - The ID of the entity to update.\n   * @param {Object} ctx.request.body.data - Optional data object containing the new stage ID for the entity.\n   * @param {string} ctx.request.body.data.id - The ID of the new stage for the entity.\n   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.\n   * @throws {ValidationError} If the `data` object in the request body fails to pass validation.\n   * @returns {Promise<void>} A promise that resolves when the entity's stage has been updated.\n   */\n  async updateEntity(ctx: Context) {\n    const stagesService = getService('stages');\n    const stagePermissions = getService('stage-permissions');\n    const workflowService = getService('workflows');\n\n    const { model_uid: modelUID, id: documentId } = ctx.params;\n    const { body, query = {} } = ctx.request;\n\n    const { sanitizeOutput } = strapi\n      .plugin('content-manager')\n      .service('permission-checker')\n      .create({ userAbility: ctx.state.userAbility, model: modelUID });\n\n    // Load entity\n    const locale = await validateLocale(query?.locale);\n    const entity = await strapi.documents(modelUID).findOne({\n      documentId,\n      // @ts-expect-error - locale should be also null in the doc service types\n      locale,\n      populate: [ENTITY_STAGE_ATTRIBUTE],\n    });\n\n    if (!entity) {\n      ctx.throw(404, 'Entity not found');\n    }\n\n    // Validate if entity stage can be updated\n    const canTransition = stagePermissions.can(\n      STAGE_TRANSITION_UID,\n      entity[ENTITY_STAGE_ATTRIBUTE]?.id\n    );\n\n    if (!canTransition) {\n      ctx.throw(403, 'Forbidden stage transition');\n    }\n\n    const { id: stageId } = await validateUpdateStageOnEntity(\n      { id: Number(body?.data?.id) },\n      'You should pass an id to the body of the put request.'\n    );\n\n    const workflow = await workflowService.assertContentTypeBelongsToWorkflow(modelUID);\n    workflowService.assertStageBelongsToWorkflow(stageId, workflow);\n\n    const updatedEntity = await stagesService.updateEntity(entity, modelUID, stageId);\n\n    ctx.body = { data: await sanitizeOutput(updatedEntity) };\n  },\n\n  /**\n   * List all the stages that are available for a user to transition an entity to.\n   * If the user has permission to change the current stage of the entity every other stage in the workflow is returned\n   * @async\n   * @param {*} ctx\n   * @param {string} ctx.params.model_uid - The model UID of the entity.\n   * @param {string} ctx.params.id - The ID of the entity.\n   * @throws {ApplicationError} If review workflows is not activated on the specified model UID.\n   */\n  async listAvailableStages(ctx: Context) {\n    const stagePermissions = getService('stage-permissions');\n    const workflowService = getService('workflows');\n\n    const { model_uid: modelUID, id: documentId } = ctx.params;\n    const { query = {} } = ctx.request;\n\n    if (\n      strapi\n        .plugin('content-manager')\n        .service('permission-checker')\n        .create({ userAbility: ctx.state.userAbility, model: modelUID })\n        .cannot.read()\n    ) {\n      return ctx.forbidden();\n    }\n\n    // Load entity\n    const locale = (await validateLocale(query?.locale)) ?? undefined;\n    const entity = await strapi.documents(modelUID).findOne({\n      documentId,\n      locale,\n      populate: [ENTITY_STAGE_ATTRIBUTE],\n    });\n\n    if (!entity) {\n      ctx.throw(404, 'Entity not found');\n    }\n\n    const entityStageId = entity[ENTITY_STAGE_ATTRIBUTE]?.id;\n    const canTransition = stagePermissions.can(STAGE_TRANSITION_UID, entityStageId);\n\n    const [workflowCount, workflowResult] = await Promise.all([\n      workflowService.count(),\n      workflowService.getAssignedWorkflow(modelUID, {\n        populate: 'stages',\n      }),\n    ]);\n\n    const workflowStages = workflowResult ? workflowResult.stages : [];\n\n    const meta = {\n      stageCount: workflowStages.length,\n      workflowCount,\n    };\n\n    if (!canTransition) {\n      ctx.body = {\n        data: [],\n        meta,\n      };\n\n      return;\n    }\n\n    const data = workflowStages.filter((stage: any) => stage.id !== entityStageId);\n    ctx.body = {\n      data,\n      meta,\n    };\n  },\n};\n"],"names":["sanitizeStage","strapi","userAbility","permissionChecker","plugin","service","create","model","STAGE_MODEL_UID","entity","sanitizeOutput","find","ctx","workflow_id","workflowId","params","populate","query","stagesService","getService","sanitizer","state","stages","body","data","async","map","findById","id","stage","updateEntity","stagePermissions","workflowService","model_uid","modelUID","documentId","request","locale","validateLocale","documents","findOne","ENTITY_STAGE_ATTRIBUTE","throw","canTransition","can","STAGE_TRANSITION_UID","stageId","validateUpdateStageOnEntity","Number","workflow","assertContentTypeBelongsToWorkflow","assertStageBelongsToWorkflow","updatedEntity","listAvailableStages","cannot","read","forbidden","undefined","entityStageId","workflowCount","workflowResult","Promise","all","count","getAssignedWorkflow","workflowStages","meta","stageCount","length","filter"],"mappings":";;;;;AAYA;;;;;AAKC,IACD,SAASA,aAAc,CAAA,EAAEC,QAAAA,OAAM,EAA2B,EAAEC,WAAoB,EAAA;IAC9E,MAAMC,iBAAAA,GAAoBF,QACvBG,MAAM,CAAC,mBACPC,OAAO,CAAC,oBACRC,CAAAA,CAAAA,MAAM,CAAC;AAAEJ,QAAAA,WAAAA;QAAaK,KAAOC,EAAAA;AAAgB,KAAA,CAAA;AAEhD,IAAA,OAAO,CAACC,MAAAA,GAAoBN,iBAAkBO,CAAAA,cAAc,CAACD,MAAAA,CAAAA;AAC/D;AAEA,aAAe;AACb;;;MAIA,MAAME,MAAKC,GAAY,EAAA;AACrB,QAAA,MAAM,EAAEC,WAAaC,EAAAA,UAAU,EAAE,GAAGF,IAAIG,MAAM;AAC9C,QAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGJ,IAAIK,KAAK;AAC9B,QAAA,MAAMC,gBAAgBC,UAAW,CAAA,QAAA,CAAA;AACjC,QAAA,MAAMC,YAAYpB,aAAc,CAAA;AAAEC,YAAAA;SAAUW,EAAAA,GAAAA,CAAIS,KAAK,CAACnB,WAAW,CAAA;AAEjE,QAAA,MAAMoB,MAAS,GAAA,MAAMJ,aAAcP,CAAAA,IAAI,CAAC;AACtCG,YAAAA,UAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEAJ,QAAAA,GAAAA,CAAIW,IAAI,GAAG;AACTC,YAAAA,IAAAA,EAAM,MAAMC,KAAAA,CAAMC,GAAG,CAACJ,MAAQF,EAAAA,SAAAA;AAChC,SAAA;AACF,KAAA;AACA;;;MAIA,MAAMO,UAASf,GAAY,EAAA;QACzB,MAAM,EAAEgB,EAAE,EAAEf,WAAAA,EAAaC,UAAU,EAAE,GAAGF,IAAIG,MAAM;AAClD,QAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGJ,IAAIK,KAAK;AAC9B,QAAA,MAAMC,gBAAgBC,UAAW,CAAA,QAAA,CAAA;AACjC,QAAA,MAAMC,YAAYpB,aAAc,CAAA;AAAEC,YAAAA;SAAUW,EAAAA,GAAAA,CAAIS,KAAK,CAACnB,WAAW,CAAA;AAEjE,QAAA,MAAM2B,KAAQ,GAAA,MAAMX,aAAcS,CAAAA,QAAQ,CAACC,EAAI,EAAA;AAC7Cd,YAAAA,UAAAA;AACAE,YAAAA;AACF,SAAA,CAAA;AAEAJ,QAAAA,GAAAA,CAAIW,IAAI,GAAG;AACTC,YAAAA,IAAAA,EAAM,MAAMJ,SAAUS,CAAAA,KAAAA;AACxB,SAAA;AACF,KAAA;AAEA;;;;;;;;;;;;MAaA,MAAMC,cAAalB,GAAY,EAAA;AAC7B,QAAA,MAAMM,gBAAgBC,UAAW,CAAA,QAAA,CAAA;AACjC,QAAA,MAAMY,mBAAmBZ,UAAW,CAAA,mBAAA,CAAA;AACpC,QAAA,MAAMa,kBAAkBb,UAAW,CAAA,WAAA,CAAA;QAEnC,MAAM,EAAEc,WAAWC,QAAQ,EAAEN,IAAIO,UAAU,EAAE,GAAGvB,GAAAA,CAAIG,MAAM;QAC1D,MAAM,EAAEQ,IAAI,EAAEN,KAAAA,GAAQ,EAAE,EAAE,GAAGL,GAAAA,CAAIwB,OAAO;AAExC,QAAA,MAAM,EAAE1B,cAAc,EAAE,GAAGT,MACxBG,CAAAA,MAAM,CAAC,iBAAA,CAAA,CACPC,OAAO,CAAC,oBACRC,CAAAA,CAAAA,MAAM,CAAC;YAAEJ,WAAaU,EAAAA,GAAAA,CAAIS,KAAK,CAACnB,WAAW;YAAEK,KAAO2B,EAAAA;AAAS,SAAA,CAAA;;QAGhE,MAAMG,MAAAA,GAAS,MAAMC,cAAAA,CAAerB,KAAOoB,EAAAA,MAAAA,CAAAA;AAC3C,QAAA,MAAM5B,SAAS,MAAMR,MAAAA,CAAOsC,SAAS,CAACL,QAAAA,CAAAA,CAAUM,OAAO,CAAC;AACtDL,YAAAA,UAAAA;;AAEAE,YAAAA,MAAAA;YACArB,QAAU,EAAA;AAACyB,gBAAAA;AAAuB;AACpC,SAAA,CAAA;AAEA,QAAA,IAAI,CAAChC,MAAQ,EAAA;YACXG,GAAI8B,CAAAA,KAAK,CAAC,GAAK,EAAA,kBAAA,CAAA;AACjB;;QAGA,MAAMC,aAAAA,GAAgBZ,iBAAiBa,GAAG,CACxCC,sBACApC,MAAM,CAACgC,uBAAuB,EAAEb,EAAAA,CAAAA;AAGlC,QAAA,IAAI,CAACe,aAAe,EAAA;YAClB/B,GAAI8B,CAAAA,KAAK,CAAC,GAAK,EAAA,4BAAA,CAAA;AACjB;AAEA,QAAA,MAAM,EAAEd,EAAIkB,EAAAA,OAAO,EAAE,GAAG,MAAMC,2BAC5B,CAAA;YAAEnB,EAAIoB,EAAAA,MAAAA,CAAOzB,MAAMC,IAAMI,EAAAA,EAAAA;SACzB,EAAA,uDAAA,CAAA;AAGF,QAAA,MAAMqB,QAAW,GAAA,MAAMjB,eAAgBkB,CAAAA,kCAAkC,CAAChB,QAAAA,CAAAA;QAC1EF,eAAgBmB,CAAAA,4BAA4B,CAACL,OAASG,EAAAA,QAAAA,CAAAA;AAEtD,QAAA,MAAMG,gBAAgB,MAAMlC,aAAAA,CAAcY,YAAY,CAACrB,QAAQyB,QAAUY,EAAAA,OAAAA,CAAAA;AAEzElC,QAAAA,GAAAA,CAAIW,IAAI,GAAG;AAAEC,YAAAA,IAAAA,EAAM,MAAMd,cAAe0C,CAAAA,aAAAA;AAAe,SAAA;AACzD,KAAA;AAEA;;;;;;;;MASA,MAAMC,qBAAoBzC,GAAY,EAAA;AACpC,QAAA,MAAMmB,mBAAmBZ,UAAW,CAAA,mBAAA,CAAA;AACpC,QAAA,MAAMa,kBAAkBb,UAAW,CAAA,WAAA,CAAA;QAEnC,MAAM,EAAEc,WAAWC,QAAQ,EAAEN,IAAIO,UAAU,EAAE,GAAGvB,GAAAA,CAAIG,MAAM;AAC1D,QAAA,MAAM,EAAEE,KAAQ,GAAA,EAAE,EAAE,GAAGL,IAAIwB,OAAO;QAElC,IACEnC,MAAAA,CACGG,MAAM,CAAC,iBAAA,CAAA,CACPC,OAAO,CAAC,oBAAA,CAAA,CACRC,MAAM,CAAC;YAAEJ,WAAaU,EAAAA,GAAAA,CAAIS,KAAK,CAACnB,WAAW;YAAEK,KAAO2B,EAAAA;SACpDoB,CAAAA,CAAAA,MAAM,CAACC,IAAI,EACd,EAAA;AACA,YAAA,OAAO3C,IAAI4C,SAAS,EAAA;AACtB;;AAGA,QAAA,MAAMnB,MAAS,GAAC,MAAMC,cAAAA,CAAerB,OAAOoB,MAAYoB,CAAAA,IAAAA,SAAAA;AACxD,QAAA,MAAMhD,SAAS,MAAMR,MAAAA,CAAOsC,SAAS,CAACL,QAAAA,CAAAA,CAAUM,OAAO,CAAC;AACtDL,YAAAA,UAAAA;AACAE,YAAAA,MAAAA;YACArB,QAAU,EAAA;AAACyB,gBAAAA;AAAuB;AACpC,SAAA,CAAA;AAEA,QAAA,IAAI,CAAChC,MAAQ,EAAA;YACXG,GAAI8B,CAAAA,KAAK,CAAC,GAAK,EAAA,kBAAA,CAAA;AACjB;AAEA,QAAA,MAAMgB,aAAgBjD,GAAAA,MAAM,CAACgC,sBAAAA,CAAuB,EAAEb,EAAAA;AACtD,QAAA,MAAMe,aAAgBZ,GAAAA,gBAAAA,CAAiBa,GAAG,CAACC,oBAAsBa,EAAAA,aAAAA,CAAAA;AAEjE,QAAA,MAAM,CAACC,aAAeC,EAAAA,cAAAA,CAAe,GAAG,MAAMC,OAAAA,CAAQC,GAAG,CAAC;AACxD9B,YAAAA,eAAAA,CAAgB+B,KAAK,EAAA;YACrB/B,eAAgBgC,CAAAA,mBAAmB,CAAC9B,QAAU,EAAA;gBAC5ClB,QAAU,EAAA;AACZ,aAAA;AACD,SAAA,CAAA;AAED,QAAA,MAAMiD,cAAiBL,GAAAA,cAAAA,GAAiBA,cAAetC,CAAAA,MAAM,GAAG,EAAE;AAElE,QAAA,MAAM4C,IAAO,GAAA;AACXC,YAAAA,UAAAA,EAAYF,eAAeG,MAAM;AACjCT,YAAAA;AACF,SAAA;AAEA,QAAA,IAAI,CAAChB,aAAe,EAAA;AAClB/B,YAAAA,GAAAA,CAAIW,IAAI,GAAG;AACTC,gBAAAA,IAAAA,EAAM,EAAE;AACR0C,gBAAAA;AACF,aAAA;AAEA,YAAA;AACF;QAEA,MAAM1C,IAAAA,GAAOyC,eAAeI,MAAM,CAAC,CAACxC,KAAeA,GAAAA,KAAAA,CAAMD,EAAE,KAAK8B,aAAAA,CAAAA;AAChE9C,QAAAA,GAAAA,CAAIW,IAAI,GAAG;AACTC,YAAAA,IAAAA;AACA0C,YAAAA;AACF,SAAA;AACF;AACF,CAAE;;;;"}