@strapi/upload 5.53.0 → 5.54.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (171) hide show
  1. package/dist/admin/future/components/UploadProgressDialog.js +9 -8
  2. package/dist/admin/future/components/UploadProgressDialog.js.map +1 -1
  3. package/dist/admin/future/components/UploadProgressDialog.mjs +9 -8
  4. package/dist/admin/future/components/UploadProgressDialog.mjs.map +1 -1
  5. package/dist/admin/future/pages/Assets/AssetsPage.js +0 -2
  6. package/dist/admin/future/pages/Assets/AssetsPage.js.map +1 -1
  7. package/dist/admin/future/pages/Assets/AssetsPage.mjs +0 -2
  8. package/dist/admin/future/pages/Assets/AssetsPage.mjs.map +1 -1
  9. package/dist/admin/future/pages/Assets/components/Dnd/AssetsDndProvider.js +7 -0
  10. package/dist/admin/future/pages/Assets/components/Dnd/AssetsDndProvider.js.map +1 -1
  11. package/dist/admin/future/pages/Assets/components/Dnd/AssetsDndProvider.mjs +7 -0
  12. package/dist/admin/future/pages/Assets/components/Dnd/AssetsDndProvider.mjs.map +1 -1
  13. package/dist/admin/future/pages/Assets/components/Dnd/DragOverlayChip.js +4 -1
  14. package/dist/admin/future/pages/Assets/components/Dnd/DragOverlayChip.js.map +1 -1
  15. package/dist/admin/future/pages/Assets/components/Dnd/DragOverlayChip.mjs +4 -1
  16. package/dist/admin/future/pages/Assets/components/Dnd/DragOverlayChip.mjs.map +1 -1
  17. package/dist/admin/future/services/api.js +17 -0
  18. package/dist/admin/future/services/api.js.map +1 -1
  19. package/dist/admin/future/services/api.mjs +18 -1
  20. package/dist/admin/future/services/api.mjs.map +1 -1
  21. package/dist/admin/future/store/uploadProgress.js +31 -22
  22. package/dist/admin/future/store/uploadProgress.js.map +1 -1
  23. package/dist/admin/future/store/uploadProgress.mjs +31 -22
  24. package/dist/admin/future/store/uploadProgress.mjs.map +1 -1
  25. package/dist/admin/index.js +11 -10
  26. package/dist/admin/index.js.map +1 -1
  27. package/dist/admin/index.mjs +11 -10
  28. package/dist/admin/index.mjs.map +1 -1
  29. package/dist/admin/src/future/store/uploadProgress.d.ts +14 -20
  30. package/dist/admin/translations/en.json.js +0 -3
  31. package/dist/admin/translations/en.json.js.map +1 -1
  32. package/dist/admin/translations/en.json.mjs +0 -3
  33. package/dist/admin/translations/en.json.mjs.map +1 -1
  34. package/dist/server/bootstrap.js +11 -0
  35. package/dist/server/bootstrap.js.map +1 -1
  36. package/dist/server/bootstrap.mjs +11 -0
  37. package/dist/server/bootstrap.mjs.map +1 -1
  38. package/dist/server/controllers/admin-upload.js +31 -1
  39. package/dist/server/controllers/admin-upload.js.map +1 -1
  40. package/dist/server/controllers/admin-upload.mjs +31 -1
  41. package/dist/server/controllers/admin-upload.mjs.map +1 -1
  42. package/dist/server/controllers/utils/find-entity-and-check-permissions.js +15 -4
  43. package/dist/server/controllers/utils/find-entity-and-check-permissions.js.map +1 -1
  44. package/dist/server/controllers/utils/find-entity-and-check-permissions.mjs +15 -4
  45. package/dist/server/controllers/utils/find-entity-and-check-permissions.mjs.map +1 -1
  46. package/dist/server/controllers/utils/folders.js +1 -1
  47. package/dist/server/controllers/utils/folders.js.map +1 -1
  48. package/dist/server/controllers/utils/folders.mjs +1 -1
  49. package/dist/server/controllers/utils/folders.mjs.map +1 -1
  50. package/dist/server/mcp/ambient-instance.js +46 -0
  51. package/dist/server/mcp/ambient-instance.js.map +1 -0
  52. package/dist/server/mcp/ambient-instance.mjs +43 -0
  53. package/dist/server/mcp/ambient-instance.mjs.map +1 -0
  54. package/dist/server/mcp/handlers/constants.js +60 -0
  55. package/dist/server/mcp/handlers/constants.js.map +1 -0
  56. package/dist/server/mcp/handlers/constants.mjs +45 -0
  57. package/dist/server/mcp/handlers/constants.mjs.map +1 -0
  58. package/dist/server/mcp/handlers/folder-handlers.js +308 -0
  59. package/dist/server/mcp/handlers/folder-handlers.js.map +1 -0
  60. package/dist/server/mcp/handlers/folder-handlers.mjs +303 -0
  61. package/dist/server/mcp/handlers/folder-handlers.mjs.map +1 -0
  62. package/dist/server/mcp/handlers/read-handlers.js +134 -0
  63. package/dist/server/mcp/handlers/read-handlers.js.map +1 -0
  64. package/dist/server/mcp/handlers/read-handlers.mjs +130 -0
  65. package/dist/server/mcp/handlers/read-handlers.mjs.map +1 -0
  66. package/dist/server/mcp/handlers/write-handlers.js +315 -0
  67. package/dist/server/mcp/handlers/write-handlers.js.map +1 -0
  68. package/dist/server/mcp/handlers/write-handlers.mjs +311 -0
  69. package/dist/server/mcp/handlers/write-handlers.mjs.map +1 -0
  70. package/dist/server/mcp/permissions.js +36 -0
  71. package/dist/server/mcp/permissions.js.map +1 -0
  72. package/dist/server/mcp/permissions.mjs +33 -0
  73. package/dist/server/mcp/permissions.mjs.map +1 -0
  74. package/dist/server/mcp/register-upload-mcp-tools.js +235 -0
  75. package/dist/server/mcp/register-upload-mcp-tools.js.map +1 -0
  76. package/dist/server/mcp/register-upload-mcp-tools.mjs +232 -0
  77. package/dist/server/mcp/register-upload-mcp-tools.mjs.map +1 -0
  78. package/dist/server/mcp/sanitizers/sanitize-media.js +97 -0
  79. package/dist/server/mcp/sanitizers/sanitize-media.js.map +1 -0
  80. package/dist/server/mcp/sanitizers/sanitize-media.mjs +93 -0
  81. package/dist/server/mcp/sanitizers/sanitize-media.mjs.map +1 -0
  82. package/dist/server/mcp/schemas/input-schemas.js +206 -0
  83. package/dist/server/mcp/schemas/input-schemas.js.map +1 -0
  84. package/dist/server/mcp/schemas/input-schemas.mjs +190 -0
  85. package/dist/server/mcp/schemas/input-schemas.mjs.map +1 -0
  86. package/dist/server/mcp/schemas/output-schemas.js +158 -0
  87. package/dist/server/mcp/schemas/output-schemas.js.map +1 -0
  88. package/dist/server/mcp/schemas/output-schemas.mjs +142 -0
  89. package/dist/server/mcp/schemas/output-schemas.mjs.map +1 -0
  90. package/dist/server/mcp/utils.js +14 -0
  91. package/dist/server/mcp/utils.js.map +1 -0
  92. package/dist/server/mcp/utils.mjs +12 -0
  93. package/dist/server/mcp/utils.mjs.map +1 -0
  94. package/dist/server/media-library-default-notice.js +42 -0
  95. package/dist/server/media-library-default-notice.js.map +1 -0
  96. package/dist/server/media-library-default-notice.mjs +40 -0
  97. package/dist/server/media-library-default-notice.mjs.map +1 -0
  98. package/dist/server/register.js +5 -0
  99. package/dist/server/register.js.map +1 -1
  100. package/dist/server/register.mjs +5 -0
  101. package/dist/server/register.mjs.map +1 -1
  102. package/dist/server/services/folder.js.map +1 -1
  103. package/dist/server/services/folder.mjs.map +1 -1
  104. package/dist/server/services/upload.js +14 -2
  105. package/dist/server/services/upload.js.map +1 -1
  106. package/dist/server/services/upload.mjs +14 -2
  107. package/dist/server/services/upload.mjs.map +1 -1
  108. package/dist/server/src/bootstrap.d.ts.map +1 -1
  109. package/dist/server/src/controllers/admin-upload.d.ts +1 -0
  110. package/dist/server/src/controllers/admin-upload.d.ts.map +1 -1
  111. package/dist/server/src/controllers/utils/find-entity-and-check-permissions.d.ts +14 -1
  112. package/dist/server/src/controllers/utils/find-entity-and-check-permissions.d.ts.map +1 -1
  113. package/dist/server/src/controllers/utils/folders.d.ts +2 -1
  114. package/dist/server/src/controllers/utils/folders.d.ts.map +1 -1
  115. package/dist/server/src/index.d.ts +8 -2
  116. package/dist/server/src/index.d.ts.map +1 -1
  117. package/dist/server/src/mcp/ambient-instance.d.ts +65 -0
  118. package/dist/server/src/mcp/ambient-instance.d.ts.map +1 -0
  119. package/dist/server/src/mcp/handlers/constants.d.ts +48 -0
  120. package/dist/server/src/mcp/handlers/constants.d.ts.map +1 -0
  121. package/dist/server/src/mcp/handlers/folder-handlers.d.ts +49 -0
  122. package/dist/server/src/mcp/handlers/folder-handlers.d.ts.map +1 -0
  123. package/dist/server/src/mcp/handlers/index.d.ts +5 -0
  124. package/dist/server/src/mcp/handlers/index.d.ts.map +1 -0
  125. package/dist/server/src/mcp/handlers/read-handlers.d.ts +35 -0
  126. package/dist/server/src/mcp/handlers/read-handlers.d.ts.map +1 -0
  127. package/dist/server/src/mcp/handlers/write-handlers.d.ts +66 -0
  128. package/dist/server/src/mcp/handlers/write-handlers.d.ts.map +1 -0
  129. package/dist/server/src/mcp/index.d.ts +3 -0
  130. package/dist/server/src/mcp/index.d.ts.map +1 -0
  131. package/dist/server/src/mcp/permissions.d.ts +22 -0
  132. package/dist/server/src/mcp/permissions.d.ts.map +1 -0
  133. package/dist/server/src/mcp/register-upload-mcp-tools.d.ts +29 -0
  134. package/dist/server/src/mcp/register-upload-mcp-tools.d.ts.map +1 -0
  135. package/dist/server/src/mcp/sanitizers/sanitize-media.d.ts +63 -0
  136. package/dist/server/src/mcp/sanitizers/sanitize-media.d.ts.map +1 -0
  137. package/dist/server/src/mcp/schemas/index.d.ts +3 -0
  138. package/dist/server/src/mcp/schemas/index.d.ts.map +1 -0
  139. package/dist/server/src/mcp/schemas/input-schemas.d.ts +148 -0
  140. package/dist/server/src/mcp/schemas/input-schemas.d.ts.map +1 -0
  141. package/dist/server/src/mcp/schemas/output-schemas.d.ts +276 -0
  142. package/dist/server/src/mcp/schemas/output-schemas.d.ts.map +1 -0
  143. package/dist/server/src/mcp/types.d.ts +19 -0
  144. package/dist/server/src/mcp/types.d.ts.map +1 -0
  145. package/dist/server/src/mcp/utils.d.ts +4 -0
  146. package/dist/server/src/mcp/utils.d.ts.map +1 -0
  147. package/dist/server/src/media-library-default-notice.d.ts +19 -0
  148. package/dist/server/src/media-library-default-notice.d.ts.map +1 -0
  149. package/dist/server/src/register.d.ts.map +1 -1
  150. package/dist/server/src/services/folder.d.ts +6 -2
  151. package/dist/server/src/services/folder.d.ts.map +1 -1
  152. package/dist/server/src/services/index.d.ts +8 -2
  153. package/dist/server/src/services/index.d.ts.map +1 -1
  154. package/dist/server/src/services/upload.d.ts +8 -1
  155. package/dist/server/src/services/upload.d.ts.map +1 -1
  156. package/dist/server/src/types.d.ts +2 -2
  157. package/dist/server/src/types.d.ts.map +1 -1
  158. package/dist/server/src/utils/index.d.ts +2 -1
  159. package/dist/server/src/utils/index.d.ts.map +1 -1
  160. package/dist/server/utils/index.js +2 -2
  161. package/dist/server/utils/index.js.map +1 -1
  162. package/dist/server/utils/index.mjs +2 -2
  163. package/dist/server/utils/index.mjs.map +1 -1
  164. package/dist/shared/contracts/files.d.ts +22 -0
  165. package/dist/shared/contracts/files.d.ts.map +1 -1
  166. package/package.json +7 -6
  167. package/dist/admin/future/components/BetaNotice.js +0 -72
  168. package/dist/admin/future/components/BetaNotice.js.map +0 -1
  169. package/dist/admin/future/components/BetaNotice.mjs +0 -70
  170. package/dist/admin/future/components/BetaNotice.mjs.map +0 -1
  171. package/dist/admin/src/future/components/BetaNotice.d.ts +0 -11
@@ -18,6 +18,13 @@ var path__default = /*#__PURE__*/_interopDefault(path);
18
18
  var fse__default = /*#__PURE__*/_interopDefault(fse);
19
19
  var ___default = /*#__PURE__*/_interopDefault(_);
20
20
 
21
+ /**
22
+ * Minimum delay between two `file:progress` frames for the same URL.
23
+ *
24
+ * `fetchUrlToInputFile` reports once per streamed chunk (~8000 calls for a 512MB file at
25
+ * 64KB chunks); at ~5 frames a second a 10s transfer costs ~50 frames, which is plenty for
26
+ * a bar the user watches.
27
+ */ const URL_FETCH_PROGRESS_INTERVAL_MS = 200;
21
28
  var adminUpload = {
22
29
  async bulkUpdateFileInfo (ctx) {
23
30
  const { state: { userAbility, user }, request: { body } } = ctx;
@@ -249,6 +256,7 @@ var adminUpload = {
249
256
  * Accepts JSON body with URLs and fetches them server-side.
250
257
  * Streams Server-Sent Events as each URL is fetched and uploaded:
251
258
  * - file:fetching — when starting to fetch a URL
259
+ * - file:progress — throttled byte progress of the remote → server temp file transfer
252
260
  * - file:uploading — when upload starts for a fetched file
253
261
  * - file:complete — when a file is successfully uploaded
254
262
  * - file:error — when a URL fetch or upload fails
@@ -300,8 +308,30 @@ var adminUpload = {
300
308
  total
301
309
  });
302
310
  try {
311
+ // `fetchUrlToInputFile` reports raw, unthrottled progress — coalescing it into a
312
+ // sane frame rate is the caller's job. State is per URL: the loop is sequential.
313
+ let lastProgressAt = 0;
314
+ let hasAnnouncedSize = false;
315
+ let hasReachedTotal = false;
316
+ const onFetchProgress = ({ bytesWritten, totalBytes })=>{
317
+ // The frame that reaches the total always goes out, or a throttled last chunk
318
+ // leaves the row short of 100% until `file:complete`.
319
+ const isFinal = !hasReachedTotal && totalBytes !== null && bytesWritten >= totalBytes;
320
+ if (hasAnnouncedSize && !isFinal && Date.now() - lastProgressAt < URL_FETCH_PROGRESS_INTERVAL_MS) {
321
+ return;
322
+ }
323
+ hasAnnouncedSize = true;
324
+ hasReachedTotal = hasReachedTotal || isFinal;
325
+ lastProgressAt = Date.now();
326
+ writeSSE('file:progress', {
327
+ index: i,
328
+ loadedBytes: bytesWritten,
329
+ totalBytes,
330
+ phase: 'fetch'
331
+ });
332
+ };
303
333
  // Fetch URL to temp file
304
- const { file } = await fileService.fetchUrlToInputFile(url, tmpWorkingDirectory, sizeLimit);
334
+ const { file } = await fileService.fetchUrlToInputFile(url, tmpWorkingDirectory, sizeLimit, onFetchProgress);
305
335
  const fileName = file.originalFilename;
306
336
  writeSSE('file:uploading', {
307
337
  name: fileName,
@@ -1 +1 @@
1
- {"version":3,"file":"admin-upload.js","sources":["../../../server/src/controllers/admin-upload.ts"],"sourcesContent":["import os from 'os';\nimport path from 'path';\nimport fse from 'fs-extra';\nimport _ from 'lodash';\nimport { errors, async } from '@strapi/utils';\n\nimport type { Context } from 'koa';\n\nimport { getService } from '../utils';\nimport { ACTIONS, FILE_MODEL_UID } from '../constants';\nimport { validateBulkUpdateBody, validateUploadBody } from './validation/admin/upload';\nimport { findEntityAndCheckPermissions } from './utils/find-entity-and-check-permissions';\nimport { Config, FileInfo } from '../types';\nimport { prepareUploadRequest, type FileUploadError } from '../utils/mime-validation';\nimport type { UploadFileInfo } from '../../../shared/contracts/files';\n\nexport default {\n async bulkUpdateFileInfo(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const { updates } = await validateBulkUpdateBody(body);\n const uploadService = getService('upload');\n\n const results = await async.map(\n updates,\n async ({ id, fileInfo }: { id: number; fileInfo: FileInfo }) => {\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n const updated = await uploadService.updateFileInfo(id, fileInfo as any, { user });\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(updated);\n\n return pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n }\n );\n\n ctx.body = results;\n },\n\n /**\n * `PUT /upload/files/:id`\n *\n * Update the editable metadata (`fileInfo`) of an existing file. Also reached\n * through the `POST /upload` multiplexer, which delegates here with the id in\n * `ctx.query` — hence the dual read below, route params winning.\n */\n async updateFileInfo(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const id = ctx.params?.id ?? ctx.query.id;\n\n if (typeof id !== 'string') {\n throw new errors.ValidationError('File id is required');\n }\n\n const uploadService = getService('upload');\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n const data = await validateUploadBody(body);\n\n const file = await uploadService.updateFileInfo(id, data.fileInfo as any, { user });\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(file);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n },\n\n /**\n * `POST /upload/files/:id/replace`\n *\n * Replace the binary content of an existing file. Also reached through the\n * `POST /upload` multiplexer, which delegates here with the id in `ctx.query`\n * — hence the dual read below, route params winning.\n */\n async replaceFile(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files: filesInput } = {} },\n } = ctx;\n\n const id = ctx.params?.id ?? ctx.query.id;\n\n if (typeof id !== 'string') {\n throw new errors.ValidationError('File id is required');\n }\n\n const uploadService = getService('upload');\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n if (Array.isArray(filesInput) && filesInput.length > 1) {\n throw new errors.ApplicationError('Cannot replace a file with multiple ones');\n }\n\n const files = Array.isArray(filesInput) ? filesInput[0] : filesInput;\n\n const {\n validFiles,\n filteredBody,\n errors: validationErrors,\n } = await prepareUploadRequest(files, body, strapi);\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0].message);\n }\n\n const data = (await validateUploadBody(filteredBody)) as { fileInfo: FileInfo };\n const replacedFile = await uploadService.replace(id, { data, file: validFiles[0] }, { user });\n\n // Regenerate AI metadata for image replacements so the alt text / caption\n // reflect the new file content. Mirrors the post-upload hook in\n // `uploadFiles`; failure is logged and swallowed to keep the replace flow\n // resilient when the AI provider is unavailable.\n const aiMetadataService = getService('aiMetadata');\n if (replacedFile?.mime?.startsWith('image/') && (await aiMetadataService.isEnabled())) {\n try {\n const metadataResults = await aiMetadataService.processFiles([replacedFile]);\n await aiMetadataService.updateFilesWithAIMetadata([replacedFile], metadataResults, user);\n } catch (error) {\n strapi.log.warn('AI metadata generation failed on replace, proceeding without it', {\n error: error instanceof Error ? error.message : String(error),\n });\n }\n }\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(replacedFile);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n },\n\n async uploadFiles(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files } = {} },\n } = ctx;\n\n const uploadService = getService('upload');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n const {\n validFiles,\n filteredBody,\n errors: validationErrors,\n } = await prepareUploadRequest(files, body, strapi);\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0].message);\n }\n\n const isMultipleFiles = validFiles.length > 1;\n const data = await validateUploadBody(filteredBody, isMultipleFiles);\n\n let filesArray = validFiles;\n\n if (\n data.fileInfo &&\n Array.isArray(data.fileInfo) &&\n filesArray.length === data.fileInfo.length\n ) {\n // Reorder filesArray to match data.fileInfo order\n const alignedFilesArray = data.fileInfo\n .map((info) => {\n return filesArray.find((file) => file.originalFilename === info.name);\n })\n .filter(Boolean) as any[];\n\n filesArray = alignedFilesArray;\n }\n\n // Upload files first to get thumbnails\n const uploadedFiles = await uploadService.upload({ data, files: filesArray }, { user });\n if (uploadedFiles.some((file) => file.mime?.startsWith('image/'))) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n const aiMetadataService = getService('aiMetadata');\n\n // AFTER upload - generate AI metadata for images\n if (await aiMetadataService.isEnabled()) {\n try {\n const metadataResults = await aiMetadataService.processFiles(uploadedFiles);\n // Update the uploaded files with AI metadata\n await aiMetadataService.updateFilesWithAIMetadata(uploadedFiles, metadataResults, user);\n } catch (error) {\n strapi.log.warn('AI metadata generation failed, proceeding without AI enhancements', {\n error: error instanceof Error ? error.message : String(error),\n });\n }\n }\n\n // Sign file urls for private providers\n const signedFiles = await async.map(uploadedFiles, getService('file').signFileUrls);\n\n ctx.body = await pm.sanitizeOutput(signedFiles, { action: ACTIONS.read });\n ctx.status = 201;\n },\n\n /**\n * `POST /upload/files`\n *\n * Upload a single file and return the created File.\n *\n * Accepts one file per request (multipart `files` + `fileInfo`) and returns a\n * single `File` object. Unlike `uploadFiles`, it does **not** run AI metadata\n * generation inline — that responsibility is decoupled and will be handled by a\n * background job. Auth and permission checks mirror `POST /upload`.\n */\n async uploadFile(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files } = {} },\n } = ctx;\n\n const uploadService = getService('upload');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n if (_.isEmpty(files) || (!Array.isArray(files) && files.size === 0)) {\n throw new errors.ApplicationError('Files are empty');\n }\n\n // Accept a single file per request; ignore any extras defensively.\n const file = Array.isArray(files) ? files[0] : files;\n const fileName = file.originalFilename || 'unknown';\n\n // Parse the single fileInfo object from the multipart body.\n let fileInfo: UploadFileInfo = {\n name: fileName,\n caption: null,\n alternativeText: null,\n folder: null,\n };\n if (body?.fileInfo) {\n const raw = body.fileInfo;\n if (typeof raw === 'string') {\n fileInfo = JSON.parse(raw);\n } else if (Array.isArray(raw)) {\n fileInfo = (typeof raw[0] === 'string' ? JSON.parse(raw[0]) : raw[0]) as UploadFileInfo;\n } else {\n fileInfo = raw as UploadFileInfo;\n }\n }\n\n // Validate this single file using security checks.\n const { validFiles, errors: validationErrors } = await prepareUploadRequest(\n file,\n { fileInfo: JSON.stringify(fileInfo) },\n strapi\n );\n\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0]?.message || 'Validation failed');\n }\n\n const data = await validateUploadBody({ fileInfo }, false);\n const [uploadedFile] = await uploadService.upload({ data, files: [validFiles[0]] }, { user });\n\n if (uploadedFile.mime?.startsWith('image/')) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n // No inline AI metadata generation — intentionally decoupled for the async job.\n\n // Sign file url for private providers.\n const signedFile = await getService('file').signFileUrls(uploadedFile);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n ctx.status = 201;\n },\n\n /**\n * `POST /upload/actions/upload-from-urls`\n *\n * Upload files from URLs with SSE streaming for per-file progress\n *\n * Accepts JSON body with URLs and fetches them server-side.\n * Streams Server-Sent Events as each URL is fetched and uploaded:\n * - file:fetching — when starting to fetch a URL\n * - file:uploading — when upload starts for a fetched file\n * - file:complete — when a file is successfully uploaded\n * - file:error — when a URL fetch or upload fails\n * - stream:complete — final summary with all results\n */\n async uploadFromUrls(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const uploadService = getService('upload');\n const fileService = getService('file');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n // Parse and validate request body\n const { urls, folderId } = body as { urls?: string[]; folderId?: number | null };\n\n if (!urls || !Array.isArray(urls) || urls.length === 0) {\n throw new errors.ApplicationError('URLs are required');\n }\n\n if (urls.length > 20) {\n throw new errors.ApplicationError('Maximum 20 URLs allowed per request');\n }\n\n // Take manual control of the response for SSE streaming\n ctx.respond = false;\n const res = ctx.res;\n res.writeHead(200, {\n 'Content-Type': 'text/event-stream',\n 'Cache-Control': 'no-cache',\n Connection: 'keep-alive',\n });\n\n const writeSSE = (event: string, data: Record<string, unknown>) => {\n res.write(`event: ${event}\\ndata: ${JSON.stringify(data)}\\n\\n`);\n };\n\n const total = urls.length;\n const uploadErrors: FileUploadError[] = [];\n const successfulFiles: any[] = [];\n\n // Create temp directory for fetched files\n const tmpWorkingDirectory = await fse.mkdtemp(path.join(os.tmpdir(), 'strapi-url-upload-'));\n const { sizeLimit } = strapi.config.get<Config>('plugin::upload');\n\n try {\n // Process each URL sequentially\n for (let i = 0; i < urls.length; i += 1) {\n const url = urls[i];\n\n writeSSE('file:fetching', { url, index: i, total });\n\n try {\n // Fetch URL to temp file\n const { file } = await fileService.fetchUrlToInputFile(\n url,\n tmpWorkingDirectory,\n sizeLimit\n );\n const fileName = file.originalFilename;\n\n writeSSE('file:uploading', {\n name: fileName,\n index: i,\n total,\n size: file.size,\n });\n\n // Validate using security checks\n const fileInfo: UploadFileInfo = {\n name: fileName,\n caption: null,\n alternativeText: null,\n folder: folderId ?? null,\n };\n\n const { validFiles, errors: validationErrors } = await prepareUploadRequest(\n file,\n { fileInfo: JSON.stringify(fileInfo) },\n strapi\n );\n\n if (validFiles.length === 0) {\n const errorMessage = validationErrors[0]?.message || 'Validation failed';\n uploadErrors.push({ name: fileName, message: errorMessage });\n writeSSE('file:error', { name: fileName, url, index: i, message: errorMessage });\n } else {\n // Upload the file\n const data = await validateUploadBody({ fileInfo }, false);\n const [uploadedFile] = await uploadService.upload(\n { data, files: [validFiles[0]] },\n { user }\n );\n\n // Sign file url\n const signedFile = await fileService.signFileUrls(uploadedFile);\n successfulFiles.push(signedFile);\n\n writeSSE('file:complete', { name: fileName, index: i, file: signedFile });\n }\n } catch (error) {\n const errorMessage = error instanceof Error ? error.message : String(error);\n uploadErrors.push({ name: url, message: errorMessage });\n writeSSE('file:error', { url, index: i, message: errorMessage });\n }\n }\n\n // Track image upload metric once if any images were uploaded\n if (successfulFiles.some((file) => file.mime?.startsWith('image/'))) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n // Send final stream summary\n writeSSE('stream:complete', {\n data: await pm.sanitizeOutput(successfulFiles, { action: ACTIONS.read }),\n errors: uploadErrors,\n });\n } finally {\n // Clean up temp directory\n await fse.remove(tmpWorkingDirectory);\n }\n\n res.end();\n },\n\n // TODO: split into multiple endpoints\n async upload(ctx: Context) {\n const {\n query: { id },\n request: { files: { files } = {} },\n } = ctx;\n\n if (_.isEmpty(files) || (!Array.isArray(files) && files.size === 0)) {\n if (id) {\n return this.updateFileInfo(ctx);\n }\n\n throw new errors.ApplicationError('Files are empty');\n }\n\n await (id ? this.replaceFile : this.uploadFiles)(ctx);\n },\n};\n"],"names":["bulkUpdateFileInfo","ctx","state","userAbility","user","request","body","updates","validateBulkUpdateBody","uploadService","getService","results","async","map","id","fileInfo","pm","findEntityAndCheckPermissions","ACTIONS","update","FILE_MODEL_UID","updated","updateFileInfo","signedFile","signFileUrls","sanitizeOutput","action","read","params","query","errors","ValidationError","data","validateUploadBody","file","replaceFile","files","filesInput","Array","isArray","length","ApplicationError","validFiles","filteredBody","validationErrors","prepareUploadRequest","strapi","message","replacedFile","replace","aiMetadataService","mime","startsWith","isEnabled","metadataResults","processFiles","updateFilesWithAIMetadata","error","log","warn","Error","String","uploadFiles","service","createPermissionsManager","ability","create","model","isAllowed","forbidden","isMultipleFiles","filesArray","alignedFilesArray","info","find","originalFilename","name","filter","Boolean","uploadedFiles","upload","some","trackUsage","signedFiles","status","uploadFile","_","isEmpty","size","fileName","caption","alternativeText","folder","raw","JSON","parse","stringify","uploadedFile","uploadFromUrls","fileService","urls","folderId","respond","res","writeHead","Connection","writeSSE","event","write","total","uploadErrors","successfulFiles","tmpWorkingDirectory","fse","mkdtemp","path","join","os","tmpdir","sizeLimit","config","get","i","url","index","fetchUrlToInputFile","errorMessage","push","remove","end"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,kBAAe;AACb,IAAA,MAAMA,oBAAmBC,GAAY,EAAA;AACnC,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;AAEJ,QAAA,MAAM,EAAEM,OAAO,EAAE,GAAG,MAAMC,6BAAAA,CAAuBF,IAAAA,CAAAA;AACjD,QAAA,MAAMG,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;QAEjC,MAAMC,OAAAA,GAAU,MAAMC,WAAAA,CAAMC,GAAG,CAC7BN,OAAAA,EACA,OAAO,EAAEO,EAAE,EAAEC,QAAQ,EAAsC,GAAA;YACzD,MAAM,EAAEC,EAAE,EAAE,GAAG,MAAMC,4DACnBd,WAAAA,EACAe,iBAAAA,CAAQC,MAAM,EACdC,wBAAAA,EACAN,EAAAA,CAAAA;AAGF,YAAA,MAAMO,UAAU,MAAMZ,aAAAA,CAAca,cAAc,CAACR,IAAIC,QAAAA,EAAiB;AAAEX,gBAAAA;AAAK,aAAA,CAAA;;AAG/E,YAAA,MAAMmB,UAAAA,GAAa,MAAMb,gBAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACH,OAAAA,CAAAA;YAEzD,OAAOL,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,gBAAAA,MAAAA,EAAQR,kBAAQS;AAAK,aAAA,CAAA;AAC9D,QAAA,CAAA,CAAA;AAGF1B,QAAAA,GAAAA,CAAIK,IAAI,GAAGK,OAAAA;AACb,IAAA,CAAA;AAEA;;;;;;MAOA,MAAMW,gBAAerB,GAAY,EAAA;AAC/B,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;QAEJ,MAAMa,EAAAA,GAAKb,IAAI2B,MAAM,EAAEd,MAAMb,GAAAA,CAAI4B,KAAK,CAACf,EAAE;QAEzC,IAAI,OAAOA,OAAO,QAAA,EAAU;YAC1B,MAAM,IAAIgB,YAAAA,CAAOC,eAAe,CAAC,qBAAA,CAAA;AACnC,QAAA;AAEA,QAAA,MAAMtB,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;QACjC,MAAM,EAAEM,EAAE,EAAE,GAAG,MAAMC,4DACnBd,WAAAA,EACAe,iBAAAA,CAAQC,MAAM,EACdC,wBAAAA,EACAN,EAAAA,CAAAA;QAGF,MAAMkB,IAAAA,GAAO,MAAMC,yBAAAA,CAAmB3B,IAAAA,CAAAA;QAEtC,MAAM4B,IAAAA,GAAO,MAAMzB,aAAAA,CAAca,cAAc,CAACR,EAAAA,EAAIkB,IAAAA,CAAKjB,QAAQ,EAAS;AAAEX,YAAAA;AAAK,SAAA,CAAA;;AAGjF,QAAA,MAAMmB,UAAAA,GAAa,MAAMb,gBAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACU,IAAAA,CAAAA;AAEzDjC,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,kBAAQS;AAAK,SAAA,CAAA;AACxE,IAAA,CAAA;AAEA;;;;;;MAOA,MAAMQ,aAAYlC,GAAY,EAAA;QAC5B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,OAAOC,UAAU,EAAE,GAAG,EAAE,EAAE,EACrD,GAAGpC,GAAAA;QAEJ,MAAMa,EAAAA,GAAKb,IAAI2B,MAAM,EAAEd,MAAMb,GAAAA,CAAI4B,KAAK,CAACf,EAAE;QAEzC,IAAI,OAAOA,OAAO,QAAA,EAAU;YAC1B,MAAM,IAAIgB,YAAAA,CAAOC,eAAe,CAAC,qBAAA,CAAA;AACnC,QAAA;AAEA,QAAA,MAAMtB,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;QACjC,MAAM,EAAEM,EAAE,EAAE,GAAG,MAAMC,4DACnBd,WAAAA,EACAe,iBAAAA,CAAQC,MAAM,EACdC,wBAAAA,EACAN,EAAAA,CAAAA;AAGF,QAAA,IAAIwB,MAAMC,OAAO,CAACF,eAAeA,UAAAA,CAAWG,MAAM,GAAG,CAAA,EAAG;YACtD,MAAM,IAAIV,YAAAA,CAAOW,gBAAgB,CAAC,0CAAA,CAAA;AACpC,QAAA;QAEA,MAAML,KAAAA,GAAQE,MAAMC,OAAO,CAACF,cAAcA,UAAU,CAAC,EAAE,GAAGA,UAAAA;AAE1D,QAAA,MAAM,EACJK,UAAU,EACVC,YAAY,EACZb,MAAAA,EAAQc,gBAAgB,EACzB,GAAG,MAAMC,mCAAAA,CAAqBT,KAAAA,EAAO9B,IAAAA,EAAMwC,MAAAA,CAAAA;QAC5C,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,aAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,CAACG,OAAO,CAAA;AAC9D,QAAA;QAEA,MAAMf,IAAAA,GAAQ,MAAMC,yBAAAA,CAAmBU,YAAAA,CAAAA;AACvC,QAAA,MAAMK,YAAAA,GAAe,MAAMvC,aAAAA,CAAcwC,OAAO,CAACnC,EAAAA,EAAI;AAAEkB,YAAAA,IAAAA;YAAME,IAAAA,EAAMQ,UAAU,CAAC,CAAA;SAAG,EAAG;AAAEtC,YAAAA;AAAK,SAAA,CAAA;;;;;AAM3F,QAAA,MAAM8C,oBAAoBxC,gBAAAA,CAAW,YAAA,CAAA;AACrC,QAAA,IAAIsC,cAAcG,IAAAA,EAAMC,UAAAA,CAAW,aAAc,MAAMF,iBAAAA,CAAkBG,SAAS,EAAA,EAAK;YACrF,IAAI;AACF,gBAAA,MAAMC,eAAAA,GAAkB,MAAMJ,iBAAAA,CAAkBK,YAAY,CAAC;AAACP,oBAAAA;AAAa,iBAAA,CAAA;gBAC3E,MAAME,iBAAAA,CAAkBM,yBAAyB,CAAC;AAACR,oBAAAA;AAAa,iBAAA,EAAEM,eAAAA,EAAiBlD,IAAAA,CAAAA;AACrF,YAAA,CAAA,CAAE,OAAOqD,KAAAA,EAAO;AACdX,gBAAAA,MAAAA,CAAOY,GAAG,CAACC,IAAI,CAAC,iEAAA,EAAmE;AACjFF,oBAAAA,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA;AACzD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;;AAGA,QAAA,MAAMlC,UAAAA,GAAa,MAAMb,gBAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACwB,YAAAA,CAAAA;AAEzD/C,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,kBAAQS;AAAK,SAAA,CAAA;AACxE,IAAA,CAAA;AAEA,IAAA,MAAMmC,aAAY7D,GAAY,EAAA;QAC5B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACzC,GAAGnC,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,kBAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAM,EACJ3B,UAAU,EACVC,YAAY,EACZb,MAAAA,EAAQc,gBAAgB,EACzB,GAAG,MAAMC,mCAAAA,CAAqBT,KAAAA,EAAO9B,IAAAA,EAAMwC,MAAAA,CAAAA;QAC5C,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,aAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,CAACG,OAAO,CAAA;AAC9D,QAAA;QAEA,MAAMuB,eAAAA,GAAkB5B,UAAAA,CAAWF,MAAM,GAAG,CAAA;QAC5C,MAAMR,IAAAA,GAAO,MAAMC,yBAAAA,CAAmBU,YAAAA,EAAc2B,eAAAA,CAAAA;AAEpD,QAAA,IAAIC,UAAAA,GAAa7B,UAAAA;AAEjB,QAAA,IACEV,KAAKjB,QAAQ,IACbuB,KAAAA,CAAMC,OAAO,CAACP,IAAAA,CAAKjB,QAAQ,CAAA,IAC3BwD,UAAAA,CAAW/B,MAAM,KAAKR,IAAAA,CAAKjB,QAAQ,CAACyB,MAAM,EAC1C;;AAEA,YAAA,MAAMgC,oBAAoBxC,IAAAA,CAAKjB,QAAQ,CACpCF,GAAG,CAAC,CAAC4D,IAAAA,GAAAA;gBACJ,OAAOF,UAAAA,CAAWG,IAAI,CAAC,CAACxC,OAASA,IAAAA,CAAKyC,gBAAgB,KAAKF,IAAAA,CAAKG,IAAI,CAAA;AACtE,YAAA,CAAA,CAAA,CACCC,MAAM,CAACC,OAAAA,CAAAA;YAEVP,UAAAA,GAAaC,iBAAAA;AACf,QAAA;;AAGA,QAAA,MAAMO,aAAAA,GAAgB,MAAMtE,aAAAA,CAAcuE,MAAM,CAAC;AAAEhD,YAAAA,IAAAA;YAAMI,KAAAA,EAAOmC;SAAW,EAAG;AAAEnE,YAAAA;AAAK,SAAA,CAAA;QACrF,IAAI2E,aAAAA,CAAcE,IAAI,CAAC,CAAC/C,OAASA,IAAAA,CAAKiB,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,CAAA,EAAY;YACjE,MAAM1C,gBAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,QAAA;AAEA,QAAA,MAAMhC,oBAAoBxC,gBAAAA,CAAW,YAAA,CAAA;;QAGrC,IAAI,MAAMwC,iBAAAA,CAAkBG,SAAS,EAAA,EAAI;YACvC,IAAI;AACF,gBAAA,MAAMC,eAAAA,GAAkB,MAAMJ,iBAAAA,CAAkBK,YAAY,CAACwB,aAAAA,CAAAA;;AAE7D,gBAAA,MAAM7B,iBAAAA,CAAkBM,yBAAyB,CAACuB,aAAAA,EAAezB,eAAAA,EAAiBlD,IAAAA,CAAAA;AACpF,YAAA,CAAA,CAAE,OAAOqD,KAAAA,EAAO;AACdX,gBAAAA,MAAAA,CAAOY,GAAG,CAACC,IAAI,CAAC,mEAAA,EAAqE;AACnFF,oBAAAA,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA;AACzD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;;QAGA,MAAM0B,WAAAA,GAAc,MAAMvE,WAAAA,CAAMC,GAAG,CAACkE,aAAAA,EAAerE,gBAAAA,CAAW,QAAQc,YAAY,CAAA;AAElFvB,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAAC0D,WAAAA,EAAa;AAAEzD,YAAAA,MAAAA,EAAQR,kBAAQS;AAAK,SAAA,CAAA;AACvE1B,QAAAA,GAAAA,CAAImF,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA;;;;;;;;;MAUA,MAAMC,YAAWpF,GAAY,EAAA;QAC3B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACzC,GAAGnC,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,kBAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,IAAIiB,kBAAAA,CAAEC,OAAO,CAACnD,KAAAA,CAAAA,IAAW,CAACE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,IAAUA,KAAAA,CAAMoD,IAAI,KAAK,CAAA,EAAI;YACnE,MAAM,IAAI1D,YAAAA,CAAOW,gBAAgB,CAAC,iBAAA,CAAA;AACpC,QAAA;;QAGA,MAAMP,IAAAA,GAAOI,MAAMC,OAAO,CAACH,SAASA,KAAK,CAAC,EAAE,GAAGA,KAAAA;QAC/C,MAAMqD,QAAAA,GAAWvD,IAAAA,CAAKyC,gBAAgB,IAAI,SAAA;;AAG1C,QAAA,IAAI5D,QAAAA,GAA2B;YAC7B6D,IAAAA,EAAMa,QAAAA;YACNC,OAAAA,EAAS,IAAA;YACTC,eAAAA,EAAiB,IAAA;YACjBC,MAAAA,EAAQ;AACV,SAAA;AACA,QAAA,IAAItF,MAAMS,QAAAA,EAAU;YAClB,MAAM8E,GAAAA,GAAMvF,KAAKS,QAAQ;YACzB,IAAI,OAAO8E,QAAQ,QAAA,EAAU;gBAC3B9E,QAAAA,GAAW+E,IAAAA,CAAKC,KAAK,CAACF,GAAAA,CAAAA;AACxB,YAAA,CAAA,MAAO,IAAIvD,KAAAA,CAAMC,OAAO,CAACsD,GAAAA,CAAAA,EAAM;AAC7B9E,gBAAAA,QAAAA,GAAY,OAAO8E,GAAG,CAAC,CAAA,CAAE,KAAK,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,GAAG,CAAC,CAAA,CAAE,CAAA,GAAIA,GAAG,CAAC,CAAA,CAAE;YACtE,CAAA,MAAO;gBACL9E,QAAAA,GAAW8E,GAAAA;AACb,YAAA;AACF,QAAA;;QAGA,MAAM,EAAEnD,UAAU,EAAEZ,MAAAA,EAAQc,gBAAgB,EAAE,GAAG,MAAMC,mCAAAA,CACrDX,IAAAA,EACA;YAAEnB,QAAAA,EAAU+E,IAAAA,CAAKE,SAAS,CAACjF,QAAAA;SAAU,EACrC+B,MAAAA,CAAAA;QAGF,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,aAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,EAAEG,OAAAA,IAAW,mBAAA,CAAA;AACnE,QAAA;QAEA,MAAMf,IAAAA,GAAO,MAAMC,yBAAAA,CAAmB;AAAElB,YAAAA;SAAS,EAAG,KAAA,CAAA;AACpD,QAAA,MAAM,CAACkF,YAAAA,CAAa,GAAG,MAAMxF,aAAAA,CAAcuE,MAAM,CAAC;AAAEhD,YAAAA,IAAAA;YAAMI,KAAAA,EAAO;AAACM,gBAAAA,UAAU,CAAC,CAAA;AAAG;SAAC,EAAG;AAAEtC,YAAAA;AAAK,SAAA,CAAA;AAE3F,QAAA,IAAI6F,YAAAA,CAAa9C,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,EAAW;YAC3C,MAAM1C,gBAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,QAAA;;;AAKA,QAAA,MAAM3D,UAAAA,GAAa,MAAMb,gBAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACyE,YAAAA,CAAAA;AAEzDhG,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,kBAAQS;AAAK,SAAA,CAAA;AACtE1B,QAAAA,GAAAA,CAAImF,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA;;;;;;;;;;;;MAaA,MAAMc,gBAAejG,GAAY,EAAA;AAC/B,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMyF,cAAczF,gBAAAA,CAAW,MAAA,CAAA;AAC/B,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,kBAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;;AAGA,QAAA,MAAM,EAAE+B,IAAI,EAAEC,QAAQ,EAAE,GAAG/F,IAAAA;QAE3B,IAAI,CAAC8F,IAAAA,IAAQ,CAAC9D,KAAAA,CAAMC,OAAO,CAAC6D,IAAAA,CAAAA,IAASA,IAAAA,CAAK5D,MAAM,KAAK,CAAA,EAAG;YACtD,MAAM,IAAIV,YAAAA,CAAOW,gBAAgB,CAAC,mBAAA,CAAA;AACpC,QAAA;QAEA,IAAI2D,IAAAA,CAAK5D,MAAM,GAAG,EAAA,EAAI;YACpB,MAAM,IAAIV,YAAAA,CAAOW,gBAAgB,CAAC,qCAAA,CAAA;AACpC,QAAA;;AAGAxC,QAAAA,GAAAA,CAAIqG,OAAO,GAAG,KAAA;QACd,MAAMC,GAAAA,GAAMtG,IAAIsG,GAAG;QACnBA,GAAAA,CAAIC,SAAS,CAAC,GAAA,EAAK;YACjB,cAAA,EAAgB,mBAAA;YAChB,eAAA,EAAiB,UAAA;YACjBC,UAAAA,EAAY;AACd,SAAA,CAAA;QAEA,MAAMC,QAAAA,GAAW,CAACC,KAAAA,EAAe3E,IAAAA,GAAAA;AAC/BuE,YAAAA,GAAAA,CAAIK,KAAK,CAAC,CAAC,OAAO,EAAED,KAAAA,CAAM,QAAQ,EAAEb,IAAAA,CAAKE,SAAS,CAAChE,IAAAA,CAAAA,CAAM,IAAI,CAAC,CAAA;AAChE,QAAA,CAAA;QAEA,MAAM6E,KAAAA,GAAQT,KAAK5D,MAAM;AACzB,QAAA,MAAMsE,eAAkC,EAAE;AAC1C,QAAA,MAAMC,kBAAyB,EAAE;;QAGjC,MAAMC,mBAAAA,GAAsB,MAAMC,oBAAAA,CAAIC,OAAO,CAACC,sBAAKC,IAAI,CAACC,mBAAAA,CAAGC,MAAM,EAAA,EAAI,oBAAA,CAAA,CAAA;QACrE,MAAM,EAAEC,SAAS,EAAE,GAAGzE,OAAO0E,MAAM,CAACC,GAAG,CAAS,gBAAA,CAAA;QAEhD,IAAI;;YAEF,IAAK,IAAIC,IAAI,CAAA,EAAGA,CAAAA,GAAItB,KAAK5D,MAAM,EAAEkF,KAAK,CAAA,CAAG;gBACvC,MAAMC,GAAAA,GAAMvB,IAAI,CAACsB,CAAAA,CAAE;AAEnBhB,gBAAAA,QAAAA,CAAS,eAAA,EAAiB;AAAEiB,oBAAAA,GAAAA;oBAAKC,KAAAA,EAAOF,CAAAA;AAAGb,oBAAAA;AAAM,iBAAA,CAAA;gBAEjD,IAAI;;oBAEF,MAAM,EAAE3E,IAAI,EAAE,GAAG,MAAMiE,WAAAA,CAAY0B,mBAAmB,CACpDF,GAAAA,EACAX,mBAAAA,EACAO,SAAAA,CAAAA;oBAEF,MAAM9B,QAAAA,GAAWvD,KAAKyC,gBAAgB;AAEtC+B,oBAAAA,QAAAA,CAAS,gBAAA,EAAkB;wBACzB9B,IAAAA,EAAMa,QAAAA;wBACNmC,KAAAA,EAAOF,CAAAA;AACPb,wBAAAA,KAAAA;AACArB,wBAAAA,IAAAA,EAAMtD,KAAKsD;AACb,qBAAA,CAAA;;AAGA,oBAAA,MAAMzE,QAAAA,GAA2B;wBAC/B6D,IAAAA,EAAMa,QAAAA;wBACNC,OAAAA,EAAS,IAAA;wBACTC,eAAAA,EAAiB,IAAA;AACjBC,wBAAAA,MAAAA,EAAQS,QAAAA,IAAY;AACtB,qBAAA;oBAEA,MAAM,EAAE3D,UAAU,EAAEZ,MAAAA,EAAQc,gBAAgB,EAAE,GAAG,MAAMC,mCAAAA,CACrDX,IAAAA,EACA;wBAAEnB,QAAAA,EAAU+E,IAAAA,CAAKE,SAAS,CAACjF,QAAAA;qBAAU,EACrC+B,MAAAA,CAAAA;oBAGF,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;AAC3B,wBAAA,MAAMsF,YAAAA,GAAelF,gBAAgB,CAAC,CAAA,CAAE,EAAEG,OAAAA,IAAW,mBAAA;AACrD+D,wBAAAA,YAAAA,CAAaiB,IAAI,CAAC;4BAAEnD,IAAAA,EAAMa,QAAAA;4BAAU1C,OAAAA,EAAS+E;AAAa,yBAAA,CAAA;AAC1DpB,wBAAAA,QAAAA,CAAS,YAAA,EAAc;4BAAE9B,IAAAA,EAAMa,QAAAA;AAAUkC,4BAAAA,GAAAA;4BAAKC,KAAAA,EAAOF,CAAAA;4BAAG3E,OAAAA,EAAS+E;AAAa,yBAAA,CAAA;oBAChF,CAAA,MAAO;;wBAEL,MAAM9F,IAAAA,GAAO,MAAMC,yBAAAA,CAAmB;AAAElB,4BAAAA;yBAAS,EAAG,KAAA,CAAA;AACpD,wBAAA,MAAM,CAACkF,YAAAA,CAAa,GAAG,MAAMxF,aAAAA,CAAcuE,MAAM,CAC/C;AAAEhD,4BAAAA,IAAAA;4BAAMI,KAAAA,EAAO;AAACM,gCAAAA,UAAU,CAAC,CAAA;AAAG;yBAAC,EAC/B;AAAEtC,4BAAAA;AAAK,yBAAA,CAAA;;AAIT,wBAAA,MAAMmB,UAAAA,GAAa,MAAM4E,WAAAA,CAAY3E,YAAY,CAACyE,YAAAA,CAAAA;AAClDc,wBAAAA,eAAAA,CAAgBgB,IAAI,CAACxG,UAAAA,CAAAA;AAErBmF,wBAAAA,QAAAA,CAAS,eAAA,EAAiB;4BAAE9B,IAAAA,EAAMa,QAAAA;4BAAUmC,KAAAA,EAAOF,CAAAA;4BAAGxF,IAAAA,EAAMX;AAAW,yBAAA,CAAA;AACzE,oBAAA;AACF,gBAAA,CAAA,CAAE,OAAOkC,KAAAA,EAAO;AACd,oBAAA,MAAMqE,eAAerE,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA,CAAAA;AACrEqD,oBAAAA,YAAAA,CAAaiB,IAAI,CAAC;wBAAEnD,IAAAA,EAAM+C,GAAAA;wBAAK5E,OAAAA,EAAS+E;AAAa,qBAAA,CAAA;AACrDpB,oBAAAA,QAAAA,CAAS,YAAA,EAAc;AAAEiB,wBAAAA,GAAAA;wBAAKC,KAAAA,EAAOF,CAAAA;wBAAG3E,OAAAA,EAAS+E;AAAa,qBAAA,CAAA;AAChE,gBAAA;AACF,YAAA;;YAGA,IAAIf,eAAAA,CAAgB9B,IAAI,CAAC,CAAC/C,OAASA,IAAAA,CAAKiB,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,CAAA,EAAY;gBACnE,MAAM1C,gBAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,YAAA;;AAGAwB,YAAAA,QAAAA,CAAS,iBAAA,EAAmB;AAC1B1E,gBAAAA,IAAAA,EAAM,MAAMhB,EAAAA,CAAGS,cAAc,CAACsF,eAAAA,EAAiB;AAAErF,oBAAAA,MAAAA,EAAQR,kBAAQS;AAAK,iBAAA,CAAA;gBACtEG,MAAAA,EAAQgF;AACV,aAAA,CAAA;QACF,CAAA,QAAU;;YAER,MAAMG,oBAAAA,CAAIe,MAAM,CAAChB,mBAAAA,CAAAA;AACnB,QAAA;AAEAT,QAAAA,GAAAA,CAAI0B,GAAG,EAAA;AACT,IAAA,CAAA;;AAGA,IAAA,MAAMjD,QAAO/E,GAAY,EAAA;AACvB,QAAA,MAAM,EACJ4B,KAAAA,EAAO,EAAEf,EAAE,EAAE,EACbT,OAAAA,EAAS,EAAE+B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACnC,GAAGnC,GAAAA;AAEJ,QAAA,IAAIqF,kBAAAA,CAAEC,OAAO,CAACnD,KAAAA,CAAAA,IAAW,CAACE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,IAAUA,KAAAA,CAAMoD,IAAI,KAAK,CAAA,EAAI;AACnE,YAAA,IAAI1E,EAAAA,EAAI;gBACN,OAAO,IAAI,CAACQ,cAAc,CAACrB,GAAAA,CAAAA;AAC7B,YAAA;YAEA,MAAM,IAAI6B,YAAAA,CAAOW,gBAAgB,CAAC,iBAAA,CAAA;AACpC,QAAA;QAEA,MAAO3B,CAAAA,EAAAA,GAAK,IAAI,CAACqB,WAAW,GAAG,IAAI,CAAC2B,WAAU,EAAG7D,GAAAA,CAAAA;AACnD,IAAA;AACF,CAAA;;;;"}
1
+ {"version":3,"file":"admin-upload.js","sources":["../../../server/src/controllers/admin-upload.ts"],"sourcesContent":["import os from 'os';\nimport path from 'path';\nimport fse from 'fs-extra';\nimport _ from 'lodash';\nimport { errors, async } from '@strapi/utils';\n\nimport type { Context } from 'koa';\n\nimport { getService } from '../utils';\nimport { ACTIONS, FILE_MODEL_UID } from '../constants';\nimport { validateBulkUpdateBody, validateUploadBody } from './validation/admin/upload';\nimport { findEntityAndCheckPermissions } from './utils/find-entity-and-check-permissions';\nimport { Config, FileInfo } from '../types';\nimport { prepareUploadRequest, type FileUploadError } from '../utils/mime-validation';\nimport type { UploadFileInfo } from '../../../shared/contracts/files';\nimport type { UrlFetchProgress } from '../services/file';\n\n/**\n * Minimum delay between two `file:progress` frames for the same URL.\n *\n * `fetchUrlToInputFile` reports once per streamed chunk (~8000 calls for a 512MB file at\n * 64KB chunks); at ~5 frames a second a 10s transfer costs ~50 frames, which is plenty for\n * a bar the user watches.\n */\nconst URL_FETCH_PROGRESS_INTERVAL_MS = 200;\n\nexport default {\n async bulkUpdateFileInfo(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const { updates } = await validateBulkUpdateBody(body);\n const uploadService = getService('upload');\n\n const results = await async.map(\n updates,\n async ({ id, fileInfo }: { id: number; fileInfo: FileInfo }) => {\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n const updated = await uploadService.updateFileInfo(id, fileInfo as any, { user });\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(updated);\n\n return pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n }\n );\n\n ctx.body = results;\n },\n\n /**\n * `PUT /upload/files/:id`\n *\n * Update the editable metadata (`fileInfo`) of an existing file. Also reached\n * through the `POST /upload` multiplexer, which delegates here with the id in\n * `ctx.query` — hence the dual read below, route params winning.\n */\n async updateFileInfo(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const id = ctx.params?.id ?? ctx.query.id;\n\n if (typeof id !== 'string') {\n throw new errors.ValidationError('File id is required');\n }\n\n const uploadService = getService('upload');\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n const data = await validateUploadBody(body);\n\n const file = await uploadService.updateFileInfo(id, data.fileInfo as any, { user });\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(file);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n },\n\n /**\n * `POST /upload/files/:id/replace`\n *\n * Replace the binary content of an existing file. Also reached through the\n * `POST /upload` multiplexer, which delegates here with the id in `ctx.query`\n * — hence the dual read below, route params winning.\n */\n async replaceFile(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files: filesInput } = {} },\n } = ctx;\n\n const id = ctx.params?.id ?? ctx.query.id;\n\n if (typeof id !== 'string') {\n throw new errors.ValidationError('File id is required');\n }\n\n const uploadService = getService('upload');\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n if (Array.isArray(filesInput) && filesInput.length > 1) {\n throw new errors.ApplicationError('Cannot replace a file with multiple ones');\n }\n\n const files = Array.isArray(filesInput) ? filesInput[0] : filesInput;\n\n const {\n validFiles,\n filteredBody,\n errors: validationErrors,\n } = await prepareUploadRequest(files, body, strapi);\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0].message);\n }\n\n const data = (await validateUploadBody(filteredBody)) as { fileInfo: FileInfo };\n const replacedFile = await uploadService.replace(id, { data, file: validFiles[0] }, { user });\n\n // Regenerate AI metadata for image replacements so the alt text / caption\n // reflect the new file content. Mirrors the post-upload hook in\n // `uploadFiles`; failure is logged and swallowed to keep the replace flow\n // resilient when the AI provider is unavailable.\n const aiMetadataService = getService('aiMetadata');\n if (replacedFile?.mime?.startsWith('image/') && (await aiMetadataService.isEnabled())) {\n try {\n const metadataResults = await aiMetadataService.processFiles([replacedFile]);\n await aiMetadataService.updateFilesWithAIMetadata([replacedFile], metadataResults, user);\n } catch (error) {\n strapi.log.warn('AI metadata generation failed on replace, proceeding without it', {\n error: error instanceof Error ? error.message : String(error),\n });\n }\n }\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(replacedFile);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n },\n\n async uploadFiles(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files } = {} },\n } = ctx;\n\n const uploadService = getService('upload');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n const {\n validFiles,\n filteredBody,\n errors: validationErrors,\n } = await prepareUploadRequest(files, body, strapi);\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0].message);\n }\n\n const isMultipleFiles = validFiles.length > 1;\n const data = await validateUploadBody(filteredBody, isMultipleFiles);\n\n let filesArray = validFiles;\n\n if (\n data.fileInfo &&\n Array.isArray(data.fileInfo) &&\n filesArray.length === data.fileInfo.length\n ) {\n // Reorder filesArray to match data.fileInfo order\n const alignedFilesArray = data.fileInfo\n .map((info) => {\n return filesArray.find((file) => file.originalFilename === info.name);\n })\n .filter(Boolean) as any[];\n\n filesArray = alignedFilesArray;\n }\n\n // Upload files first to get thumbnails\n const uploadedFiles = await uploadService.upload({ data, files: filesArray }, { user });\n if (uploadedFiles.some((file) => file.mime?.startsWith('image/'))) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n const aiMetadataService = getService('aiMetadata');\n\n // AFTER upload - generate AI metadata for images\n if (await aiMetadataService.isEnabled()) {\n try {\n const metadataResults = await aiMetadataService.processFiles(uploadedFiles);\n // Update the uploaded files with AI metadata\n await aiMetadataService.updateFilesWithAIMetadata(uploadedFiles, metadataResults, user);\n } catch (error) {\n strapi.log.warn('AI metadata generation failed, proceeding without AI enhancements', {\n error: error instanceof Error ? error.message : String(error),\n });\n }\n }\n\n // Sign file urls for private providers\n const signedFiles = await async.map(uploadedFiles, getService('file').signFileUrls);\n\n ctx.body = await pm.sanitizeOutput(signedFiles, { action: ACTIONS.read });\n ctx.status = 201;\n },\n\n /**\n * `POST /upload/files`\n *\n * Upload a single file and return the created File.\n *\n * Accepts one file per request (multipart `files` + `fileInfo`) and returns a\n * single `File` object. Unlike `uploadFiles`, it does **not** run AI metadata\n * generation inline — that responsibility is decoupled and will be handled by a\n * background job. Auth and permission checks mirror `POST /upload`.\n */\n async uploadFile(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files } = {} },\n } = ctx;\n\n const uploadService = getService('upload');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n if (_.isEmpty(files) || (!Array.isArray(files) && files.size === 0)) {\n throw new errors.ApplicationError('Files are empty');\n }\n\n // Accept a single file per request; ignore any extras defensively.\n const file = Array.isArray(files) ? files[0] : files;\n const fileName = file.originalFilename || 'unknown';\n\n // Parse the single fileInfo object from the multipart body.\n let fileInfo: UploadFileInfo = {\n name: fileName,\n caption: null,\n alternativeText: null,\n folder: null,\n };\n if (body?.fileInfo) {\n const raw = body.fileInfo;\n if (typeof raw === 'string') {\n fileInfo = JSON.parse(raw);\n } else if (Array.isArray(raw)) {\n fileInfo = (typeof raw[0] === 'string' ? JSON.parse(raw[0]) : raw[0]) as UploadFileInfo;\n } else {\n fileInfo = raw as UploadFileInfo;\n }\n }\n\n // Validate this single file using security checks.\n const { validFiles, errors: validationErrors } = await prepareUploadRequest(\n file,\n { fileInfo: JSON.stringify(fileInfo) },\n strapi\n );\n\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0]?.message || 'Validation failed');\n }\n\n const data = await validateUploadBody({ fileInfo }, false);\n const [uploadedFile] = await uploadService.upload({ data, files: [validFiles[0]] }, { user });\n\n if (uploadedFile.mime?.startsWith('image/')) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n // No inline AI metadata generation — intentionally decoupled for the async job.\n\n // Sign file url for private providers.\n const signedFile = await getService('file').signFileUrls(uploadedFile);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n ctx.status = 201;\n },\n\n /**\n * `POST /upload/actions/upload-from-urls`\n *\n * Upload files from URLs with SSE streaming for per-file progress\n *\n * Accepts JSON body with URLs and fetches them server-side.\n * Streams Server-Sent Events as each URL is fetched and uploaded:\n * - file:fetching — when starting to fetch a URL\n * - file:progress — throttled byte progress of the remote → server temp file transfer\n * - file:uploading — when upload starts for a fetched file\n * - file:complete — when a file is successfully uploaded\n * - file:error — when a URL fetch or upload fails\n * - stream:complete — final summary with all results\n */\n async uploadFromUrls(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const uploadService = getService('upload');\n const fileService = getService('file');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n // Parse and validate request body\n const { urls, folderId } = body as { urls?: string[]; folderId?: number | null };\n\n if (!urls || !Array.isArray(urls) || urls.length === 0) {\n throw new errors.ApplicationError('URLs are required');\n }\n\n if (urls.length > 20) {\n throw new errors.ApplicationError('Maximum 20 URLs allowed per request');\n }\n\n // Take manual control of the response for SSE streaming\n ctx.respond = false;\n const res = ctx.res;\n res.writeHead(200, {\n 'Content-Type': 'text/event-stream',\n 'Cache-Control': 'no-cache',\n Connection: 'keep-alive',\n });\n\n const writeSSE = (event: string, data: Record<string, unknown>) => {\n res.write(`event: ${event}\\ndata: ${JSON.stringify(data)}\\n\\n`);\n };\n\n const total = urls.length;\n const uploadErrors: FileUploadError[] = [];\n const successfulFiles: any[] = [];\n\n // Create temp directory for fetched files\n const tmpWorkingDirectory = await fse.mkdtemp(path.join(os.tmpdir(), 'strapi-url-upload-'));\n const { sizeLimit } = strapi.config.get<Config>('plugin::upload');\n\n try {\n // Process each URL sequentially\n for (let i = 0; i < urls.length; i += 1) {\n const url = urls[i];\n\n writeSSE('file:fetching', { url, index: i, total });\n\n try {\n // `fetchUrlToInputFile` reports raw, unthrottled progress — coalescing it into a\n // sane frame rate is the caller's job. State is per URL: the loop is sequential.\n let lastProgressAt = 0;\n let hasAnnouncedSize = false;\n let hasReachedTotal = false;\n\n const onFetchProgress = ({ bytesWritten, totalBytes }: UrlFetchProgress) => {\n // The frame that reaches the total always goes out, or a throttled last chunk\n // leaves the row short of 100% until `file:complete`.\n const isFinal = !hasReachedTotal && totalBytes !== null && bytesWritten >= totalBytes;\n if (\n hasAnnouncedSize &&\n !isFinal &&\n Date.now() - lastProgressAt < URL_FETCH_PROGRESS_INTERVAL_MS\n ) {\n return;\n }\n\n hasAnnouncedSize = true;\n hasReachedTotal = hasReachedTotal || isFinal;\n lastProgressAt = Date.now();\n\n writeSSE('file:progress', {\n index: i,\n loadedBytes: bytesWritten,\n totalBytes,\n phase: 'fetch',\n });\n };\n\n // Fetch URL to temp file\n const { file } = await fileService.fetchUrlToInputFile(\n url,\n tmpWorkingDirectory,\n sizeLimit,\n onFetchProgress\n );\n const fileName = file.originalFilename;\n\n writeSSE('file:uploading', {\n name: fileName,\n index: i,\n total,\n size: file.size,\n });\n\n // Validate using security checks\n const fileInfo: UploadFileInfo = {\n name: fileName,\n caption: null,\n alternativeText: null,\n folder: folderId ?? null,\n };\n\n const { validFiles, errors: validationErrors } = await prepareUploadRequest(\n file,\n { fileInfo: JSON.stringify(fileInfo) },\n strapi\n );\n\n if (validFiles.length === 0) {\n const errorMessage = validationErrors[0]?.message || 'Validation failed';\n uploadErrors.push({ name: fileName, message: errorMessage });\n writeSSE('file:error', { name: fileName, url, index: i, message: errorMessage });\n } else {\n // Upload the file\n const data = await validateUploadBody({ fileInfo }, false);\n const [uploadedFile] = await uploadService.upload(\n { data, files: [validFiles[0]] },\n { user }\n );\n\n // Sign file url\n const signedFile = await fileService.signFileUrls(uploadedFile);\n successfulFiles.push(signedFile);\n\n writeSSE('file:complete', { name: fileName, index: i, file: signedFile });\n }\n } catch (error) {\n const errorMessage = error instanceof Error ? error.message : String(error);\n uploadErrors.push({ name: url, message: errorMessage });\n writeSSE('file:error', { url, index: i, message: errorMessage });\n }\n }\n\n // Track image upload metric once if any images were uploaded\n if (successfulFiles.some((file) => file.mime?.startsWith('image/'))) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n // Send final stream summary\n writeSSE('stream:complete', {\n data: await pm.sanitizeOutput(successfulFiles, { action: ACTIONS.read }),\n errors: uploadErrors,\n });\n } finally {\n // Clean up temp directory\n await fse.remove(tmpWorkingDirectory);\n }\n\n res.end();\n },\n\n // TODO: split into multiple endpoints\n async upload(ctx: Context) {\n const {\n query: { id },\n request: { files: { files } = {} },\n } = ctx;\n\n if (_.isEmpty(files) || (!Array.isArray(files) && files.size === 0)) {\n if (id) {\n return this.updateFileInfo(ctx);\n }\n\n throw new errors.ApplicationError('Files are empty');\n }\n\n await (id ? this.replaceFile : this.uploadFiles)(ctx);\n },\n};\n"],"names":["URL_FETCH_PROGRESS_INTERVAL_MS","bulkUpdateFileInfo","ctx","state","userAbility","user","request","body","updates","validateBulkUpdateBody","uploadService","getService","results","async","map","id","fileInfo","pm","findEntityAndCheckPermissions","ACTIONS","update","FILE_MODEL_UID","updated","updateFileInfo","signedFile","signFileUrls","sanitizeOutput","action","read","params","query","errors","ValidationError","data","validateUploadBody","file","replaceFile","files","filesInput","Array","isArray","length","ApplicationError","validFiles","filteredBody","validationErrors","prepareUploadRequest","strapi","message","replacedFile","replace","aiMetadataService","mime","startsWith","isEnabled","metadataResults","processFiles","updateFilesWithAIMetadata","error","log","warn","Error","String","uploadFiles","service","createPermissionsManager","ability","create","model","isAllowed","forbidden","isMultipleFiles","filesArray","alignedFilesArray","info","find","originalFilename","name","filter","Boolean","uploadedFiles","upload","some","trackUsage","signedFiles","status","uploadFile","_","isEmpty","size","fileName","caption","alternativeText","folder","raw","JSON","parse","stringify","uploadedFile","uploadFromUrls","fileService","urls","folderId","respond","res","writeHead","Connection","writeSSE","event","write","total","uploadErrors","successfulFiles","tmpWorkingDirectory","fse","mkdtemp","path","join","os","tmpdir","sizeLimit","config","get","i","url","index","lastProgressAt","hasAnnouncedSize","hasReachedTotal","onFetchProgress","bytesWritten","totalBytes","isFinal","Date","now","loadedBytes","phase","fetchUrlToInputFile","errorMessage","push","remove","end"],"mappings":";;;;;;;;;;;;;;;;;;;;AAiBA;;;;;;AAMC,IACD,MAAMA,8BAAAA,GAAiC,GAAA;AAEvC,kBAAe;AACb,IAAA,MAAMC,oBAAmBC,GAAY,EAAA;AACnC,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;AAEJ,QAAA,MAAM,EAAEM,OAAO,EAAE,GAAG,MAAMC,6BAAAA,CAAuBF,IAAAA,CAAAA;AACjD,QAAA,MAAMG,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;QAEjC,MAAMC,OAAAA,GAAU,MAAMC,WAAAA,CAAMC,GAAG,CAC7BN,OAAAA,EACA,OAAO,EAAEO,EAAE,EAAEC,QAAQ,EAAsC,GAAA;YACzD,MAAM,EAAEC,EAAE,EAAE,GAAG,MAAMC,4DACnBd,WAAAA,EACAe,iBAAAA,CAAQC,MAAM,EACdC,wBAAAA,EACAN,EAAAA,CAAAA;AAGF,YAAA,MAAMO,UAAU,MAAMZ,aAAAA,CAAca,cAAc,CAACR,IAAIC,QAAAA,EAAiB;AAAEX,gBAAAA;AAAK,aAAA,CAAA;;AAG/E,YAAA,MAAMmB,UAAAA,GAAa,MAAMb,gBAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACH,OAAAA,CAAAA;YAEzD,OAAOL,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,gBAAAA,MAAAA,EAAQR,kBAAQS;AAAK,aAAA,CAAA;AAC9D,QAAA,CAAA,CAAA;AAGF1B,QAAAA,GAAAA,CAAIK,IAAI,GAAGK,OAAAA;AACb,IAAA,CAAA;AAEA;;;;;;MAOA,MAAMW,gBAAerB,GAAY,EAAA;AAC/B,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;QAEJ,MAAMa,EAAAA,GAAKb,IAAI2B,MAAM,EAAEd,MAAMb,GAAAA,CAAI4B,KAAK,CAACf,EAAE;QAEzC,IAAI,OAAOA,OAAO,QAAA,EAAU;YAC1B,MAAM,IAAIgB,YAAAA,CAAOC,eAAe,CAAC,qBAAA,CAAA;AACnC,QAAA;AAEA,QAAA,MAAMtB,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;QACjC,MAAM,EAAEM,EAAE,EAAE,GAAG,MAAMC,4DACnBd,WAAAA,EACAe,iBAAAA,CAAQC,MAAM,EACdC,wBAAAA,EACAN,EAAAA,CAAAA;QAGF,MAAMkB,IAAAA,GAAO,MAAMC,yBAAAA,CAAmB3B,IAAAA,CAAAA;QAEtC,MAAM4B,IAAAA,GAAO,MAAMzB,aAAAA,CAAca,cAAc,CAACR,EAAAA,EAAIkB,IAAAA,CAAKjB,QAAQ,EAAS;AAAEX,YAAAA;AAAK,SAAA,CAAA;;AAGjF,QAAA,MAAMmB,UAAAA,GAAa,MAAMb,gBAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACU,IAAAA,CAAAA;AAEzDjC,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,kBAAQS;AAAK,SAAA,CAAA;AACxE,IAAA,CAAA;AAEA;;;;;;MAOA,MAAMQ,aAAYlC,GAAY,EAAA;QAC5B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,OAAOC,UAAU,EAAE,GAAG,EAAE,EAAE,EACrD,GAAGpC,GAAAA;QAEJ,MAAMa,EAAAA,GAAKb,IAAI2B,MAAM,EAAEd,MAAMb,GAAAA,CAAI4B,KAAK,CAACf,EAAE;QAEzC,IAAI,OAAOA,OAAO,QAAA,EAAU;YAC1B,MAAM,IAAIgB,YAAAA,CAAOC,eAAe,CAAC,qBAAA,CAAA;AACnC,QAAA;AAEA,QAAA,MAAMtB,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;QACjC,MAAM,EAAEM,EAAE,EAAE,GAAG,MAAMC,4DACnBd,WAAAA,EACAe,iBAAAA,CAAQC,MAAM,EACdC,wBAAAA,EACAN,EAAAA,CAAAA;AAGF,QAAA,IAAIwB,MAAMC,OAAO,CAACF,eAAeA,UAAAA,CAAWG,MAAM,GAAG,CAAA,EAAG;YACtD,MAAM,IAAIV,YAAAA,CAAOW,gBAAgB,CAAC,0CAAA,CAAA;AACpC,QAAA;QAEA,MAAML,KAAAA,GAAQE,MAAMC,OAAO,CAACF,cAAcA,UAAU,CAAC,EAAE,GAAGA,UAAAA;AAE1D,QAAA,MAAM,EACJK,UAAU,EACVC,YAAY,EACZb,MAAAA,EAAQc,gBAAgB,EACzB,GAAG,MAAMC,mCAAAA,CAAqBT,KAAAA,EAAO9B,IAAAA,EAAMwC,MAAAA,CAAAA;QAC5C,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,aAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,CAACG,OAAO,CAAA;AAC9D,QAAA;QAEA,MAAMf,IAAAA,GAAQ,MAAMC,yBAAAA,CAAmBU,YAAAA,CAAAA;AACvC,QAAA,MAAMK,YAAAA,GAAe,MAAMvC,aAAAA,CAAcwC,OAAO,CAACnC,EAAAA,EAAI;AAAEkB,YAAAA,IAAAA;YAAME,IAAAA,EAAMQ,UAAU,CAAC,CAAA;SAAG,EAAG;AAAEtC,YAAAA;AAAK,SAAA,CAAA;;;;;AAM3F,QAAA,MAAM8C,oBAAoBxC,gBAAAA,CAAW,YAAA,CAAA;AACrC,QAAA,IAAIsC,cAAcG,IAAAA,EAAMC,UAAAA,CAAW,aAAc,MAAMF,iBAAAA,CAAkBG,SAAS,EAAA,EAAK;YACrF,IAAI;AACF,gBAAA,MAAMC,eAAAA,GAAkB,MAAMJ,iBAAAA,CAAkBK,YAAY,CAAC;AAACP,oBAAAA;AAAa,iBAAA,CAAA;gBAC3E,MAAME,iBAAAA,CAAkBM,yBAAyB,CAAC;AAACR,oBAAAA;AAAa,iBAAA,EAAEM,eAAAA,EAAiBlD,IAAAA,CAAAA;AACrF,YAAA,CAAA,CAAE,OAAOqD,KAAAA,EAAO;AACdX,gBAAAA,MAAAA,CAAOY,GAAG,CAACC,IAAI,CAAC,iEAAA,EAAmE;AACjFF,oBAAAA,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA;AACzD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;;AAGA,QAAA,MAAMlC,UAAAA,GAAa,MAAMb,gBAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACwB,YAAAA,CAAAA;AAEzD/C,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,kBAAQS;AAAK,SAAA,CAAA;AACxE,IAAA,CAAA;AAEA,IAAA,MAAMmC,aAAY7D,GAAY,EAAA;QAC5B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACzC,GAAGnC,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,kBAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAM,EACJ3B,UAAU,EACVC,YAAY,EACZb,MAAAA,EAAQc,gBAAgB,EACzB,GAAG,MAAMC,mCAAAA,CAAqBT,KAAAA,EAAO9B,IAAAA,EAAMwC,MAAAA,CAAAA;QAC5C,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,aAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,CAACG,OAAO,CAAA;AAC9D,QAAA;QAEA,MAAMuB,eAAAA,GAAkB5B,UAAAA,CAAWF,MAAM,GAAG,CAAA;QAC5C,MAAMR,IAAAA,GAAO,MAAMC,yBAAAA,CAAmBU,YAAAA,EAAc2B,eAAAA,CAAAA;AAEpD,QAAA,IAAIC,UAAAA,GAAa7B,UAAAA;AAEjB,QAAA,IACEV,KAAKjB,QAAQ,IACbuB,KAAAA,CAAMC,OAAO,CAACP,IAAAA,CAAKjB,QAAQ,CAAA,IAC3BwD,UAAAA,CAAW/B,MAAM,KAAKR,IAAAA,CAAKjB,QAAQ,CAACyB,MAAM,EAC1C;;AAEA,YAAA,MAAMgC,oBAAoBxC,IAAAA,CAAKjB,QAAQ,CACpCF,GAAG,CAAC,CAAC4D,IAAAA,GAAAA;gBACJ,OAAOF,UAAAA,CAAWG,IAAI,CAAC,CAACxC,OAASA,IAAAA,CAAKyC,gBAAgB,KAAKF,IAAAA,CAAKG,IAAI,CAAA;AACtE,YAAA,CAAA,CAAA,CACCC,MAAM,CAACC,OAAAA,CAAAA;YAEVP,UAAAA,GAAaC,iBAAAA;AACf,QAAA;;AAGA,QAAA,MAAMO,aAAAA,GAAgB,MAAMtE,aAAAA,CAAcuE,MAAM,CAAC;AAAEhD,YAAAA,IAAAA;YAAMI,KAAAA,EAAOmC;SAAW,EAAG;AAAEnE,YAAAA;AAAK,SAAA,CAAA;QACrF,IAAI2E,aAAAA,CAAcE,IAAI,CAAC,CAAC/C,OAASA,IAAAA,CAAKiB,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,CAAA,EAAY;YACjE,MAAM1C,gBAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,QAAA;AAEA,QAAA,MAAMhC,oBAAoBxC,gBAAAA,CAAW,YAAA,CAAA;;QAGrC,IAAI,MAAMwC,iBAAAA,CAAkBG,SAAS,EAAA,EAAI;YACvC,IAAI;AACF,gBAAA,MAAMC,eAAAA,GAAkB,MAAMJ,iBAAAA,CAAkBK,YAAY,CAACwB,aAAAA,CAAAA;;AAE7D,gBAAA,MAAM7B,iBAAAA,CAAkBM,yBAAyB,CAACuB,aAAAA,EAAezB,eAAAA,EAAiBlD,IAAAA,CAAAA;AACpF,YAAA,CAAA,CAAE,OAAOqD,KAAAA,EAAO;AACdX,gBAAAA,MAAAA,CAAOY,GAAG,CAACC,IAAI,CAAC,mEAAA,EAAqE;AACnFF,oBAAAA,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA;AACzD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;;QAGA,MAAM0B,WAAAA,GAAc,MAAMvE,WAAAA,CAAMC,GAAG,CAACkE,aAAAA,EAAerE,gBAAAA,CAAW,QAAQc,YAAY,CAAA;AAElFvB,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAAC0D,WAAAA,EAAa;AAAEzD,YAAAA,MAAAA,EAAQR,kBAAQS;AAAK,SAAA,CAAA;AACvE1B,QAAAA,GAAAA,CAAImF,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA;;;;;;;;;MAUA,MAAMC,YAAWpF,GAAY,EAAA;QAC3B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACzC,GAAGnC,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,kBAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,IAAIiB,kBAAAA,CAAEC,OAAO,CAACnD,KAAAA,CAAAA,IAAW,CAACE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,IAAUA,KAAAA,CAAMoD,IAAI,KAAK,CAAA,EAAI;YACnE,MAAM,IAAI1D,YAAAA,CAAOW,gBAAgB,CAAC,iBAAA,CAAA;AACpC,QAAA;;QAGA,MAAMP,IAAAA,GAAOI,MAAMC,OAAO,CAACH,SAASA,KAAK,CAAC,EAAE,GAAGA,KAAAA;QAC/C,MAAMqD,QAAAA,GAAWvD,IAAAA,CAAKyC,gBAAgB,IAAI,SAAA;;AAG1C,QAAA,IAAI5D,QAAAA,GAA2B;YAC7B6D,IAAAA,EAAMa,QAAAA;YACNC,OAAAA,EAAS,IAAA;YACTC,eAAAA,EAAiB,IAAA;YACjBC,MAAAA,EAAQ;AACV,SAAA;AACA,QAAA,IAAItF,MAAMS,QAAAA,EAAU;YAClB,MAAM8E,GAAAA,GAAMvF,KAAKS,QAAQ;YACzB,IAAI,OAAO8E,QAAQ,QAAA,EAAU;gBAC3B9E,QAAAA,GAAW+E,IAAAA,CAAKC,KAAK,CAACF,GAAAA,CAAAA;AACxB,YAAA,CAAA,MAAO,IAAIvD,KAAAA,CAAMC,OAAO,CAACsD,GAAAA,CAAAA,EAAM;AAC7B9E,gBAAAA,QAAAA,GAAY,OAAO8E,GAAG,CAAC,CAAA,CAAE,KAAK,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,GAAG,CAAC,CAAA,CAAE,CAAA,GAAIA,GAAG,CAAC,CAAA,CAAE;YACtE,CAAA,MAAO;gBACL9E,QAAAA,GAAW8E,GAAAA;AACb,YAAA;AACF,QAAA;;QAGA,MAAM,EAAEnD,UAAU,EAAEZ,MAAAA,EAAQc,gBAAgB,EAAE,GAAG,MAAMC,mCAAAA,CACrDX,IAAAA,EACA;YAAEnB,QAAAA,EAAU+E,IAAAA,CAAKE,SAAS,CAACjF,QAAAA;SAAU,EACrC+B,MAAAA,CAAAA;QAGF,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,aAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,EAAEG,OAAAA,IAAW,mBAAA,CAAA;AACnE,QAAA;QAEA,MAAMf,IAAAA,GAAO,MAAMC,yBAAAA,CAAmB;AAAElB,YAAAA;SAAS,EAAG,KAAA,CAAA;AACpD,QAAA,MAAM,CAACkF,YAAAA,CAAa,GAAG,MAAMxF,aAAAA,CAAcuE,MAAM,CAAC;AAAEhD,YAAAA,IAAAA;YAAMI,KAAAA,EAAO;AAACM,gBAAAA,UAAU,CAAC,CAAA;AAAG;SAAC,EAAG;AAAEtC,YAAAA;AAAK,SAAA,CAAA;AAE3F,QAAA,IAAI6F,YAAAA,CAAa9C,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,EAAW;YAC3C,MAAM1C,gBAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,QAAA;;;AAKA,QAAA,MAAM3D,UAAAA,GAAa,MAAMb,gBAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACyE,YAAAA,CAAAA;AAEzDhG,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,kBAAQS;AAAK,SAAA,CAAA;AACtE1B,QAAAA,GAAAA,CAAImF,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA;;;;;;;;;;;;;MAcA,MAAMc,gBAAejG,GAAY,EAAA;AAC/B,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,gBAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMyF,cAAczF,gBAAAA,CAAW,MAAA,CAAA;AAC/B,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,kBAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;;AAGA,QAAA,MAAM,EAAE+B,IAAI,EAAEC,QAAQ,EAAE,GAAG/F,IAAAA;QAE3B,IAAI,CAAC8F,IAAAA,IAAQ,CAAC9D,KAAAA,CAAMC,OAAO,CAAC6D,IAAAA,CAAAA,IAASA,IAAAA,CAAK5D,MAAM,KAAK,CAAA,EAAG;YACtD,MAAM,IAAIV,YAAAA,CAAOW,gBAAgB,CAAC,mBAAA,CAAA;AACpC,QAAA;QAEA,IAAI2D,IAAAA,CAAK5D,MAAM,GAAG,EAAA,EAAI;YACpB,MAAM,IAAIV,YAAAA,CAAOW,gBAAgB,CAAC,qCAAA,CAAA;AACpC,QAAA;;AAGAxC,QAAAA,GAAAA,CAAIqG,OAAO,GAAG,KAAA;QACd,MAAMC,GAAAA,GAAMtG,IAAIsG,GAAG;QACnBA,GAAAA,CAAIC,SAAS,CAAC,GAAA,EAAK;YACjB,cAAA,EAAgB,mBAAA;YAChB,eAAA,EAAiB,UAAA;YACjBC,UAAAA,EAAY;AACd,SAAA,CAAA;QAEA,MAAMC,QAAAA,GAAW,CAACC,KAAAA,EAAe3E,IAAAA,GAAAA;AAC/BuE,YAAAA,GAAAA,CAAIK,KAAK,CAAC,CAAC,OAAO,EAAED,KAAAA,CAAM,QAAQ,EAAEb,IAAAA,CAAKE,SAAS,CAAChE,IAAAA,CAAAA,CAAM,IAAI,CAAC,CAAA;AAChE,QAAA,CAAA;QAEA,MAAM6E,KAAAA,GAAQT,KAAK5D,MAAM;AACzB,QAAA,MAAMsE,eAAkC,EAAE;AAC1C,QAAA,MAAMC,kBAAyB,EAAE;;QAGjC,MAAMC,mBAAAA,GAAsB,MAAMC,oBAAAA,CAAIC,OAAO,CAACC,sBAAKC,IAAI,CAACC,mBAAAA,CAAGC,MAAM,EAAA,EAAI,oBAAA,CAAA,CAAA;QACrE,MAAM,EAAEC,SAAS,EAAE,GAAGzE,OAAO0E,MAAM,CAACC,GAAG,CAAS,gBAAA,CAAA;QAEhD,IAAI;;YAEF,IAAK,IAAIC,IAAI,CAAA,EAAGA,CAAAA,GAAItB,KAAK5D,MAAM,EAAEkF,KAAK,CAAA,CAAG;gBACvC,MAAMC,GAAAA,GAAMvB,IAAI,CAACsB,CAAAA,CAAE;AAEnBhB,gBAAAA,QAAAA,CAAS,eAAA,EAAiB;AAAEiB,oBAAAA,GAAAA;oBAAKC,KAAAA,EAAOF,CAAAA;AAAGb,oBAAAA;AAAM,iBAAA,CAAA;gBAEjD,IAAI;;;AAGF,oBAAA,IAAIgB,cAAAA,GAAiB,CAAA;AACrB,oBAAA,IAAIC,gBAAAA,GAAmB,KAAA;AACvB,oBAAA,IAAIC,eAAAA,GAAkB,KAAA;AAEtB,oBAAA,MAAMC,kBAAkB,CAAC,EAAEC,YAAY,EAAEC,UAAU,EAAoB,GAAA;;;AAGrE,wBAAA,MAAMC,OAAAA,GAAU,CAACJ,eAAAA,IAAmBG,UAAAA,KAAe,QAAQD,YAAAA,IAAgBC,UAAAA;AAC3E,wBAAA,IACEJ,oBACA,CAACK,OAAAA,IACDC,KAAKC,GAAG,EAAA,GAAKR,iBAAiB9H,8BAAAA,EAC9B;AACA,4BAAA;AACF,wBAAA;wBAEA+H,gBAAAA,GAAmB,IAAA;AACnBC,wBAAAA,eAAAA,GAAkBA,eAAAA,IAAmBI,OAAAA;AACrCN,wBAAAA,cAAAA,GAAiBO,KAAKC,GAAG,EAAA;AAEzB3B,wBAAAA,QAAAA,CAAS,eAAA,EAAiB;4BACxBkB,KAAAA,EAAOF,CAAAA;4BACPY,WAAAA,EAAaL,YAAAA;AACbC,4BAAAA,UAAAA;4BACAK,KAAAA,EAAO;AACT,yBAAA,CAAA;AACF,oBAAA,CAAA;;oBAGA,MAAM,EAAErG,IAAI,EAAE,GAAG,MAAMiE,YAAYqC,mBAAmB,CACpDb,GAAAA,EACAX,mBAAAA,EACAO,SAAAA,EACAS,eAAAA,CAAAA;oBAEF,MAAMvC,QAAAA,GAAWvD,KAAKyC,gBAAgB;AAEtC+B,oBAAAA,QAAAA,CAAS,gBAAA,EAAkB;wBACzB9B,IAAAA,EAAMa,QAAAA;wBACNmC,KAAAA,EAAOF,CAAAA;AACPb,wBAAAA,KAAAA;AACArB,wBAAAA,IAAAA,EAAMtD,KAAKsD;AACb,qBAAA,CAAA;;AAGA,oBAAA,MAAMzE,QAAAA,GAA2B;wBAC/B6D,IAAAA,EAAMa,QAAAA;wBACNC,OAAAA,EAAS,IAAA;wBACTC,eAAAA,EAAiB,IAAA;AACjBC,wBAAAA,MAAAA,EAAQS,QAAAA,IAAY;AACtB,qBAAA;oBAEA,MAAM,EAAE3D,UAAU,EAAEZ,MAAAA,EAAQc,gBAAgB,EAAE,GAAG,MAAMC,mCAAAA,CACrDX,IAAAA,EACA;wBAAEnB,QAAAA,EAAU+E,IAAAA,CAAKE,SAAS,CAACjF,QAAAA;qBAAU,EACrC+B,MAAAA,CAAAA;oBAGF,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;AAC3B,wBAAA,MAAMiG,YAAAA,GAAe7F,gBAAgB,CAAC,CAAA,CAAE,EAAEG,OAAAA,IAAW,mBAAA;AACrD+D,wBAAAA,YAAAA,CAAa4B,IAAI,CAAC;4BAAE9D,IAAAA,EAAMa,QAAAA;4BAAU1C,OAAAA,EAAS0F;AAAa,yBAAA,CAAA;AAC1D/B,wBAAAA,QAAAA,CAAS,YAAA,EAAc;4BAAE9B,IAAAA,EAAMa,QAAAA;AAAUkC,4BAAAA,GAAAA;4BAAKC,KAAAA,EAAOF,CAAAA;4BAAG3E,OAAAA,EAAS0F;AAAa,yBAAA,CAAA;oBAChF,CAAA,MAAO;;wBAEL,MAAMzG,IAAAA,GAAO,MAAMC,yBAAAA,CAAmB;AAAElB,4BAAAA;yBAAS,EAAG,KAAA,CAAA;AACpD,wBAAA,MAAM,CAACkF,YAAAA,CAAa,GAAG,MAAMxF,aAAAA,CAAcuE,MAAM,CAC/C;AAAEhD,4BAAAA,IAAAA;4BAAMI,KAAAA,EAAO;AAACM,gCAAAA,UAAU,CAAC,CAAA;AAAG;yBAAC,EAC/B;AAAEtC,4BAAAA;AAAK,yBAAA,CAAA;;AAIT,wBAAA,MAAMmB,UAAAA,GAAa,MAAM4E,WAAAA,CAAY3E,YAAY,CAACyE,YAAAA,CAAAA;AAClDc,wBAAAA,eAAAA,CAAgB2B,IAAI,CAACnH,UAAAA,CAAAA;AAErBmF,wBAAAA,QAAAA,CAAS,eAAA,EAAiB;4BAAE9B,IAAAA,EAAMa,QAAAA;4BAAUmC,KAAAA,EAAOF,CAAAA;4BAAGxF,IAAAA,EAAMX;AAAW,yBAAA,CAAA;AACzE,oBAAA;AACF,gBAAA,CAAA,CAAE,OAAOkC,KAAAA,EAAO;AACd,oBAAA,MAAMgF,eAAehF,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA,CAAAA;AACrEqD,oBAAAA,YAAAA,CAAa4B,IAAI,CAAC;wBAAE9D,IAAAA,EAAM+C,GAAAA;wBAAK5E,OAAAA,EAAS0F;AAAa,qBAAA,CAAA;AACrD/B,oBAAAA,QAAAA,CAAS,YAAA,EAAc;AAAEiB,wBAAAA,GAAAA;wBAAKC,KAAAA,EAAOF,CAAAA;wBAAG3E,OAAAA,EAAS0F;AAAa,qBAAA,CAAA;AAChE,gBAAA;AACF,YAAA;;YAGA,IAAI1B,eAAAA,CAAgB9B,IAAI,CAAC,CAAC/C,OAASA,IAAAA,CAAKiB,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,CAAA,EAAY;gBACnE,MAAM1C,gBAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,YAAA;;AAGAwB,YAAAA,QAAAA,CAAS,iBAAA,EAAmB;AAC1B1E,gBAAAA,IAAAA,EAAM,MAAMhB,EAAAA,CAAGS,cAAc,CAACsF,eAAAA,EAAiB;AAAErF,oBAAAA,MAAAA,EAAQR,kBAAQS;AAAK,iBAAA,CAAA;gBACtEG,MAAAA,EAAQgF;AACV,aAAA,CAAA;QACF,CAAA,QAAU;;YAER,MAAMG,oBAAAA,CAAI0B,MAAM,CAAC3B,mBAAAA,CAAAA;AACnB,QAAA;AAEAT,QAAAA,GAAAA,CAAIqC,GAAG,EAAA;AACT,IAAA,CAAA;;AAGA,IAAA,MAAM5D,QAAO/E,GAAY,EAAA;AACvB,QAAA,MAAM,EACJ4B,KAAAA,EAAO,EAAEf,EAAE,EAAE,EACbT,OAAAA,EAAS,EAAE+B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACnC,GAAGnC,GAAAA;AAEJ,QAAA,IAAIqF,kBAAAA,CAAEC,OAAO,CAACnD,KAAAA,CAAAA,IAAW,CAACE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,IAAUA,KAAAA,CAAMoD,IAAI,KAAK,CAAA,EAAI;AACnE,YAAA,IAAI1E,EAAAA,EAAI;gBACN,OAAO,IAAI,CAACQ,cAAc,CAACrB,GAAAA,CAAAA;AAC7B,YAAA;YAEA,MAAM,IAAI6B,YAAAA,CAAOW,gBAAgB,CAAC,iBAAA,CAAA;AACpC,QAAA;QAEA,MAAO3B,CAAAA,EAAAA,GAAK,IAAI,CAACqB,WAAW,GAAG,IAAI,CAAC2B,WAAU,EAAG7D,GAAAA,CAAAA;AACnD,IAAA;AACF,CAAA;;;;"}
@@ -9,6 +9,13 @@ import { validateUploadBody, validateBulkUpdateBody } from './validation/admin/u
9
9
  import { findEntityAndCheckPermissions } from './utils/find-entity-and-check-permissions.mjs';
10
10
  import { prepareUploadRequest } from '../utils/mime-validation.mjs';
11
11
 
12
+ /**
13
+ * Minimum delay between two `file:progress` frames for the same URL.
14
+ *
15
+ * `fetchUrlToInputFile` reports once per streamed chunk (~8000 calls for a 512MB file at
16
+ * 64KB chunks); at ~5 frames a second a 10s transfer costs ~50 frames, which is plenty for
17
+ * a bar the user watches.
18
+ */ const URL_FETCH_PROGRESS_INTERVAL_MS = 200;
12
19
  var adminUpload = {
13
20
  async bulkUpdateFileInfo (ctx) {
14
21
  const { state: { userAbility, user }, request: { body } } = ctx;
@@ -240,6 +247,7 @@ var adminUpload = {
240
247
  * Accepts JSON body with URLs and fetches them server-side.
241
248
  * Streams Server-Sent Events as each URL is fetched and uploaded:
242
249
  * - file:fetching — when starting to fetch a URL
250
+ * - file:progress — throttled byte progress of the remote → server temp file transfer
243
251
  * - file:uploading — when upload starts for a fetched file
244
252
  * - file:complete — when a file is successfully uploaded
245
253
  * - file:error — when a URL fetch or upload fails
@@ -291,8 +299,30 @@ var adminUpload = {
291
299
  total
292
300
  });
293
301
  try {
302
+ // `fetchUrlToInputFile` reports raw, unthrottled progress — coalescing it into a
303
+ // sane frame rate is the caller's job. State is per URL: the loop is sequential.
304
+ let lastProgressAt = 0;
305
+ let hasAnnouncedSize = false;
306
+ let hasReachedTotal = false;
307
+ const onFetchProgress = ({ bytesWritten, totalBytes })=>{
308
+ // The frame that reaches the total always goes out, or a throttled last chunk
309
+ // leaves the row short of 100% until `file:complete`.
310
+ const isFinal = !hasReachedTotal && totalBytes !== null && bytesWritten >= totalBytes;
311
+ if (hasAnnouncedSize && !isFinal && Date.now() - lastProgressAt < URL_FETCH_PROGRESS_INTERVAL_MS) {
312
+ return;
313
+ }
314
+ hasAnnouncedSize = true;
315
+ hasReachedTotal = hasReachedTotal || isFinal;
316
+ lastProgressAt = Date.now();
317
+ writeSSE('file:progress', {
318
+ index: i,
319
+ loadedBytes: bytesWritten,
320
+ totalBytes,
321
+ phase: 'fetch'
322
+ });
323
+ };
294
324
  // Fetch URL to temp file
295
- const { file } = await fileService.fetchUrlToInputFile(url, tmpWorkingDirectory, sizeLimit);
325
+ const { file } = await fileService.fetchUrlToInputFile(url, tmpWorkingDirectory, sizeLimit, onFetchProgress);
296
326
  const fileName = file.originalFilename;
297
327
  writeSSE('file:uploading', {
298
328
  name: fileName,
@@ -1 +1 @@
1
- {"version":3,"file":"admin-upload.mjs","sources":["../../../server/src/controllers/admin-upload.ts"],"sourcesContent":["import os from 'os';\nimport path from 'path';\nimport fse from 'fs-extra';\nimport _ from 'lodash';\nimport { errors, async } from '@strapi/utils';\n\nimport type { Context } from 'koa';\n\nimport { getService } from '../utils';\nimport { ACTIONS, FILE_MODEL_UID } from '../constants';\nimport { validateBulkUpdateBody, validateUploadBody } from './validation/admin/upload';\nimport { findEntityAndCheckPermissions } from './utils/find-entity-and-check-permissions';\nimport { Config, FileInfo } from '../types';\nimport { prepareUploadRequest, type FileUploadError } from '../utils/mime-validation';\nimport type { UploadFileInfo } from '../../../shared/contracts/files';\n\nexport default {\n async bulkUpdateFileInfo(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const { updates } = await validateBulkUpdateBody(body);\n const uploadService = getService('upload');\n\n const results = await async.map(\n updates,\n async ({ id, fileInfo }: { id: number; fileInfo: FileInfo }) => {\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n const updated = await uploadService.updateFileInfo(id, fileInfo as any, { user });\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(updated);\n\n return pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n }\n );\n\n ctx.body = results;\n },\n\n /**\n * `PUT /upload/files/:id`\n *\n * Update the editable metadata (`fileInfo`) of an existing file. Also reached\n * through the `POST /upload` multiplexer, which delegates here with the id in\n * `ctx.query` — hence the dual read below, route params winning.\n */\n async updateFileInfo(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const id = ctx.params?.id ?? ctx.query.id;\n\n if (typeof id !== 'string') {\n throw new errors.ValidationError('File id is required');\n }\n\n const uploadService = getService('upload');\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n const data = await validateUploadBody(body);\n\n const file = await uploadService.updateFileInfo(id, data.fileInfo as any, { user });\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(file);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n },\n\n /**\n * `POST /upload/files/:id/replace`\n *\n * Replace the binary content of an existing file. Also reached through the\n * `POST /upload` multiplexer, which delegates here with the id in `ctx.query`\n * — hence the dual read below, route params winning.\n */\n async replaceFile(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files: filesInput } = {} },\n } = ctx;\n\n const id = ctx.params?.id ?? ctx.query.id;\n\n if (typeof id !== 'string') {\n throw new errors.ValidationError('File id is required');\n }\n\n const uploadService = getService('upload');\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n if (Array.isArray(filesInput) && filesInput.length > 1) {\n throw new errors.ApplicationError('Cannot replace a file with multiple ones');\n }\n\n const files = Array.isArray(filesInput) ? filesInput[0] : filesInput;\n\n const {\n validFiles,\n filteredBody,\n errors: validationErrors,\n } = await prepareUploadRequest(files, body, strapi);\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0].message);\n }\n\n const data = (await validateUploadBody(filteredBody)) as { fileInfo: FileInfo };\n const replacedFile = await uploadService.replace(id, { data, file: validFiles[0] }, { user });\n\n // Regenerate AI metadata for image replacements so the alt text / caption\n // reflect the new file content. Mirrors the post-upload hook in\n // `uploadFiles`; failure is logged and swallowed to keep the replace flow\n // resilient when the AI provider is unavailable.\n const aiMetadataService = getService('aiMetadata');\n if (replacedFile?.mime?.startsWith('image/') && (await aiMetadataService.isEnabled())) {\n try {\n const metadataResults = await aiMetadataService.processFiles([replacedFile]);\n await aiMetadataService.updateFilesWithAIMetadata([replacedFile], metadataResults, user);\n } catch (error) {\n strapi.log.warn('AI metadata generation failed on replace, proceeding without it', {\n error: error instanceof Error ? error.message : String(error),\n });\n }\n }\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(replacedFile);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n },\n\n async uploadFiles(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files } = {} },\n } = ctx;\n\n const uploadService = getService('upload');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n const {\n validFiles,\n filteredBody,\n errors: validationErrors,\n } = await prepareUploadRequest(files, body, strapi);\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0].message);\n }\n\n const isMultipleFiles = validFiles.length > 1;\n const data = await validateUploadBody(filteredBody, isMultipleFiles);\n\n let filesArray = validFiles;\n\n if (\n data.fileInfo &&\n Array.isArray(data.fileInfo) &&\n filesArray.length === data.fileInfo.length\n ) {\n // Reorder filesArray to match data.fileInfo order\n const alignedFilesArray = data.fileInfo\n .map((info) => {\n return filesArray.find((file) => file.originalFilename === info.name);\n })\n .filter(Boolean) as any[];\n\n filesArray = alignedFilesArray;\n }\n\n // Upload files first to get thumbnails\n const uploadedFiles = await uploadService.upload({ data, files: filesArray }, { user });\n if (uploadedFiles.some((file) => file.mime?.startsWith('image/'))) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n const aiMetadataService = getService('aiMetadata');\n\n // AFTER upload - generate AI metadata for images\n if (await aiMetadataService.isEnabled()) {\n try {\n const metadataResults = await aiMetadataService.processFiles(uploadedFiles);\n // Update the uploaded files with AI metadata\n await aiMetadataService.updateFilesWithAIMetadata(uploadedFiles, metadataResults, user);\n } catch (error) {\n strapi.log.warn('AI metadata generation failed, proceeding without AI enhancements', {\n error: error instanceof Error ? error.message : String(error),\n });\n }\n }\n\n // Sign file urls for private providers\n const signedFiles = await async.map(uploadedFiles, getService('file').signFileUrls);\n\n ctx.body = await pm.sanitizeOutput(signedFiles, { action: ACTIONS.read });\n ctx.status = 201;\n },\n\n /**\n * `POST /upload/files`\n *\n * Upload a single file and return the created File.\n *\n * Accepts one file per request (multipart `files` + `fileInfo`) and returns a\n * single `File` object. Unlike `uploadFiles`, it does **not** run AI metadata\n * generation inline — that responsibility is decoupled and will be handled by a\n * background job. Auth and permission checks mirror `POST /upload`.\n */\n async uploadFile(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files } = {} },\n } = ctx;\n\n const uploadService = getService('upload');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n if (_.isEmpty(files) || (!Array.isArray(files) && files.size === 0)) {\n throw new errors.ApplicationError('Files are empty');\n }\n\n // Accept a single file per request; ignore any extras defensively.\n const file = Array.isArray(files) ? files[0] : files;\n const fileName = file.originalFilename || 'unknown';\n\n // Parse the single fileInfo object from the multipart body.\n let fileInfo: UploadFileInfo = {\n name: fileName,\n caption: null,\n alternativeText: null,\n folder: null,\n };\n if (body?.fileInfo) {\n const raw = body.fileInfo;\n if (typeof raw === 'string') {\n fileInfo = JSON.parse(raw);\n } else if (Array.isArray(raw)) {\n fileInfo = (typeof raw[0] === 'string' ? JSON.parse(raw[0]) : raw[0]) as UploadFileInfo;\n } else {\n fileInfo = raw as UploadFileInfo;\n }\n }\n\n // Validate this single file using security checks.\n const { validFiles, errors: validationErrors } = await prepareUploadRequest(\n file,\n { fileInfo: JSON.stringify(fileInfo) },\n strapi\n );\n\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0]?.message || 'Validation failed');\n }\n\n const data = await validateUploadBody({ fileInfo }, false);\n const [uploadedFile] = await uploadService.upload({ data, files: [validFiles[0]] }, { user });\n\n if (uploadedFile.mime?.startsWith('image/')) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n // No inline AI metadata generation — intentionally decoupled for the async job.\n\n // Sign file url for private providers.\n const signedFile = await getService('file').signFileUrls(uploadedFile);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n ctx.status = 201;\n },\n\n /**\n * `POST /upload/actions/upload-from-urls`\n *\n * Upload files from URLs with SSE streaming for per-file progress\n *\n * Accepts JSON body with URLs and fetches them server-side.\n * Streams Server-Sent Events as each URL is fetched and uploaded:\n * - file:fetching — when starting to fetch a URL\n * - file:uploading — when upload starts for a fetched file\n * - file:complete — when a file is successfully uploaded\n * - file:error — when a URL fetch or upload fails\n * - stream:complete — final summary with all results\n */\n async uploadFromUrls(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const uploadService = getService('upload');\n const fileService = getService('file');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n // Parse and validate request body\n const { urls, folderId } = body as { urls?: string[]; folderId?: number | null };\n\n if (!urls || !Array.isArray(urls) || urls.length === 0) {\n throw new errors.ApplicationError('URLs are required');\n }\n\n if (urls.length > 20) {\n throw new errors.ApplicationError('Maximum 20 URLs allowed per request');\n }\n\n // Take manual control of the response for SSE streaming\n ctx.respond = false;\n const res = ctx.res;\n res.writeHead(200, {\n 'Content-Type': 'text/event-stream',\n 'Cache-Control': 'no-cache',\n Connection: 'keep-alive',\n });\n\n const writeSSE = (event: string, data: Record<string, unknown>) => {\n res.write(`event: ${event}\\ndata: ${JSON.stringify(data)}\\n\\n`);\n };\n\n const total = urls.length;\n const uploadErrors: FileUploadError[] = [];\n const successfulFiles: any[] = [];\n\n // Create temp directory for fetched files\n const tmpWorkingDirectory = await fse.mkdtemp(path.join(os.tmpdir(), 'strapi-url-upload-'));\n const { sizeLimit } = strapi.config.get<Config>('plugin::upload');\n\n try {\n // Process each URL sequentially\n for (let i = 0; i < urls.length; i += 1) {\n const url = urls[i];\n\n writeSSE('file:fetching', { url, index: i, total });\n\n try {\n // Fetch URL to temp file\n const { file } = await fileService.fetchUrlToInputFile(\n url,\n tmpWorkingDirectory,\n sizeLimit\n );\n const fileName = file.originalFilename;\n\n writeSSE('file:uploading', {\n name: fileName,\n index: i,\n total,\n size: file.size,\n });\n\n // Validate using security checks\n const fileInfo: UploadFileInfo = {\n name: fileName,\n caption: null,\n alternativeText: null,\n folder: folderId ?? null,\n };\n\n const { validFiles, errors: validationErrors } = await prepareUploadRequest(\n file,\n { fileInfo: JSON.stringify(fileInfo) },\n strapi\n );\n\n if (validFiles.length === 0) {\n const errorMessage = validationErrors[0]?.message || 'Validation failed';\n uploadErrors.push({ name: fileName, message: errorMessage });\n writeSSE('file:error', { name: fileName, url, index: i, message: errorMessage });\n } else {\n // Upload the file\n const data = await validateUploadBody({ fileInfo }, false);\n const [uploadedFile] = await uploadService.upload(\n { data, files: [validFiles[0]] },\n { user }\n );\n\n // Sign file url\n const signedFile = await fileService.signFileUrls(uploadedFile);\n successfulFiles.push(signedFile);\n\n writeSSE('file:complete', { name: fileName, index: i, file: signedFile });\n }\n } catch (error) {\n const errorMessage = error instanceof Error ? error.message : String(error);\n uploadErrors.push({ name: url, message: errorMessage });\n writeSSE('file:error', { url, index: i, message: errorMessage });\n }\n }\n\n // Track image upload metric once if any images were uploaded\n if (successfulFiles.some((file) => file.mime?.startsWith('image/'))) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n // Send final stream summary\n writeSSE('stream:complete', {\n data: await pm.sanitizeOutput(successfulFiles, { action: ACTIONS.read }),\n errors: uploadErrors,\n });\n } finally {\n // Clean up temp directory\n await fse.remove(tmpWorkingDirectory);\n }\n\n res.end();\n },\n\n // TODO: split into multiple endpoints\n async upload(ctx: Context) {\n const {\n query: { id },\n request: { files: { files } = {} },\n } = ctx;\n\n if (_.isEmpty(files) || (!Array.isArray(files) && files.size === 0)) {\n if (id) {\n return this.updateFileInfo(ctx);\n }\n\n throw new errors.ApplicationError('Files are empty');\n }\n\n await (id ? this.replaceFile : this.uploadFiles)(ctx);\n },\n};\n"],"names":["bulkUpdateFileInfo","ctx","state","userAbility","user","request","body","updates","validateBulkUpdateBody","uploadService","getService","results","async","map","id","fileInfo","pm","findEntityAndCheckPermissions","ACTIONS","update","FILE_MODEL_UID","updated","updateFileInfo","signedFile","signFileUrls","sanitizeOutput","action","read","params","query","errors","ValidationError","data","validateUploadBody","file","replaceFile","files","filesInput","Array","isArray","length","ApplicationError","validFiles","filteredBody","validationErrors","prepareUploadRequest","strapi","message","replacedFile","replace","aiMetadataService","mime","startsWith","isEnabled","metadataResults","processFiles","updateFilesWithAIMetadata","error","log","warn","Error","String","uploadFiles","service","createPermissionsManager","ability","create","model","isAllowed","forbidden","isMultipleFiles","filesArray","alignedFilesArray","info","find","originalFilename","name","filter","Boolean","uploadedFiles","upload","some","trackUsage","signedFiles","status","uploadFile","_","isEmpty","size","fileName","caption","alternativeText","folder","raw","JSON","parse","stringify","uploadedFile","uploadFromUrls","fileService","urls","folderId","respond","res","writeHead","Connection","writeSSE","event","write","total","uploadErrors","successfulFiles","tmpWorkingDirectory","fse","mkdtemp","path","join","os","tmpdir","sizeLimit","config","get","i","url","index","fetchUrlToInputFile","errorMessage","push","remove","end"],"mappings":";;;;;;;;;;;AAgBA,kBAAe;AACb,IAAA,MAAMA,oBAAmBC,GAAY,EAAA;AACnC,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;AAEJ,QAAA,MAAM,EAAEM,OAAO,EAAE,GAAG,MAAMC,sBAAAA,CAAuBF,IAAAA,CAAAA;AACjD,QAAA,MAAMG,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;QAEjC,MAAMC,OAAAA,GAAU,MAAMC,KAAAA,CAAMC,GAAG,CAC7BN,OAAAA,EACA,OAAO,EAAEO,EAAE,EAAEC,QAAQ,EAAsC,GAAA;YACzD,MAAM,EAAEC,EAAE,EAAE,GAAG,MAAMC,8BACnBd,WAAAA,EACAe,OAAAA,CAAQC,MAAM,EACdC,cAAAA,EACAN,EAAAA,CAAAA;AAGF,YAAA,MAAMO,UAAU,MAAMZ,aAAAA,CAAca,cAAc,CAACR,IAAIC,QAAAA,EAAiB;AAAEX,gBAAAA;AAAK,aAAA,CAAA;;AAG/E,YAAA,MAAMmB,UAAAA,GAAa,MAAMb,UAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACH,OAAAA,CAAAA;YAEzD,OAAOL,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,gBAAAA,MAAAA,EAAQR,QAAQS;AAAK,aAAA,CAAA;AAC9D,QAAA,CAAA,CAAA;AAGF1B,QAAAA,GAAAA,CAAIK,IAAI,GAAGK,OAAAA;AACb,IAAA,CAAA;AAEA;;;;;;MAOA,MAAMW,gBAAerB,GAAY,EAAA;AAC/B,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;QAEJ,MAAMa,EAAAA,GAAKb,IAAI2B,MAAM,EAAEd,MAAMb,GAAAA,CAAI4B,KAAK,CAACf,EAAE;QAEzC,IAAI,OAAOA,OAAO,QAAA,EAAU;YAC1B,MAAM,IAAIgB,MAAAA,CAAOC,eAAe,CAAC,qBAAA,CAAA;AACnC,QAAA;AAEA,QAAA,MAAMtB,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;QACjC,MAAM,EAAEM,EAAE,EAAE,GAAG,MAAMC,8BACnBd,WAAAA,EACAe,OAAAA,CAAQC,MAAM,EACdC,cAAAA,EACAN,EAAAA,CAAAA;QAGF,MAAMkB,IAAAA,GAAO,MAAMC,kBAAAA,CAAmB3B,IAAAA,CAAAA;QAEtC,MAAM4B,IAAAA,GAAO,MAAMzB,aAAAA,CAAca,cAAc,CAACR,EAAAA,EAAIkB,IAAAA,CAAKjB,QAAQ,EAAS;AAAEX,YAAAA;AAAK,SAAA,CAAA;;AAGjF,QAAA,MAAMmB,UAAAA,GAAa,MAAMb,UAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACU,IAAAA,CAAAA;AAEzDjC,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,QAAQS;AAAK,SAAA,CAAA;AACxE,IAAA,CAAA;AAEA;;;;;;MAOA,MAAMQ,aAAYlC,GAAY,EAAA;QAC5B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,OAAOC,UAAU,EAAE,GAAG,EAAE,EAAE,EACrD,GAAGpC,GAAAA;QAEJ,MAAMa,EAAAA,GAAKb,IAAI2B,MAAM,EAAEd,MAAMb,GAAAA,CAAI4B,KAAK,CAACf,EAAE;QAEzC,IAAI,OAAOA,OAAO,QAAA,EAAU;YAC1B,MAAM,IAAIgB,MAAAA,CAAOC,eAAe,CAAC,qBAAA,CAAA;AACnC,QAAA;AAEA,QAAA,MAAMtB,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;QACjC,MAAM,EAAEM,EAAE,EAAE,GAAG,MAAMC,8BACnBd,WAAAA,EACAe,OAAAA,CAAQC,MAAM,EACdC,cAAAA,EACAN,EAAAA,CAAAA;AAGF,QAAA,IAAIwB,MAAMC,OAAO,CAACF,eAAeA,UAAAA,CAAWG,MAAM,GAAG,CAAA,EAAG;YACtD,MAAM,IAAIV,MAAAA,CAAOW,gBAAgB,CAAC,0CAAA,CAAA;AACpC,QAAA;QAEA,MAAML,KAAAA,GAAQE,MAAMC,OAAO,CAACF,cAAcA,UAAU,CAAC,EAAE,GAAGA,UAAAA;AAE1D,QAAA,MAAM,EACJK,UAAU,EACVC,YAAY,EACZb,MAAAA,EAAQc,gBAAgB,EACzB,GAAG,MAAMC,oBAAAA,CAAqBT,KAAAA,EAAO9B,IAAAA,EAAMwC,MAAAA,CAAAA;QAC5C,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,OAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,CAACG,OAAO,CAAA;AAC9D,QAAA;QAEA,MAAMf,IAAAA,GAAQ,MAAMC,kBAAAA,CAAmBU,YAAAA,CAAAA;AACvC,QAAA,MAAMK,YAAAA,GAAe,MAAMvC,aAAAA,CAAcwC,OAAO,CAACnC,EAAAA,EAAI;AAAEkB,YAAAA,IAAAA;YAAME,IAAAA,EAAMQ,UAAU,CAAC,CAAA;SAAG,EAAG;AAAEtC,YAAAA;AAAK,SAAA,CAAA;;;;;AAM3F,QAAA,MAAM8C,oBAAoBxC,UAAAA,CAAW,YAAA,CAAA;AACrC,QAAA,IAAIsC,cAAcG,IAAAA,EAAMC,UAAAA,CAAW,aAAc,MAAMF,iBAAAA,CAAkBG,SAAS,EAAA,EAAK;YACrF,IAAI;AACF,gBAAA,MAAMC,eAAAA,GAAkB,MAAMJ,iBAAAA,CAAkBK,YAAY,CAAC;AAACP,oBAAAA;AAAa,iBAAA,CAAA;gBAC3E,MAAME,iBAAAA,CAAkBM,yBAAyB,CAAC;AAACR,oBAAAA;AAAa,iBAAA,EAAEM,eAAAA,EAAiBlD,IAAAA,CAAAA;AACrF,YAAA,CAAA,CAAE,OAAOqD,KAAAA,EAAO;AACdX,gBAAAA,MAAAA,CAAOY,GAAG,CAACC,IAAI,CAAC,iEAAA,EAAmE;AACjFF,oBAAAA,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA;AACzD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;;AAGA,QAAA,MAAMlC,UAAAA,GAAa,MAAMb,UAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACwB,YAAAA,CAAAA;AAEzD/C,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,QAAQS;AAAK,SAAA,CAAA;AACxE,IAAA,CAAA;AAEA,IAAA,MAAMmC,aAAY7D,GAAY,EAAA;QAC5B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACzC,GAAGnC,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,QAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAM,EACJ3B,UAAU,EACVC,YAAY,EACZb,MAAAA,EAAQc,gBAAgB,EACzB,GAAG,MAAMC,oBAAAA,CAAqBT,KAAAA,EAAO9B,IAAAA,EAAMwC,MAAAA,CAAAA;QAC5C,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,OAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,CAACG,OAAO,CAAA;AAC9D,QAAA;QAEA,MAAMuB,eAAAA,GAAkB5B,UAAAA,CAAWF,MAAM,GAAG,CAAA;QAC5C,MAAMR,IAAAA,GAAO,MAAMC,kBAAAA,CAAmBU,YAAAA,EAAc2B,eAAAA,CAAAA;AAEpD,QAAA,IAAIC,UAAAA,GAAa7B,UAAAA;AAEjB,QAAA,IACEV,KAAKjB,QAAQ,IACbuB,KAAAA,CAAMC,OAAO,CAACP,IAAAA,CAAKjB,QAAQ,CAAA,IAC3BwD,UAAAA,CAAW/B,MAAM,KAAKR,IAAAA,CAAKjB,QAAQ,CAACyB,MAAM,EAC1C;;AAEA,YAAA,MAAMgC,oBAAoBxC,IAAAA,CAAKjB,QAAQ,CACpCF,GAAG,CAAC,CAAC4D,IAAAA,GAAAA;gBACJ,OAAOF,UAAAA,CAAWG,IAAI,CAAC,CAACxC,OAASA,IAAAA,CAAKyC,gBAAgB,KAAKF,IAAAA,CAAKG,IAAI,CAAA;AACtE,YAAA,CAAA,CAAA,CACCC,MAAM,CAACC,OAAAA,CAAAA;YAEVP,UAAAA,GAAaC,iBAAAA;AACf,QAAA;;AAGA,QAAA,MAAMO,aAAAA,GAAgB,MAAMtE,aAAAA,CAAcuE,MAAM,CAAC;AAAEhD,YAAAA,IAAAA;YAAMI,KAAAA,EAAOmC;SAAW,EAAG;AAAEnE,YAAAA;AAAK,SAAA,CAAA;QACrF,IAAI2E,aAAAA,CAAcE,IAAI,CAAC,CAAC/C,OAASA,IAAAA,CAAKiB,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,CAAA,EAAY;YACjE,MAAM1C,UAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,QAAA;AAEA,QAAA,MAAMhC,oBAAoBxC,UAAAA,CAAW,YAAA,CAAA;;QAGrC,IAAI,MAAMwC,iBAAAA,CAAkBG,SAAS,EAAA,EAAI;YACvC,IAAI;AACF,gBAAA,MAAMC,eAAAA,GAAkB,MAAMJ,iBAAAA,CAAkBK,YAAY,CAACwB,aAAAA,CAAAA;;AAE7D,gBAAA,MAAM7B,iBAAAA,CAAkBM,yBAAyB,CAACuB,aAAAA,EAAezB,eAAAA,EAAiBlD,IAAAA,CAAAA;AACpF,YAAA,CAAA,CAAE,OAAOqD,KAAAA,EAAO;AACdX,gBAAAA,MAAAA,CAAOY,GAAG,CAACC,IAAI,CAAC,mEAAA,EAAqE;AACnFF,oBAAAA,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA;AACzD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;;QAGA,MAAM0B,WAAAA,GAAc,MAAMvE,KAAAA,CAAMC,GAAG,CAACkE,aAAAA,EAAerE,UAAAA,CAAW,QAAQc,YAAY,CAAA;AAElFvB,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAAC0D,WAAAA,EAAa;AAAEzD,YAAAA,MAAAA,EAAQR,QAAQS;AAAK,SAAA,CAAA;AACvE1B,QAAAA,GAAAA,CAAImF,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA;;;;;;;;;MAUA,MAAMC,YAAWpF,GAAY,EAAA;QAC3B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACzC,GAAGnC,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,QAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,IAAIiB,CAAAA,CAAEC,OAAO,CAACnD,KAAAA,CAAAA,IAAW,CAACE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,IAAUA,KAAAA,CAAMoD,IAAI,KAAK,CAAA,EAAI;YACnE,MAAM,IAAI1D,MAAAA,CAAOW,gBAAgB,CAAC,iBAAA,CAAA;AACpC,QAAA;;QAGA,MAAMP,IAAAA,GAAOI,MAAMC,OAAO,CAACH,SAASA,KAAK,CAAC,EAAE,GAAGA,KAAAA;QAC/C,MAAMqD,QAAAA,GAAWvD,IAAAA,CAAKyC,gBAAgB,IAAI,SAAA;;AAG1C,QAAA,IAAI5D,QAAAA,GAA2B;YAC7B6D,IAAAA,EAAMa,QAAAA;YACNC,OAAAA,EAAS,IAAA;YACTC,eAAAA,EAAiB,IAAA;YACjBC,MAAAA,EAAQ;AACV,SAAA;AACA,QAAA,IAAItF,MAAMS,QAAAA,EAAU;YAClB,MAAM8E,GAAAA,GAAMvF,KAAKS,QAAQ;YACzB,IAAI,OAAO8E,QAAQ,QAAA,EAAU;gBAC3B9E,QAAAA,GAAW+E,IAAAA,CAAKC,KAAK,CAACF,GAAAA,CAAAA;AACxB,YAAA,CAAA,MAAO,IAAIvD,KAAAA,CAAMC,OAAO,CAACsD,GAAAA,CAAAA,EAAM;AAC7B9E,gBAAAA,QAAAA,GAAY,OAAO8E,GAAG,CAAC,CAAA,CAAE,KAAK,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,GAAG,CAAC,CAAA,CAAE,CAAA,GAAIA,GAAG,CAAC,CAAA,CAAE;YACtE,CAAA,MAAO;gBACL9E,QAAAA,GAAW8E,GAAAA;AACb,YAAA;AACF,QAAA;;QAGA,MAAM,EAAEnD,UAAU,EAAEZ,MAAAA,EAAQc,gBAAgB,EAAE,GAAG,MAAMC,oBAAAA,CACrDX,IAAAA,EACA;YAAEnB,QAAAA,EAAU+E,IAAAA,CAAKE,SAAS,CAACjF,QAAAA;SAAU,EACrC+B,MAAAA,CAAAA;QAGF,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,OAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,EAAEG,OAAAA,IAAW,mBAAA,CAAA;AACnE,QAAA;QAEA,MAAMf,IAAAA,GAAO,MAAMC,kBAAAA,CAAmB;AAAElB,YAAAA;SAAS,EAAG,KAAA,CAAA;AACpD,QAAA,MAAM,CAACkF,YAAAA,CAAa,GAAG,MAAMxF,aAAAA,CAAcuE,MAAM,CAAC;AAAEhD,YAAAA,IAAAA;YAAMI,KAAAA,EAAO;AAACM,gBAAAA,UAAU,CAAC,CAAA;AAAG;SAAC,EAAG;AAAEtC,YAAAA;AAAK,SAAA,CAAA;AAE3F,QAAA,IAAI6F,YAAAA,CAAa9C,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,EAAW;YAC3C,MAAM1C,UAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,QAAA;;;AAKA,QAAA,MAAM3D,UAAAA,GAAa,MAAMb,UAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACyE,YAAAA,CAAAA;AAEzDhG,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,QAAQS;AAAK,SAAA,CAAA;AACtE1B,QAAAA,GAAAA,CAAImF,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA;;;;;;;;;;;;MAaA,MAAMc,gBAAejG,GAAY,EAAA;AAC/B,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMyF,cAAczF,UAAAA,CAAW,MAAA,CAAA;AAC/B,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,QAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;;AAGA,QAAA,MAAM,EAAE+B,IAAI,EAAEC,QAAQ,EAAE,GAAG/F,IAAAA;QAE3B,IAAI,CAAC8F,IAAAA,IAAQ,CAAC9D,KAAAA,CAAMC,OAAO,CAAC6D,IAAAA,CAAAA,IAASA,IAAAA,CAAK5D,MAAM,KAAK,CAAA,EAAG;YACtD,MAAM,IAAIV,MAAAA,CAAOW,gBAAgB,CAAC,mBAAA,CAAA;AACpC,QAAA;QAEA,IAAI2D,IAAAA,CAAK5D,MAAM,GAAG,EAAA,EAAI;YACpB,MAAM,IAAIV,MAAAA,CAAOW,gBAAgB,CAAC,qCAAA,CAAA;AACpC,QAAA;;AAGAxC,QAAAA,GAAAA,CAAIqG,OAAO,GAAG,KAAA;QACd,MAAMC,GAAAA,GAAMtG,IAAIsG,GAAG;QACnBA,GAAAA,CAAIC,SAAS,CAAC,GAAA,EAAK;YACjB,cAAA,EAAgB,mBAAA;YAChB,eAAA,EAAiB,UAAA;YACjBC,UAAAA,EAAY;AACd,SAAA,CAAA;QAEA,MAAMC,QAAAA,GAAW,CAACC,KAAAA,EAAe3E,IAAAA,GAAAA;AAC/BuE,YAAAA,GAAAA,CAAIK,KAAK,CAAC,CAAC,OAAO,EAAED,KAAAA,CAAM,QAAQ,EAAEb,IAAAA,CAAKE,SAAS,CAAChE,IAAAA,CAAAA,CAAM,IAAI,CAAC,CAAA;AAChE,QAAA,CAAA;QAEA,MAAM6E,KAAAA,GAAQT,KAAK5D,MAAM;AACzB,QAAA,MAAMsE,eAAkC,EAAE;AAC1C,QAAA,MAAMC,kBAAyB,EAAE;;QAGjC,MAAMC,mBAAAA,GAAsB,MAAMC,GAAAA,CAAIC,OAAO,CAACC,KAAKC,IAAI,CAACC,EAAAA,CAAGC,MAAM,EAAA,EAAI,oBAAA,CAAA,CAAA;QACrE,MAAM,EAAEC,SAAS,EAAE,GAAGzE,OAAO0E,MAAM,CAACC,GAAG,CAAS,gBAAA,CAAA;QAEhD,IAAI;;YAEF,IAAK,IAAIC,IAAI,CAAA,EAAGA,CAAAA,GAAItB,KAAK5D,MAAM,EAAEkF,KAAK,CAAA,CAAG;gBACvC,MAAMC,GAAAA,GAAMvB,IAAI,CAACsB,CAAAA,CAAE;AAEnBhB,gBAAAA,QAAAA,CAAS,eAAA,EAAiB;AAAEiB,oBAAAA,GAAAA;oBAAKC,KAAAA,EAAOF,CAAAA;AAAGb,oBAAAA;AAAM,iBAAA,CAAA;gBAEjD,IAAI;;oBAEF,MAAM,EAAE3E,IAAI,EAAE,GAAG,MAAMiE,WAAAA,CAAY0B,mBAAmB,CACpDF,GAAAA,EACAX,mBAAAA,EACAO,SAAAA,CAAAA;oBAEF,MAAM9B,QAAAA,GAAWvD,KAAKyC,gBAAgB;AAEtC+B,oBAAAA,QAAAA,CAAS,gBAAA,EAAkB;wBACzB9B,IAAAA,EAAMa,QAAAA;wBACNmC,KAAAA,EAAOF,CAAAA;AACPb,wBAAAA,KAAAA;AACArB,wBAAAA,IAAAA,EAAMtD,KAAKsD;AACb,qBAAA,CAAA;;AAGA,oBAAA,MAAMzE,QAAAA,GAA2B;wBAC/B6D,IAAAA,EAAMa,QAAAA;wBACNC,OAAAA,EAAS,IAAA;wBACTC,eAAAA,EAAiB,IAAA;AACjBC,wBAAAA,MAAAA,EAAQS,QAAAA,IAAY;AACtB,qBAAA;oBAEA,MAAM,EAAE3D,UAAU,EAAEZ,MAAAA,EAAQc,gBAAgB,EAAE,GAAG,MAAMC,oBAAAA,CACrDX,IAAAA,EACA;wBAAEnB,QAAAA,EAAU+E,IAAAA,CAAKE,SAAS,CAACjF,QAAAA;qBAAU,EACrC+B,MAAAA,CAAAA;oBAGF,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;AAC3B,wBAAA,MAAMsF,YAAAA,GAAelF,gBAAgB,CAAC,CAAA,CAAE,EAAEG,OAAAA,IAAW,mBAAA;AACrD+D,wBAAAA,YAAAA,CAAaiB,IAAI,CAAC;4BAAEnD,IAAAA,EAAMa,QAAAA;4BAAU1C,OAAAA,EAAS+E;AAAa,yBAAA,CAAA;AAC1DpB,wBAAAA,QAAAA,CAAS,YAAA,EAAc;4BAAE9B,IAAAA,EAAMa,QAAAA;AAAUkC,4BAAAA,GAAAA;4BAAKC,KAAAA,EAAOF,CAAAA;4BAAG3E,OAAAA,EAAS+E;AAAa,yBAAA,CAAA;oBAChF,CAAA,MAAO;;wBAEL,MAAM9F,IAAAA,GAAO,MAAMC,kBAAAA,CAAmB;AAAElB,4BAAAA;yBAAS,EAAG,KAAA,CAAA;AACpD,wBAAA,MAAM,CAACkF,YAAAA,CAAa,GAAG,MAAMxF,aAAAA,CAAcuE,MAAM,CAC/C;AAAEhD,4BAAAA,IAAAA;4BAAMI,KAAAA,EAAO;AAACM,gCAAAA,UAAU,CAAC,CAAA;AAAG;yBAAC,EAC/B;AAAEtC,4BAAAA;AAAK,yBAAA,CAAA;;AAIT,wBAAA,MAAMmB,UAAAA,GAAa,MAAM4E,WAAAA,CAAY3E,YAAY,CAACyE,YAAAA,CAAAA;AAClDc,wBAAAA,eAAAA,CAAgBgB,IAAI,CAACxG,UAAAA,CAAAA;AAErBmF,wBAAAA,QAAAA,CAAS,eAAA,EAAiB;4BAAE9B,IAAAA,EAAMa,QAAAA;4BAAUmC,KAAAA,EAAOF,CAAAA;4BAAGxF,IAAAA,EAAMX;AAAW,yBAAA,CAAA;AACzE,oBAAA;AACF,gBAAA,CAAA,CAAE,OAAOkC,KAAAA,EAAO;AACd,oBAAA,MAAMqE,eAAerE,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA,CAAAA;AACrEqD,oBAAAA,YAAAA,CAAaiB,IAAI,CAAC;wBAAEnD,IAAAA,EAAM+C,GAAAA;wBAAK5E,OAAAA,EAAS+E;AAAa,qBAAA,CAAA;AACrDpB,oBAAAA,QAAAA,CAAS,YAAA,EAAc;AAAEiB,wBAAAA,GAAAA;wBAAKC,KAAAA,EAAOF,CAAAA;wBAAG3E,OAAAA,EAAS+E;AAAa,qBAAA,CAAA;AAChE,gBAAA;AACF,YAAA;;YAGA,IAAIf,eAAAA,CAAgB9B,IAAI,CAAC,CAAC/C,OAASA,IAAAA,CAAKiB,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,CAAA,EAAY;gBACnE,MAAM1C,UAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,YAAA;;AAGAwB,YAAAA,QAAAA,CAAS,iBAAA,EAAmB;AAC1B1E,gBAAAA,IAAAA,EAAM,MAAMhB,EAAAA,CAAGS,cAAc,CAACsF,eAAAA,EAAiB;AAAErF,oBAAAA,MAAAA,EAAQR,QAAQS;AAAK,iBAAA,CAAA;gBACtEG,MAAAA,EAAQgF;AACV,aAAA,CAAA;QACF,CAAA,QAAU;;YAER,MAAMG,GAAAA,CAAIe,MAAM,CAAChB,mBAAAA,CAAAA;AACnB,QAAA;AAEAT,QAAAA,GAAAA,CAAI0B,GAAG,EAAA;AACT,IAAA,CAAA;;AAGA,IAAA,MAAMjD,QAAO/E,GAAY,EAAA;AACvB,QAAA,MAAM,EACJ4B,KAAAA,EAAO,EAAEf,EAAE,EAAE,EACbT,OAAAA,EAAS,EAAE+B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACnC,GAAGnC,GAAAA;AAEJ,QAAA,IAAIqF,CAAAA,CAAEC,OAAO,CAACnD,KAAAA,CAAAA,IAAW,CAACE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,IAAUA,KAAAA,CAAMoD,IAAI,KAAK,CAAA,EAAI;AACnE,YAAA,IAAI1E,EAAAA,EAAI;gBACN,OAAO,IAAI,CAACQ,cAAc,CAACrB,GAAAA,CAAAA;AAC7B,YAAA;YAEA,MAAM,IAAI6B,MAAAA,CAAOW,gBAAgB,CAAC,iBAAA,CAAA;AACpC,QAAA;QAEA,MAAO3B,CAAAA,EAAAA,GAAK,IAAI,CAACqB,WAAW,GAAG,IAAI,CAAC2B,WAAU,EAAG7D,GAAAA,CAAAA;AACnD,IAAA;AACF,CAAA;;;;"}
1
+ {"version":3,"file":"admin-upload.mjs","sources":["../../../server/src/controllers/admin-upload.ts"],"sourcesContent":["import os from 'os';\nimport path from 'path';\nimport fse from 'fs-extra';\nimport _ from 'lodash';\nimport { errors, async } from '@strapi/utils';\n\nimport type { Context } from 'koa';\n\nimport { getService } from '../utils';\nimport { ACTIONS, FILE_MODEL_UID } from '../constants';\nimport { validateBulkUpdateBody, validateUploadBody } from './validation/admin/upload';\nimport { findEntityAndCheckPermissions } from './utils/find-entity-and-check-permissions';\nimport { Config, FileInfo } from '../types';\nimport { prepareUploadRequest, type FileUploadError } from '../utils/mime-validation';\nimport type { UploadFileInfo } from '../../../shared/contracts/files';\nimport type { UrlFetchProgress } from '../services/file';\n\n/**\n * Minimum delay between two `file:progress` frames for the same URL.\n *\n * `fetchUrlToInputFile` reports once per streamed chunk (~8000 calls for a 512MB file at\n * 64KB chunks); at ~5 frames a second a 10s transfer costs ~50 frames, which is plenty for\n * a bar the user watches.\n */\nconst URL_FETCH_PROGRESS_INTERVAL_MS = 200;\n\nexport default {\n async bulkUpdateFileInfo(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const { updates } = await validateBulkUpdateBody(body);\n const uploadService = getService('upload');\n\n const results = await async.map(\n updates,\n async ({ id, fileInfo }: { id: number; fileInfo: FileInfo }) => {\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n const updated = await uploadService.updateFileInfo(id, fileInfo as any, { user });\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(updated);\n\n return pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n }\n );\n\n ctx.body = results;\n },\n\n /**\n * `PUT /upload/files/:id`\n *\n * Update the editable metadata (`fileInfo`) of an existing file. Also reached\n * through the `POST /upload` multiplexer, which delegates here with the id in\n * `ctx.query` — hence the dual read below, route params winning.\n */\n async updateFileInfo(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const id = ctx.params?.id ?? ctx.query.id;\n\n if (typeof id !== 'string') {\n throw new errors.ValidationError('File id is required');\n }\n\n const uploadService = getService('upload');\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n const data = await validateUploadBody(body);\n\n const file = await uploadService.updateFileInfo(id, data.fileInfo as any, { user });\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(file);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n },\n\n /**\n * `POST /upload/files/:id/replace`\n *\n * Replace the binary content of an existing file. Also reached through the\n * `POST /upload` multiplexer, which delegates here with the id in `ctx.query`\n * — hence the dual read below, route params winning.\n */\n async replaceFile(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files: filesInput } = {} },\n } = ctx;\n\n const id = ctx.params?.id ?? ctx.query.id;\n\n if (typeof id !== 'string') {\n throw new errors.ValidationError('File id is required');\n }\n\n const uploadService = getService('upload');\n const { pm } = await findEntityAndCheckPermissions(\n userAbility,\n ACTIONS.update,\n FILE_MODEL_UID,\n id\n );\n\n if (Array.isArray(filesInput) && filesInput.length > 1) {\n throw new errors.ApplicationError('Cannot replace a file with multiple ones');\n }\n\n const files = Array.isArray(filesInput) ? filesInput[0] : filesInput;\n\n const {\n validFiles,\n filteredBody,\n errors: validationErrors,\n } = await prepareUploadRequest(files, body, strapi);\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0].message);\n }\n\n const data = (await validateUploadBody(filteredBody)) as { fileInfo: FileInfo };\n const replacedFile = await uploadService.replace(id, { data, file: validFiles[0] }, { user });\n\n // Regenerate AI metadata for image replacements so the alt text / caption\n // reflect the new file content. Mirrors the post-upload hook in\n // `uploadFiles`; failure is logged and swallowed to keep the replace flow\n // resilient when the AI provider is unavailable.\n const aiMetadataService = getService('aiMetadata');\n if (replacedFile?.mime?.startsWith('image/') && (await aiMetadataService.isEnabled())) {\n try {\n const metadataResults = await aiMetadataService.processFiles([replacedFile]);\n await aiMetadataService.updateFilesWithAIMetadata([replacedFile], metadataResults, user);\n } catch (error) {\n strapi.log.warn('AI metadata generation failed on replace, proceeding without it', {\n error: error instanceof Error ? error.message : String(error),\n });\n }\n }\n\n // Sign file urls for private providers\n const signedFile = await getService('file').signFileUrls(replacedFile);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n },\n\n async uploadFiles(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files } = {} },\n } = ctx;\n\n const uploadService = getService('upload');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n const {\n validFiles,\n filteredBody,\n errors: validationErrors,\n } = await prepareUploadRequest(files, body, strapi);\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0].message);\n }\n\n const isMultipleFiles = validFiles.length > 1;\n const data = await validateUploadBody(filteredBody, isMultipleFiles);\n\n let filesArray = validFiles;\n\n if (\n data.fileInfo &&\n Array.isArray(data.fileInfo) &&\n filesArray.length === data.fileInfo.length\n ) {\n // Reorder filesArray to match data.fileInfo order\n const alignedFilesArray = data.fileInfo\n .map((info) => {\n return filesArray.find((file) => file.originalFilename === info.name);\n })\n .filter(Boolean) as any[];\n\n filesArray = alignedFilesArray;\n }\n\n // Upload files first to get thumbnails\n const uploadedFiles = await uploadService.upload({ data, files: filesArray }, { user });\n if (uploadedFiles.some((file) => file.mime?.startsWith('image/'))) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n const aiMetadataService = getService('aiMetadata');\n\n // AFTER upload - generate AI metadata for images\n if (await aiMetadataService.isEnabled()) {\n try {\n const metadataResults = await aiMetadataService.processFiles(uploadedFiles);\n // Update the uploaded files with AI metadata\n await aiMetadataService.updateFilesWithAIMetadata(uploadedFiles, metadataResults, user);\n } catch (error) {\n strapi.log.warn('AI metadata generation failed, proceeding without AI enhancements', {\n error: error instanceof Error ? error.message : String(error),\n });\n }\n }\n\n // Sign file urls for private providers\n const signedFiles = await async.map(uploadedFiles, getService('file').signFileUrls);\n\n ctx.body = await pm.sanitizeOutput(signedFiles, { action: ACTIONS.read });\n ctx.status = 201;\n },\n\n /**\n * `POST /upload/files`\n *\n * Upload a single file and return the created File.\n *\n * Accepts one file per request (multipart `files` + `fileInfo`) and returns a\n * single `File` object. Unlike `uploadFiles`, it does **not** run AI metadata\n * generation inline — that responsibility is decoupled and will be handled by a\n * background job. Auth and permission checks mirror `POST /upload`.\n */\n async uploadFile(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body, files: { files } = {} },\n } = ctx;\n\n const uploadService = getService('upload');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n if (_.isEmpty(files) || (!Array.isArray(files) && files.size === 0)) {\n throw new errors.ApplicationError('Files are empty');\n }\n\n // Accept a single file per request; ignore any extras defensively.\n const file = Array.isArray(files) ? files[0] : files;\n const fileName = file.originalFilename || 'unknown';\n\n // Parse the single fileInfo object from the multipart body.\n let fileInfo: UploadFileInfo = {\n name: fileName,\n caption: null,\n alternativeText: null,\n folder: null,\n };\n if (body?.fileInfo) {\n const raw = body.fileInfo;\n if (typeof raw === 'string') {\n fileInfo = JSON.parse(raw);\n } else if (Array.isArray(raw)) {\n fileInfo = (typeof raw[0] === 'string' ? JSON.parse(raw[0]) : raw[0]) as UploadFileInfo;\n } else {\n fileInfo = raw as UploadFileInfo;\n }\n }\n\n // Validate this single file using security checks.\n const { validFiles, errors: validationErrors } = await prepareUploadRequest(\n file,\n { fileInfo: JSON.stringify(fileInfo) },\n strapi\n );\n\n if (validFiles.length === 0) {\n throw new errors.ValidationError(validationErrors[0]?.message || 'Validation failed');\n }\n\n const data = await validateUploadBody({ fileInfo }, false);\n const [uploadedFile] = await uploadService.upload({ data, files: [validFiles[0]] }, { user });\n\n if (uploadedFile.mime?.startsWith('image/')) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n // No inline AI metadata generation — intentionally decoupled for the async job.\n\n // Sign file url for private providers.\n const signedFile = await getService('file').signFileUrls(uploadedFile);\n\n ctx.body = await pm.sanitizeOutput(signedFile, { action: ACTIONS.read });\n ctx.status = 201;\n },\n\n /**\n * `POST /upload/actions/upload-from-urls`\n *\n * Upload files from URLs with SSE streaming for per-file progress\n *\n * Accepts JSON body with URLs and fetches them server-side.\n * Streams Server-Sent Events as each URL is fetched and uploaded:\n * - file:fetching — when starting to fetch a URL\n * - file:progress — throttled byte progress of the remote → server temp file transfer\n * - file:uploading — when upload starts for a fetched file\n * - file:complete — when a file is successfully uploaded\n * - file:error — when a URL fetch or upload fails\n * - stream:complete — final summary with all results\n */\n async uploadFromUrls(ctx: Context) {\n const {\n state: { userAbility, user },\n request: { body },\n } = ctx;\n\n const uploadService = getService('upload');\n const fileService = getService('file');\n const pm = strapi.service('admin::permission').createPermissionsManager({\n ability: userAbility,\n action: ACTIONS.create,\n model: FILE_MODEL_UID,\n });\n\n if (!pm.isAllowed) {\n return ctx.forbidden();\n }\n\n // Parse and validate request body\n const { urls, folderId } = body as { urls?: string[]; folderId?: number | null };\n\n if (!urls || !Array.isArray(urls) || urls.length === 0) {\n throw new errors.ApplicationError('URLs are required');\n }\n\n if (urls.length > 20) {\n throw new errors.ApplicationError('Maximum 20 URLs allowed per request');\n }\n\n // Take manual control of the response for SSE streaming\n ctx.respond = false;\n const res = ctx.res;\n res.writeHead(200, {\n 'Content-Type': 'text/event-stream',\n 'Cache-Control': 'no-cache',\n Connection: 'keep-alive',\n });\n\n const writeSSE = (event: string, data: Record<string, unknown>) => {\n res.write(`event: ${event}\\ndata: ${JSON.stringify(data)}\\n\\n`);\n };\n\n const total = urls.length;\n const uploadErrors: FileUploadError[] = [];\n const successfulFiles: any[] = [];\n\n // Create temp directory for fetched files\n const tmpWorkingDirectory = await fse.mkdtemp(path.join(os.tmpdir(), 'strapi-url-upload-'));\n const { sizeLimit } = strapi.config.get<Config>('plugin::upload');\n\n try {\n // Process each URL sequentially\n for (let i = 0; i < urls.length; i += 1) {\n const url = urls[i];\n\n writeSSE('file:fetching', { url, index: i, total });\n\n try {\n // `fetchUrlToInputFile` reports raw, unthrottled progress — coalescing it into a\n // sane frame rate is the caller's job. State is per URL: the loop is sequential.\n let lastProgressAt = 0;\n let hasAnnouncedSize = false;\n let hasReachedTotal = false;\n\n const onFetchProgress = ({ bytesWritten, totalBytes }: UrlFetchProgress) => {\n // The frame that reaches the total always goes out, or a throttled last chunk\n // leaves the row short of 100% until `file:complete`.\n const isFinal = !hasReachedTotal && totalBytes !== null && bytesWritten >= totalBytes;\n if (\n hasAnnouncedSize &&\n !isFinal &&\n Date.now() - lastProgressAt < URL_FETCH_PROGRESS_INTERVAL_MS\n ) {\n return;\n }\n\n hasAnnouncedSize = true;\n hasReachedTotal = hasReachedTotal || isFinal;\n lastProgressAt = Date.now();\n\n writeSSE('file:progress', {\n index: i,\n loadedBytes: bytesWritten,\n totalBytes,\n phase: 'fetch',\n });\n };\n\n // Fetch URL to temp file\n const { file } = await fileService.fetchUrlToInputFile(\n url,\n tmpWorkingDirectory,\n sizeLimit,\n onFetchProgress\n );\n const fileName = file.originalFilename;\n\n writeSSE('file:uploading', {\n name: fileName,\n index: i,\n total,\n size: file.size,\n });\n\n // Validate using security checks\n const fileInfo: UploadFileInfo = {\n name: fileName,\n caption: null,\n alternativeText: null,\n folder: folderId ?? null,\n };\n\n const { validFiles, errors: validationErrors } = await prepareUploadRequest(\n file,\n { fileInfo: JSON.stringify(fileInfo) },\n strapi\n );\n\n if (validFiles.length === 0) {\n const errorMessage = validationErrors[0]?.message || 'Validation failed';\n uploadErrors.push({ name: fileName, message: errorMessage });\n writeSSE('file:error', { name: fileName, url, index: i, message: errorMessage });\n } else {\n // Upload the file\n const data = await validateUploadBody({ fileInfo }, false);\n const [uploadedFile] = await uploadService.upload(\n { data, files: [validFiles[0]] },\n { user }\n );\n\n // Sign file url\n const signedFile = await fileService.signFileUrls(uploadedFile);\n successfulFiles.push(signedFile);\n\n writeSSE('file:complete', { name: fileName, index: i, file: signedFile });\n }\n } catch (error) {\n const errorMessage = error instanceof Error ? error.message : String(error);\n uploadErrors.push({ name: url, message: errorMessage });\n writeSSE('file:error', { url, index: i, message: errorMessage });\n }\n }\n\n // Track image upload metric once if any images were uploaded\n if (successfulFiles.some((file) => file.mime?.startsWith('image/'))) {\n await getService('metrics').trackUsage('didUploadImage');\n }\n\n // Send final stream summary\n writeSSE('stream:complete', {\n data: await pm.sanitizeOutput(successfulFiles, { action: ACTIONS.read }),\n errors: uploadErrors,\n });\n } finally {\n // Clean up temp directory\n await fse.remove(tmpWorkingDirectory);\n }\n\n res.end();\n },\n\n // TODO: split into multiple endpoints\n async upload(ctx: Context) {\n const {\n query: { id },\n request: { files: { files } = {} },\n } = ctx;\n\n if (_.isEmpty(files) || (!Array.isArray(files) && files.size === 0)) {\n if (id) {\n return this.updateFileInfo(ctx);\n }\n\n throw new errors.ApplicationError('Files are empty');\n }\n\n await (id ? this.replaceFile : this.uploadFiles)(ctx);\n },\n};\n"],"names":["URL_FETCH_PROGRESS_INTERVAL_MS","bulkUpdateFileInfo","ctx","state","userAbility","user","request","body","updates","validateBulkUpdateBody","uploadService","getService","results","async","map","id","fileInfo","pm","findEntityAndCheckPermissions","ACTIONS","update","FILE_MODEL_UID","updated","updateFileInfo","signedFile","signFileUrls","sanitizeOutput","action","read","params","query","errors","ValidationError","data","validateUploadBody","file","replaceFile","files","filesInput","Array","isArray","length","ApplicationError","validFiles","filteredBody","validationErrors","prepareUploadRequest","strapi","message","replacedFile","replace","aiMetadataService","mime","startsWith","isEnabled","metadataResults","processFiles","updateFilesWithAIMetadata","error","log","warn","Error","String","uploadFiles","service","createPermissionsManager","ability","create","model","isAllowed","forbidden","isMultipleFiles","filesArray","alignedFilesArray","info","find","originalFilename","name","filter","Boolean","uploadedFiles","upload","some","trackUsage","signedFiles","status","uploadFile","_","isEmpty","size","fileName","caption","alternativeText","folder","raw","JSON","parse","stringify","uploadedFile","uploadFromUrls","fileService","urls","folderId","respond","res","writeHead","Connection","writeSSE","event","write","total","uploadErrors","successfulFiles","tmpWorkingDirectory","fse","mkdtemp","path","join","os","tmpdir","sizeLimit","config","get","i","url","index","lastProgressAt","hasAnnouncedSize","hasReachedTotal","onFetchProgress","bytesWritten","totalBytes","isFinal","Date","now","loadedBytes","phase","fetchUrlToInputFile","errorMessage","push","remove","end"],"mappings":";;;;;;;;;;;AAiBA;;;;;;AAMC,IACD,MAAMA,8BAAAA,GAAiC,GAAA;AAEvC,kBAAe;AACb,IAAA,MAAMC,oBAAmBC,GAAY,EAAA;AACnC,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;AAEJ,QAAA,MAAM,EAAEM,OAAO,EAAE,GAAG,MAAMC,sBAAAA,CAAuBF,IAAAA,CAAAA;AACjD,QAAA,MAAMG,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;QAEjC,MAAMC,OAAAA,GAAU,MAAMC,KAAAA,CAAMC,GAAG,CAC7BN,OAAAA,EACA,OAAO,EAAEO,EAAE,EAAEC,QAAQ,EAAsC,GAAA;YACzD,MAAM,EAAEC,EAAE,EAAE,GAAG,MAAMC,8BACnBd,WAAAA,EACAe,OAAAA,CAAQC,MAAM,EACdC,cAAAA,EACAN,EAAAA,CAAAA;AAGF,YAAA,MAAMO,UAAU,MAAMZ,aAAAA,CAAca,cAAc,CAACR,IAAIC,QAAAA,EAAiB;AAAEX,gBAAAA;AAAK,aAAA,CAAA;;AAG/E,YAAA,MAAMmB,UAAAA,GAAa,MAAMb,UAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACH,OAAAA,CAAAA;YAEzD,OAAOL,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,gBAAAA,MAAAA,EAAQR,QAAQS;AAAK,aAAA,CAAA;AAC9D,QAAA,CAAA,CAAA;AAGF1B,QAAAA,GAAAA,CAAIK,IAAI,GAAGK,OAAAA;AACb,IAAA,CAAA;AAEA;;;;;;MAOA,MAAMW,gBAAerB,GAAY,EAAA;AAC/B,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;QAEJ,MAAMa,EAAAA,GAAKb,IAAI2B,MAAM,EAAEd,MAAMb,GAAAA,CAAI4B,KAAK,CAACf,EAAE;QAEzC,IAAI,OAAOA,OAAO,QAAA,EAAU;YAC1B,MAAM,IAAIgB,MAAAA,CAAOC,eAAe,CAAC,qBAAA,CAAA;AACnC,QAAA;AAEA,QAAA,MAAMtB,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;QACjC,MAAM,EAAEM,EAAE,EAAE,GAAG,MAAMC,8BACnBd,WAAAA,EACAe,OAAAA,CAAQC,MAAM,EACdC,cAAAA,EACAN,EAAAA,CAAAA;QAGF,MAAMkB,IAAAA,GAAO,MAAMC,kBAAAA,CAAmB3B,IAAAA,CAAAA;QAEtC,MAAM4B,IAAAA,GAAO,MAAMzB,aAAAA,CAAca,cAAc,CAACR,EAAAA,EAAIkB,IAAAA,CAAKjB,QAAQ,EAAS;AAAEX,YAAAA;AAAK,SAAA,CAAA;;AAGjF,QAAA,MAAMmB,UAAAA,GAAa,MAAMb,UAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACU,IAAAA,CAAAA;AAEzDjC,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,QAAQS;AAAK,SAAA,CAAA;AACxE,IAAA,CAAA;AAEA;;;;;;MAOA,MAAMQ,aAAYlC,GAAY,EAAA;QAC5B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,OAAOC,UAAU,EAAE,GAAG,EAAE,EAAE,EACrD,GAAGpC,GAAAA;QAEJ,MAAMa,EAAAA,GAAKb,IAAI2B,MAAM,EAAEd,MAAMb,GAAAA,CAAI4B,KAAK,CAACf,EAAE;QAEzC,IAAI,OAAOA,OAAO,QAAA,EAAU;YAC1B,MAAM,IAAIgB,MAAAA,CAAOC,eAAe,CAAC,qBAAA,CAAA;AACnC,QAAA;AAEA,QAAA,MAAMtB,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;QACjC,MAAM,EAAEM,EAAE,EAAE,GAAG,MAAMC,8BACnBd,WAAAA,EACAe,OAAAA,CAAQC,MAAM,EACdC,cAAAA,EACAN,EAAAA,CAAAA;AAGF,QAAA,IAAIwB,MAAMC,OAAO,CAACF,eAAeA,UAAAA,CAAWG,MAAM,GAAG,CAAA,EAAG;YACtD,MAAM,IAAIV,MAAAA,CAAOW,gBAAgB,CAAC,0CAAA,CAAA;AACpC,QAAA;QAEA,MAAML,KAAAA,GAAQE,MAAMC,OAAO,CAACF,cAAcA,UAAU,CAAC,EAAE,GAAGA,UAAAA;AAE1D,QAAA,MAAM,EACJK,UAAU,EACVC,YAAY,EACZb,MAAAA,EAAQc,gBAAgB,EACzB,GAAG,MAAMC,oBAAAA,CAAqBT,KAAAA,EAAO9B,IAAAA,EAAMwC,MAAAA,CAAAA;QAC5C,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,OAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,CAACG,OAAO,CAAA;AAC9D,QAAA;QAEA,MAAMf,IAAAA,GAAQ,MAAMC,kBAAAA,CAAmBU,YAAAA,CAAAA;AACvC,QAAA,MAAMK,YAAAA,GAAe,MAAMvC,aAAAA,CAAcwC,OAAO,CAACnC,EAAAA,EAAI;AAAEkB,YAAAA,IAAAA;YAAME,IAAAA,EAAMQ,UAAU,CAAC,CAAA;SAAG,EAAG;AAAEtC,YAAAA;AAAK,SAAA,CAAA;;;;;AAM3F,QAAA,MAAM8C,oBAAoBxC,UAAAA,CAAW,YAAA,CAAA;AACrC,QAAA,IAAIsC,cAAcG,IAAAA,EAAMC,UAAAA,CAAW,aAAc,MAAMF,iBAAAA,CAAkBG,SAAS,EAAA,EAAK;YACrF,IAAI;AACF,gBAAA,MAAMC,eAAAA,GAAkB,MAAMJ,iBAAAA,CAAkBK,YAAY,CAAC;AAACP,oBAAAA;AAAa,iBAAA,CAAA;gBAC3E,MAAME,iBAAAA,CAAkBM,yBAAyB,CAAC;AAACR,oBAAAA;AAAa,iBAAA,EAAEM,eAAAA,EAAiBlD,IAAAA,CAAAA;AACrF,YAAA,CAAA,CAAE,OAAOqD,KAAAA,EAAO;AACdX,gBAAAA,MAAAA,CAAOY,GAAG,CAACC,IAAI,CAAC,iEAAA,EAAmE;AACjFF,oBAAAA,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA;AACzD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;;AAGA,QAAA,MAAMlC,UAAAA,GAAa,MAAMb,UAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACwB,YAAAA,CAAAA;AAEzD/C,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,QAAQS;AAAK,SAAA,CAAA;AACxE,IAAA,CAAA;AAEA,IAAA,MAAMmC,aAAY7D,GAAY,EAAA;QAC5B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACzC,GAAGnC,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,QAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,MAAM,EACJ3B,UAAU,EACVC,YAAY,EACZb,MAAAA,EAAQc,gBAAgB,EACzB,GAAG,MAAMC,oBAAAA,CAAqBT,KAAAA,EAAO9B,IAAAA,EAAMwC,MAAAA,CAAAA;QAC5C,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,OAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,CAACG,OAAO,CAAA;AAC9D,QAAA;QAEA,MAAMuB,eAAAA,GAAkB5B,UAAAA,CAAWF,MAAM,GAAG,CAAA;QAC5C,MAAMR,IAAAA,GAAO,MAAMC,kBAAAA,CAAmBU,YAAAA,EAAc2B,eAAAA,CAAAA;AAEpD,QAAA,IAAIC,UAAAA,GAAa7B,UAAAA;AAEjB,QAAA,IACEV,KAAKjB,QAAQ,IACbuB,KAAAA,CAAMC,OAAO,CAACP,IAAAA,CAAKjB,QAAQ,CAAA,IAC3BwD,UAAAA,CAAW/B,MAAM,KAAKR,IAAAA,CAAKjB,QAAQ,CAACyB,MAAM,EAC1C;;AAEA,YAAA,MAAMgC,oBAAoBxC,IAAAA,CAAKjB,QAAQ,CACpCF,GAAG,CAAC,CAAC4D,IAAAA,GAAAA;gBACJ,OAAOF,UAAAA,CAAWG,IAAI,CAAC,CAACxC,OAASA,IAAAA,CAAKyC,gBAAgB,KAAKF,IAAAA,CAAKG,IAAI,CAAA;AACtE,YAAA,CAAA,CAAA,CACCC,MAAM,CAACC,OAAAA,CAAAA;YAEVP,UAAAA,GAAaC,iBAAAA;AACf,QAAA;;AAGA,QAAA,MAAMO,aAAAA,GAAgB,MAAMtE,aAAAA,CAAcuE,MAAM,CAAC;AAAEhD,YAAAA,IAAAA;YAAMI,KAAAA,EAAOmC;SAAW,EAAG;AAAEnE,YAAAA;AAAK,SAAA,CAAA;QACrF,IAAI2E,aAAAA,CAAcE,IAAI,CAAC,CAAC/C,OAASA,IAAAA,CAAKiB,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,CAAA,EAAY;YACjE,MAAM1C,UAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,QAAA;AAEA,QAAA,MAAMhC,oBAAoBxC,UAAAA,CAAW,YAAA,CAAA;;QAGrC,IAAI,MAAMwC,iBAAAA,CAAkBG,SAAS,EAAA,EAAI;YACvC,IAAI;AACF,gBAAA,MAAMC,eAAAA,GAAkB,MAAMJ,iBAAAA,CAAkBK,YAAY,CAACwB,aAAAA,CAAAA;;AAE7D,gBAAA,MAAM7B,iBAAAA,CAAkBM,yBAAyB,CAACuB,aAAAA,EAAezB,eAAAA,EAAiBlD,IAAAA,CAAAA;AACpF,YAAA,CAAA,CAAE,OAAOqD,KAAAA,EAAO;AACdX,gBAAAA,MAAAA,CAAOY,GAAG,CAACC,IAAI,CAAC,mEAAA,EAAqE;AACnFF,oBAAAA,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA;AACzD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;;QAGA,MAAM0B,WAAAA,GAAc,MAAMvE,KAAAA,CAAMC,GAAG,CAACkE,aAAAA,EAAerE,UAAAA,CAAW,QAAQc,YAAY,CAAA;AAElFvB,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAAC0D,WAAAA,EAAa;AAAEzD,YAAAA,MAAAA,EAAQR,QAAQS;AAAK,SAAA,CAAA;AACvE1B,QAAAA,GAAAA,CAAImF,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA;;;;;;;;;MAUA,MAAMC,YAAWpF,GAAY,EAAA;QAC3B,MAAM,EACJC,OAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE8B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACzC,GAAGnC,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,QAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;AAEA,QAAA,IAAIiB,CAAAA,CAAEC,OAAO,CAACnD,KAAAA,CAAAA,IAAW,CAACE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,IAAUA,KAAAA,CAAMoD,IAAI,KAAK,CAAA,EAAI;YACnE,MAAM,IAAI1D,MAAAA,CAAOW,gBAAgB,CAAC,iBAAA,CAAA;AACpC,QAAA;;QAGA,MAAMP,IAAAA,GAAOI,MAAMC,OAAO,CAACH,SAASA,KAAK,CAAC,EAAE,GAAGA,KAAAA;QAC/C,MAAMqD,QAAAA,GAAWvD,IAAAA,CAAKyC,gBAAgB,IAAI,SAAA;;AAG1C,QAAA,IAAI5D,QAAAA,GAA2B;YAC7B6D,IAAAA,EAAMa,QAAAA;YACNC,OAAAA,EAAS,IAAA;YACTC,eAAAA,EAAiB,IAAA;YACjBC,MAAAA,EAAQ;AACV,SAAA;AACA,QAAA,IAAItF,MAAMS,QAAAA,EAAU;YAClB,MAAM8E,GAAAA,GAAMvF,KAAKS,QAAQ;YACzB,IAAI,OAAO8E,QAAQ,QAAA,EAAU;gBAC3B9E,QAAAA,GAAW+E,IAAAA,CAAKC,KAAK,CAACF,GAAAA,CAAAA;AACxB,YAAA,CAAA,MAAO,IAAIvD,KAAAA,CAAMC,OAAO,CAACsD,GAAAA,CAAAA,EAAM;AAC7B9E,gBAAAA,QAAAA,GAAY,OAAO8E,GAAG,CAAC,CAAA,CAAE,KAAK,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,GAAG,CAAC,CAAA,CAAE,CAAA,GAAIA,GAAG,CAAC,CAAA,CAAE;YACtE,CAAA,MAAO;gBACL9E,QAAAA,GAAW8E,GAAAA;AACb,YAAA;AACF,QAAA;;QAGA,MAAM,EAAEnD,UAAU,EAAEZ,MAAAA,EAAQc,gBAAgB,EAAE,GAAG,MAAMC,oBAAAA,CACrDX,IAAAA,EACA;YAAEnB,QAAAA,EAAU+E,IAAAA,CAAKE,SAAS,CAACjF,QAAAA;SAAU,EACrC+B,MAAAA,CAAAA;QAGF,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;YAC3B,MAAM,IAAIV,OAAOC,eAAe,CAACa,gBAAgB,CAAC,CAAA,CAAE,EAAEG,OAAAA,IAAW,mBAAA,CAAA;AACnE,QAAA;QAEA,MAAMf,IAAAA,GAAO,MAAMC,kBAAAA,CAAmB;AAAElB,YAAAA;SAAS,EAAG,KAAA,CAAA;AACpD,QAAA,MAAM,CAACkF,YAAAA,CAAa,GAAG,MAAMxF,aAAAA,CAAcuE,MAAM,CAAC;AAAEhD,YAAAA,IAAAA;YAAMI,KAAAA,EAAO;AAACM,gBAAAA,UAAU,CAAC,CAAA;AAAG;SAAC,EAAG;AAAEtC,YAAAA;AAAK,SAAA,CAAA;AAE3F,QAAA,IAAI6F,YAAAA,CAAa9C,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,EAAW;YAC3C,MAAM1C,UAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,QAAA;;;AAKA,QAAA,MAAM3D,UAAAA,GAAa,MAAMb,UAAAA,CAAW,MAAA,CAAA,CAAQc,YAAY,CAACyE,YAAAA,CAAAA;AAEzDhG,QAAAA,GAAAA,CAAIK,IAAI,GAAG,MAAMU,EAAAA,CAAGS,cAAc,CAACF,UAAAA,EAAY;AAAEG,YAAAA,MAAAA,EAAQR,QAAQS;AAAK,SAAA,CAAA;AACtE1B,QAAAA,GAAAA,CAAImF,MAAM,GAAG,GAAA;AACf,IAAA,CAAA;AAEA;;;;;;;;;;;;;MAcA,MAAMc,gBAAejG,GAAY,EAAA;AAC/B,QAAA,MAAM,EACJC,KAAAA,EAAO,EAAEC,WAAW,EAAEC,IAAI,EAAE,EAC5BC,OAAAA,EAAS,EAAEC,IAAI,EAAE,EAClB,GAAGL,GAAAA;AAEJ,QAAA,MAAMQ,gBAAgBC,UAAAA,CAAW,QAAA,CAAA;AACjC,QAAA,MAAMyF,cAAczF,UAAAA,CAAW,MAAA,CAAA;AAC/B,QAAA,MAAMM,KAAK8B,MAAAA,CAAOiB,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;YACtEC,OAAAA,EAAS9D,WAAAA;AACTuB,YAAAA,MAAAA,EAAQR,QAAQgD,MAAM;YACtBC,KAAAA,EAAO/C;AACT,SAAA,CAAA;QAEA,IAAI,CAACJ,EAAAA,CAAGoD,SAAS,EAAE;AACjB,YAAA,OAAOnE,IAAIoE,SAAS,EAAA;AACtB,QAAA;;AAGA,QAAA,MAAM,EAAE+B,IAAI,EAAEC,QAAQ,EAAE,GAAG/F,IAAAA;QAE3B,IAAI,CAAC8F,IAAAA,IAAQ,CAAC9D,KAAAA,CAAMC,OAAO,CAAC6D,IAAAA,CAAAA,IAASA,IAAAA,CAAK5D,MAAM,KAAK,CAAA,EAAG;YACtD,MAAM,IAAIV,MAAAA,CAAOW,gBAAgB,CAAC,mBAAA,CAAA;AACpC,QAAA;QAEA,IAAI2D,IAAAA,CAAK5D,MAAM,GAAG,EAAA,EAAI;YACpB,MAAM,IAAIV,MAAAA,CAAOW,gBAAgB,CAAC,qCAAA,CAAA;AACpC,QAAA;;AAGAxC,QAAAA,GAAAA,CAAIqG,OAAO,GAAG,KAAA;QACd,MAAMC,GAAAA,GAAMtG,IAAIsG,GAAG;QACnBA,GAAAA,CAAIC,SAAS,CAAC,GAAA,EAAK;YACjB,cAAA,EAAgB,mBAAA;YAChB,eAAA,EAAiB,UAAA;YACjBC,UAAAA,EAAY;AACd,SAAA,CAAA;QAEA,MAAMC,QAAAA,GAAW,CAACC,KAAAA,EAAe3E,IAAAA,GAAAA;AAC/BuE,YAAAA,GAAAA,CAAIK,KAAK,CAAC,CAAC,OAAO,EAAED,KAAAA,CAAM,QAAQ,EAAEb,IAAAA,CAAKE,SAAS,CAAChE,IAAAA,CAAAA,CAAM,IAAI,CAAC,CAAA;AAChE,QAAA,CAAA;QAEA,MAAM6E,KAAAA,GAAQT,KAAK5D,MAAM;AACzB,QAAA,MAAMsE,eAAkC,EAAE;AAC1C,QAAA,MAAMC,kBAAyB,EAAE;;QAGjC,MAAMC,mBAAAA,GAAsB,MAAMC,GAAAA,CAAIC,OAAO,CAACC,KAAKC,IAAI,CAACC,EAAAA,CAAGC,MAAM,EAAA,EAAI,oBAAA,CAAA,CAAA;QACrE,MAAM,EAAEC,SAAS,EAAE,GAAGzE,OAAO0E,MAAM,CAACC,GAAG,CAAS,gBAAA,CAAA;QAEhD,IAAI;;YAEF,IAAK,IAAIC,IAAI,CAAA,EAAGA,CAAAA,GAAItB,KAAK5D,MAAM,EAAEkF,KAAK,CAAA,CAAG;gBACvC,MAAMC,GAAAA,GAAMvB,IAAI,CAACsB,CAAAA,CAAE;AAEnBhB,gBAAAA,QAAAA,CAAS,eAAA,EAAiB;AAAEiB,oBAAAA,GAAAA;oBAAKC,KAAAA,EAAOF,CAAAA;AAAGb,oBAAAA;AAAM,iBAAA,CAAA;gBAEjD,IAAI;;;AAGF,oBAAA,IAAIgB,cAAAA,GAAiB,CAAA;AACrB,oBAAA,IAAIC,gBAAAA,GAAmB,KAAA;AACvB,oBAAA,IAAIC,eAAAA,GAAkB,KAAA;AAEtB,oBAAA,MAAMC,kBAAkB,CAAC,EAAEC,YAAY,EAAEC,UAAU,EAAoB,GAAA;;;AAGrE,wBAAA,MAAMC,OAAAA,GAAU,CAACJ,eAAAA,IAAmBG,UAAAA,KAAe,QAAQD,YAAAA,IAAgBC,UAAAA;AAC3E,wBAAA,IACEJ,oBACA,CAACK,OAAAA,IACDC,KAAKC,GAAG,EAAA,GAAKR,iBAAiB9H,8BAAAA,EAC9B;AACA,4BAAA;AACF,wBAAA;wBAEA+H,gBAAAA,GAAmB,IAAA;AACnBC,wBAAAA,eAAAA,GAAkBA,eAAAA,IAAmBI,OAAAA;AACrCN,wBAAAA,cAAAA,GAAiBO,KAAKC,GAAG,EAAA;AAEzB3B,wBAAAA,QAAAA,CAAS,eAAA,EAAiB;4BACxBkB,KAAAA,EAAOF,CAAAA;4BACPY,WAAAA,EAAaL,YAAAA;AACbC,4BAAAA,UAAAA;4BACAK,KAAAA,EAAO;AACT,yBAAA,CAAA;AACF,oBAAA,CAAA;;oBAGA,MAAM,EAAErG,IAAI,EAAE,GAAG,MAAMiE,YAAYqC,mBAAmB,CACpDb,GAAAA,EACAX,mBAAAA,EACAO,SAAAA,EACAS,eAAAA,CAAAA;oBAEF,MAAMvC,QAAAA,GAAWvD,KAAKyC,gBAAgB;AAEtC+B,oBAAAA,QAAAA,CAAS,gBAAA,EAAkB;wBACzB9B,IAAAA,EAAMa,QAAAA;wBACNmC,KAAAA,EAAOF,CAAAA;AACPb,wBAAAA,KAAAA;AACArB,wBAAAA,IAAAA,EAAMtD,KAAKsD;AACb,qBAAA,CAAA;;AAGA,oBAAA,MAAMzE,QAAAA,GAA2B;wBAC/B6D,IAAAA,EAAMa,QAAAA;wBACNC,OAAAA,EAAS,IAAA;wBACTC,eAAAA,EAAiB,IAAA;AACjBC,wBAAAA,MAAAA,EAAQS,QAAAA,IAAY;AACtB,qBAAA;oBAEA,MAAM,EAAE3D,UAAU,EAAEZ,MAAAA,EAAQc,gBAAgB,EAAE,GAAG,MAAMC,oBAAAA,CACrDX,IAAAA,EACA;wBAAEnB,QAAAA,EAAU+E,IAAAA,CAAKE,SAAS,CAACjF,QAAAA;qBAAU,EACrC+B,MAAAA,CAAAA;oBAGF,IAAIJ,UAAAA,CAAWF,MAAM,KAAK,CAAA,EAAG;AAC3B,wBAAA,MAAMiG,YAAAA,GAAe7F,gBAAgB,CAAC,CAAA,CAAE,EAAEG,OAAAA,IAAW,mBAAA;AACrD+D,wBAAAA,YAAAA,CAAa4B,IAAI,CAAC;4BAAE9D,IAAAA,EAAMa,QAAAA;4BAAU1C,OAAAA,EAAS0F;AAAa,yBAAA,CAAA;AAC1D/B,wBAAAA,QAAAA,CAAS,YAAA,EAAc;4BAAE9B,IAAAA,EAAMa,QAAAA;AAAUkC,4BAAAA,GAAAA;4BAAKC,KAAAA,EAAOF,CAAAA;4BAAG3E,OAAAA,EAAS0F;AAAa,yBAAA,CAAA;oBAChF,CAAA,MAAO;;wBAEL,MAAMzG,IAAAA,GAAO,MAAMC,kBAAAA,CAAmB;AAAElB,4BAAAA;yBAAS,EAAG,KAAA,CAAA;AACpD,wBAAA,MAAM,CAACkF,YAAAA,CAAa,GAAG,MAAMxF,aAAAA,CAAcuE,MAAM,CAC/C;AAAEhD,4BAAAA,IAAAA;4BAAMI,KAAAA,EAAO;AAACM,gCAAAA,UAAU,CAAC,CAAA;AAAG;yBAAC,EAC/B;AAAEtC,4BAAAA;AAAK,yBAAA,CAAA;;AAIT,wBAAA,MAAMmB,UAAAA,GAAa,MAAM4E,WAAAA,CAAY3E,YAAY,CAACyE,YAAAA,CAAAA;AAClDc,wBAAAA,eAAAA,CAAgB2B,IAAI,CAACnH,UAAAA,CAAAA;AAErBmF,wBAAAA,QAAAA,CAAS,eAAA,EAAiB;4BAAE9B,IAAAA,EAAMa,QAAAA;4BAAUmC,KAAAA,EAAOF,CAAAA;4BAAGxF,IAAAA,EAAMX;AAAW,yBAAA,CAAA;AACzE,oBAAA;AACF,gBAAA,CAAA,CAAE,OAAOkC,KAAAA,EAAO;AACd,oBAAA,MAAMgF,eAAehF,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMV,OAAO,GAAGc,MAAAA,CAAOJ,KAAAA,CAAAA;AACrEqD,oBAAAA,YAAAA,CAAa4B,IAAI,CAAC;wBAAE9D,IAAAA,EAAM+C,GAAAA;wBAAK5E,OAAAA,EAAS0F;AAAa,qBAAA,CAAA;AACrD/B,oBAAAA,QAAAA,CAAS,YAAA,EAAc;AAAEiB,wBAAAA,GAAAA;wBAAKC,KAAAA,EAAOF,CAAAA;wBAAG3E,OAAAA,EAAS0F;AAAa,qBAAA,CAAA;AAChE,gBAAA;AACF,YAAA;;YAGA,IAAI1B,eAAAA,CAAgB9B,IAAI,CAAC,CAAC/C,OAASA,IAAAA,CAAKiB,IAAI,EAAEC,UAAAA,CAAW,QAAA,CAAA,CAAA,EAAY;gBACnE,MAAM1C,UAAAA,CAAW,SAAA,CAAA,CAAWwE,UAAU,CAAC,gBAAA,CAAA;AACzC,YAAA;;AAGAwB,YAAAA,QAAAA,CAAS,iBAAA,EAAmB;AAC1B1E,gBAAAA,IAAAA,EAAM,MAAMhB,EAAAA,CAAGS,cAAc,CAACsF,eAAAA,EAAiB;AAAErF,oBAAAA,MAAAA,EAAQR,QAAQS;AAAK,iBAAA,CAAA;gBACtEG,MAAAA,EAAQgF;AACV,aAAA,CAAA;QACF,CAAA,QAAU;;YAER,MAAMG,GAAAA,CAAI0B,MAAM,CAAC3B,mBAAAA,CAAAA;AACnB,QAAA;AAEAT,QAAAA,GAAAA,CAAIqC,GAAG,EAAA;AACT,IAAA,CAAA;;AAGA,IAAA,MAAM5D,QAAO/E,GAAY,EAAA;AACvB,QAAA,MAAM,EACJ4B,KAAAA,EAAO,EAAEf,EAAE,EAAE,EACbT,OAAAA,EAAS,EAAE+B,KAAAA,EAAO,EAAEA,KAAK,EAAE,GAAG,EAAE,EAAE,EACnC,GAAGnC,GAAAA;AAEJ,QAAA,IAAIqF,CAAAA,CAAEC,OAAO,CAACnD,KAAAA,CAAAA,IAAW,CAACE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,IAAUA,KAAAA,CAAMoD,IAAI,KAAK,CAAA,EAAI;AACnE,YAAA,IAAI1E,EAAAA,EAAI;gBACN,OAAO,IAAI,CAACQ,cAAc,CAACrB,GAAAA,CAAAA;AAC7B,YAAA;YAEA,MAAM,IAAI6B,MAAAA,CAAOW,gBAAgB,CAAC,iBAAA,CAAA;AACpC,QAAA;QAEA,MAAO3B,CAAAA,EAAAA,GAAK,IAAI,CAACqB,WAAW,GAAG,IAAI,CAAC2B,WAAU,EAAG7D,GAAAA,CAAAA;AACnD,IAAA;AACF,CAAA;;;;"}
@@ -8,15 +8,26 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
8
8
 
9
9
  var ___default = /*#__PURE__*/_interopDefault(_);
10
10
 
11
- const findEntityAndCheckPermissions = async (ability, action, model, id)=>{
12
- const file = await index.getService('upload').findOne(id, [
11
+ /**
12
+ * Loads a file and enforces the permission *conditions* attached to `action` on it.
13
+ *
14
+ * `createdBy` and the creator's `roles` have to be populated before `toSubject`: the admin
15
+ * conditions read them (`admin::is-creator` matches `createdBy.id`, `admin::has-same-role-as-creator`
16
+ * matches `createdBy.roles`), and a subject missing those fields can never satisfy the rule — so
17
+ * a conditioned grant would be denied its own files rather than allowed them.
18
+ *
19
+ * `strapiInstance` defaults to the ambient global for the admin controllers, which have no
20
+ * `strapi` in scope. Callers that are handed an instance — MCP tool handlers — pass it
21
+ * explicitly so they never bind to a different one.
22
+ */ const findEntityAndCheckPermissions = async (ability, action, model, id, strapiInstance = strapi)=>{
23
+ const file = await index.getService('upload', strapiInstance).findOne(id, [
13
24
  utils.contentTypes.constants.CREATED_BY_ATTRIBUTE,
14
25
  'folder'
15
26
  ]);
16
27
  if (___default.default.isNil(file)) {
17
28
  throw new utils.errors.NotFoundError();
18
29
  }
19
- const pm = strapi.service('admin::permission').createPermissionsManager({
30
+ const pm = strapiInstance.service('admin::permission').createPermissionsManager({
20
31
  ability,
21
32
  action,
22
33
  model
@@ -25,7 +36,7 @@ const findEntityAndCheckPermissions = async (ability, action, model, id)=>{
25
36
  utils.contentTypes.constants.CREATED_BY_ATTRIBUTE,
26
37
  'id'
27
38
  ]);
28
- const author = creatorId ? await strapi.service('admin::user').findOne(creatorId, [
39
+ const author = creatorId ? await strapiInstance.service('admin::user').findOne(creatorId, [
29
40
  'roles'
30
41
  ]) : null;
31
42
  const fileWithRoles = ___default.default.set(___default.default.cloneDeep(file), 'createdBy', author);
@@ -1 +1 @@
1
- {"version":3,"file":"find-entity-and-check-permissions.js","sources":["../../../../server/src/controllers/utils/find-entity-and-check-permissions.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors, contentTypes as contentTypesUtils } from '@strapi/utils';\nimport { getService } from '../../utils';\n\nconst findEntityAndCheckPermissions = async (\n ability: unknown,\n action: string,\n model: string,\n id: string | number\n) => {\n const file = await getService('upload').findOne(id, [\n contentTypesUtils.constants.CREATED_BY_ATTRIBUTE,\n 'folder',\n ]);\n\n if (_.isNil(file)) {\n throw new errors.NotFoundError();\n }\n\n const pm = strapi\n .service('admin::permission')\n .createPermissionsManager({ ability, action, model });\n\n const creatorId = _.get(file, [contentTypesUtils.constants.CREATED_BY_ATTRIBUTE, 'id']);\n const author = creatorId\n ? await strapi.service('admin::user').findOne(creatorId, ['roles'])\n : null;\n\n const fileWithRoles = _.set(_.cloneDeep(file), 'createdBy', author);\n\n if (pm.ability.cannot(pm.action, pm.toSubject(fileWithRoles))) {\n throw new errors.ForbiddenError();\n }\n\n return { pm, file };\n};\n\nexport { findEntityAndCheckPermissions };\n"],"names":["findEntityAndCheckPermissions","ability","action","model","id","file","getService","findOne","contentTypesUtils","constants","CREATED_BY_ATTRIBUTE","_","isNil","errors","NotFoundError","pm","strapi","service","createPermissionsManager","creatorId","get","author","fileWithRoles","set","cloneDeep","cannot","toSubject","ForbiddenError"],"mappings":";;;;;;;;;;AAIA,MAAMA,6BAAAA,GAAgC,OACpCC,OAAAA,EACAC,MAAAA,EACAC,KAAAA,EACAC,EAAAA,GAAAA;AAEA,IAAA,MAAMC,OAAO,MAAMC,gBAAAA,CAAW,QAAA,CAAA,CAAUC,OAAO,CAACH,EAAAA,EAAI;QAClDI,kBAAAA,CAAkBC,SAAS,CAACC,oBAAoB;AAChD,QAAA;AACD,KAAA,CAAA;IAED,IAAIC,kBAAAA,CAAEC,KAAK,CAACP,IAAAA,CAAAA,EAAO;QACjB,MAAM,IAAIQ,aAAOC,aAAa,EAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,KAAKC,MAAAA,CACRC,OAAO,CAAC,mBAAA,CAAA,CACRC,wBAAwB,CAAC;AAAEjB,QAAAA,OAAAA;AAASC,QAAAA,MAAAA;AAAQC,QAAAA;AAAM,KAAA,CAAA;AAErD,IAAA,MAAMgB,SAAAA,GAAYR,kBAAAA,CAAES,GAAG,CAACf,IAAAA,EAAM;QAACG,kBAAAA,CAAkBC,SAAS,CAACC,oBAAoB;AAAE,QAAA;AAAK,KAAA,CAAA;IACtF,MAAMW,MAAAA,GAASF,YACX,MAAMH,MAAAA,CAAOC,OAAO,CAAC,aAAA,CAAA,CAAeV,OAAO,CAACY,SAAAA,EAAW;AAAC,QAAA;KAAQ,CAAA,GAChE,IAAA;IAEJ,MAAMG,aAAAA,GAAgBX,mBAAEY,GAAG,CAACZ,mBAAEa,SAAS,CAACnB,OAAO,WAAA,EAAagB,MAAAA,CAAAA;IAE5D,IAAIN,EAAAA,CAAGd,OAAO,CAACwB,MAAM,CAACV,EAAAA,CAAGb,MAAM,EAAEa,EAAAA,CAAGW,SAAS,CAACJ,aAAAA,CAAAA,CAAAA,EAAiB;QAC7D,MAAM,IAAIT,aAAOc,cAAc,EAAA;AACjC,IAAA;IAEA,OAAO;AAAEZ,QAAAA,EAAAA;AAAIV,QAAAA;AAAK,KAAA;AACpB;;;;"}
1
+ {"version":3,"file":"find-entity-and-check-permissions.js","sources":["../../../../server/src/controllers/utils/find-entity-and-check-permissions.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors, contentTypes as contentTypesUtils } from '@strapi/utils';\nimport type { Core } from '@strapi/types';\nimport { getService } from '../../utils';\n\n/**\n * Loads a file and enforces the permission *conditions* attached to `action` on it.\n *\n * `createdBy` and the creator's `roles` have to be populated before `toSubject`: the admin\n * conditions read them (`admin::is-creator` matches `createdBy.id`, `admin::has-same-role-as-creator`\n * matches `createdBy.roles`), and a subject missing those fields can never satisfy the rule — so\n * a conditioned grant would be denied its own files rather than allowed them.\n *\n * `strapiInstance` defaults to the ambient global for the admin controllers, which have no\n * `strapi` in scope. Callers that are handed an instance — MCP tool handlers — pass it\n * explicitly so they never bind to a different one.\n */\nconst findEntityAndCheckPermissions = async (\n ability: unknown,\n action: string,\n model: string,\n id: string | number,\n strapiInstance: Core.Strapi = strapi\n) => {\n const file = await getService('upload', strapiInstance).findOne(id, [\n contentTypesUtils.constants.CREATED_BY_ATTRIBUTE,\n 'folder',\n ]);\n\n if (_.isNil(file)) {\n throw new errors.NotFoundError();\n }\n\n const pm = strapiInstance\n .service('admin::permission')\n .createPermissionsManager({ ability, action, model });\n\n const creatorId = _.get(file, [contentTypesUtils.constants.CREATED_BY_ATTRIBUTE, 'id']);\n const author = creatorId\n ? await strapiInstance.service('admin::user').findOne(creatorId, ['roles'])\n : null;\n\n const fileWithRoles = _.set(_.cloneDeep(file), 'createdBy', author);\n\n if (pm.ability.cannot(pm.action, pm.toSubject(fileWithRoles))) {\n throw new errors.ForbiddenError();\n }\n\n return { pm, file };\n};\n\nexport { findEntityAndCheckPermissions };\n"],"names":["findEntityAndCheckPermissions","ability","action","model","id","strapiInstance","strapi","file","getService","findOne","contentTypesUtils","constants","CREATED_BY_ATTRIBUTE","_","isNil","errors","NotFoundError","pm","service","createPermissionsManager","creatorId","get","author","fileWithRoles","set","cloneDeep","cannot","toSubject","ForbiddenError"],"mappings":";;;;;;;;;;AAKA;;;;;;;;;;;IAYA,MAAMA,gCAAgC,OACpCC,OAAAA,EACAC,QACAC,KAAAA,EACAC,EAAAA,EACAC,iBAA8BC,MAAM,GAAA;AAEpC,IAAA,MAAMC,OAAO,MAAMC,gBAAAA,CAAW,UAAUH,cAAAA,CAAAA,CAAgBI,OAAO,CAACL,EAAAA,EAAI;QAClEM,kBAAAA,CAAkBC,SAAS,CAACC,oBAAoB;AAChD,QAAA;AACD,KAAA,CAAA;IAED,IAAIC,kBAAAA,CAAEC,KAAK,CAACP,IAAAA,CAAAA,EAAO;QACjB,MAAM,IAAIQ,aAAOC,aAAa,EAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,KAAKZ,cAAAA,CACRa,OAAO,CAAC,mBAAA,CAAA,CACRC,wBAAwB,CAAC;AAAElB,QAAAA,OAAAA;AAASC,QAAAA,MAAAA;AAAQC,QAAAA;AAAM,KAAA,CAAA;AAErD,IAAA,MAAMiB,SAAAA,GAAYP,kBAAAA,CAAEQ,GAAG,CAACd,IAAAA,EAAM;QAACG,kBAAAA,CAAkBC,SAAS,CAACC,oBAAoB;AAAE,QAAA;AAAK,KAAA,CAAA;IACtF,MAAMU,MAAAA,GAASF,YACX,MAAMf,cAAAA,CAAea,OAAO,CAAC,aAAA,CAAA,CAAeT,OAAO,CAACW,SAAAA,EAAW;AAAC,QAAA;KAAQ,CAAA,GACxE,IAAA;IAEJ,MAAMG,aAAAA,GAAgBV,mBAAEW,GAAG,CAACX,mBAAEY,SAAS,CAAClB,OAAO,WAAA,EAAae,MAAAA,CAAAA;IAE5D,IAAIL,EAAAA,CAAGhB,OAAO,CAACyB,MAAM,CAACT,EAAAA,CAAGf,MAAM,EAAEe,EAAAA,CAAGU,SAAS,CAACJ,aAAAA,CAAAA,CAAAA,EAAiB;QAC7D,MAAM,IAAIR,aAAOa,cAAc,EAAA;AACjC,IAAA;IAEA,OAAO;AAAEX,QAAAA,EAAAA;AAAIV,QAAAA;AAAK,KAAA;AACpB;;;;"}
@@ -2,15 +2,26 @@ import _ from 'lodash';
2
2
  import { contentTypes, errors } from '@strapi/utils';
3
3
  import { getService } from '../../utils/index.mjs';
4
4
 
5
- const findEntityAndCheckPermissions = async (ability, action, model, id)=>{
6
- const file = await getService('upload').findOne(id, [
5
+ /**
6
+ * Loads a file and enforces the permission *conditions* attached to `action` on it.
7
+ *
8
+ * `createdBy` and the creator's `roles` have to be populated before `toSubject`: the admin
9
+ * conditions read them (`admin::is-creator` matches `createdBy.id`, `admin::has-same-role-as-creator`
10
+ * matches `createdBy.roles`), and a subject missing those fields can never satisfy the rule — so
11
+ * a conditioned grant would be denied its own files rather than allowed them.
12
+ *
13
+ * `strapiInstance` defaults to the ambient global for the admin controllers, which have no
14
+ * `strapi` in scope. Callers that are handed an instance — MCP tool handlers — pass it
15
+ * explicitly so they never bind to a different one.
16
+ */ const findEntityAndCheckPermissions = async (ability, action, model, id, strapiInstance = strapi)=>{
17
+ const file = await getService('upload', strapiInstance).findOne(id, [
7
18
  contentTypes.constants.CREATED_BY_ATTRIBUTE,
8
19
  'folder'
9
20
  ]);
10
21
  if (_.isNil(file)) {
11
22
  throw new errors.NotFoundError();
12
23
  }
13
- const pm = strapi.service('admin::permission').createPermissionsManager({
24
+ const pm = strapiInstance.service('admin::permission').createPermissionsManager({
14
25
  ability,
15
26
  action,
16
27
  model
@@ -19,7 +30,7 @@ const findEntityAndCheckPermissions = async (ability, action, model, id)=>{
19
30
  contentTypes.constants.CREATED_BY_ATTRIBUTE,
20
31
  'id'
21
32
  ]);
22
- const author = creatorId ? await strapi.service('admin::user').findOne(creatorId, [
33
+ const author = creatorId ? await strapiInstance.service('admin::user').findOne(creatorId, [
23
34
  'roles'
24
35
  ]) : null;
25
36
  const fileWithRoles = _.set(_.cloneDeep(file), 'createdBy', author);
@@ -1 +1 @@
1
- {"version":3,"file":"find-entity-and-check-permissions.mjs","sources":["../../../../server/src/controllers/utils/find-entity-and-check-permissions.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors, contentTypes as contentTypesUtils } from '@strapi/utils';\nimport { getService } from '../../utils';\n\nconst findEntityAndCheckPermissions = async (\n ability: unknown,\n action: string,\n model: string,\n id: string | number\n) => {\n const file = await getService('upload').findOne(id, [\n contentTypesUtils.constants.CREATED_BY_ATTRIBUTE,\n 'folder',\n ]);\n\n if (_.isNil(file)) {\n throw new errors.NotFoundError();\n }\n\n const pm = strapi\n .service('admin::permission')\n .createPermissionsManager({ ability, action, model });\n\n const creatorId = _.get(file, [contentTypesUtils.constants.CREATED_BY_ATTRIBUTE, 'id']);\n const author = creatorId\n ? await strapi.service('admin::user').findOne(creatorId, ['roles'])\n : null;\n\n const fileWithRoles = _.set(_.cloneDeep(file), 'createdBy', author);\n\n if (pm.ability.cannot(pm.action, pm.toSubject(fileWithRoles))) {\n throw new errors.ForbiddenError();\n }\n\n return { pm, file };\n};\n\nexport { findEntityAndCheckPermissions };\n"],"names":["findEntityAndCheckPermissions","ability","action","model","id","file","getService","findOne","contentTypesUtils","constants","CREATED_BY_ATTRIBUTE","_","isNil","errors","NotFoundError","pm","strapi","service","createPermissionsManager","creatorId","get","author","fileWithRoles","set","cloneDeep","cannot","toSubject","ForbiddenError"],"mappings":";;;;AAIA,MAAMA,6BAAAA,GAAgC,OACpCC,OAAAA,EACAC,MAAAA,EACAC,KAAAA,EACAC,EAAAA,GAAAA;AAEA,IAAA,MAAMC,OAAO,MAAMC,UAAAA,CAAW,QAAA,CAAA,CAAUC,OAAO,CAACH,EAAAA,EAAI;QAClDI,YAAAA,CAAkBC,SAAS,CAACC,oBAAoB;AAChD,QAAA;AACD,KAAA,CAAA;IAED,IAAIC,CAAAA,CAAEC,KAAK,CAACP,IAAAA,CAAAA,EAAO;QACjB,MAAM,IAAIQ,OAAOC,aAAa,EAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,KAAKC,MAAAA,CACRC,OAAO,CAAC,mBAAA,CAAA,CACRC,wBAAwB,CAAC;AAAEjB,QAAAA,OAAAA;AAASC,QAAAA,MAAAA;AAAQC,QAAAA;AAAM,KAAA,CAAA;AAErD,IAAA,MAAMgB,SAAAA,GAAYR,CAAAA,CAAES,GAAG,CAACf,IAAAA,EAAM;QAACG,YAAAA,CAAkBC,SAAS,CAACC,oBAAoB;AAAE,QAAA;AAAK,KAAA,CAAA;IACtF,MAAMW,MAAAA,GAASF,YACX,MAAMH,MAAAA,CAAOC,OAAO,CAAC,aAAA,CAAA,CAAeV,OAAO,CAACY,SAAAA,EAAW;AAAC,QAAA;KAAQ,CAAA,GAChE,IAAA;IAEJ,MAAMG,aAAAA,GAAgBX,EAAEY,GAAG,CAACZ,EAAEa,SAAS,CAACnB,OAAO,WAAA,EAAagB,MAAAA,CAAAA;IAE5D,IAAIN,EAAAA,CAAGd,OAAO,CAACwB,MAAM,CAACV,EAAAA,CAAGb,MAAM,EAAEa,EAAAA,CAAGW,SAAS,CAACJ,aAAAA,CAAAA,CAAAA,EAAiB;QAC7D,MAAM,IAAIT,OAAOc,cAAc,EAAA;AACjC,IAAA;IAEA,OAAO;AAAEZ,QAAAA,EAAAA;AAAIV,QAAAA;AAAK,KAAA;AACpB;;;;"}
1
+ {"version":3,"file":"find-entity-and-check-permissions.mjs","sources":["../../../../server/src/controllers/utils/find-entity-and-check-permissions.ts"],"sourcesContent":["import _ from 'lodash';\nimport { errors, contentTypes as contentTypesUtils } from '@strapi/utils';\nimport type { Core } from '@strapi/types';\nimport { getService } from '../../utils';\n\n/**\n * Loads a file and enforces the permission *conditions* attached to `action` on it.\n *\n * `createdBy` and the creator's `roles` have to be populated before `toSubject`: the admin\n * conditions read them (`admin::is-creator` matches `createdBy.id`, `admin::has-same-role-as-creator`\n * matches `createdBy.roles`), and a subject missing those fields can never satisfy the rule — so\n * a conditioned grant would be denied its own files rather than allowed them.\n *\n * `strapiInstance` defaults to the ambient global for the admin controllers, which have no\n * `strapi` in scope. Callers that are handed an instance — MCP tool handlers — pass it\n * explicitly so they never bind to a different one.\n */\nconst findEntityAndCheckPermissions = async (\n ability: unknown,\n action: string,\n model: string,\n id: string | number,\n strapiInstance: Core.Strapi = strapi\n) => {\n const file = await getService('upload', strapiInstance).findOne(id, [\n contentTypesUtils.constants.CREATED_BY_ATTRIBUTE,\n 'folder',\n ]);\n\n if (_.isNil(file)) {\n throw new errors.NotFoundError();\n }\n\n const pm = strapiInstance\n .service('admin::permission')\n .createPermissionsManager({ ability, action, model });\n\n const creatorId = _.get(file, [contentTypesUtils.constants.CREATED_BY_ATTRIBUTE, 'id']);\n const author = creatorId\n ? await strapiInstance.service('admin::user').findOne(creatorId, ['roles'])\n : null;\n\n const fileWithRoles = _.set(_.cloneDeep(file), 'createdBy', author);\n\n if (pm.ability.cannot(pm.action, pm.toSubject(fileWithRoles))) {\n throw new errors.ForbiddenError();\n }\n\n return { pm, file };\n};\n\nexport { findEntityAndCheckPermissions };\n"],"names":["findEntityAndCheckPermissions","ability","action","model","id","strapiInstance","strapi","file","getService","findOne","contentTypesUtils","constants","CREATED_BY_ATTRIBUTE","_","isNil","errors","NotFoundError","pm","service","createPermissionsManager","creatorId","get","author","fileWithRoles","set","cloneDeep","cannot","toSubject","ForbiddenError"],"mappings":";;;;AAKA;;;;;;;;;;;IAYA,MAAMA,gCAAgC,OACpCC,OAAAA,EACAC,QACAC,KAAAA,EACAC,EAAAA,EACAC,iBAA8BC,MAAM,GAAA;AAEpC,IAAA,MAAMC,OAAO,MAAMC,UAAAA,CAAW,UAAUH,cAAAA,CAAAA,CAAgBI,OAAO,CAACL,EAAAA,EAAI;QAClEM,YAAAA,CAAkBC,SAAS,CAACC,oBAAoB;AAChD,QAAA;AACD,KAAA,CAAA;IAED,IAAIC,CAAAA,CAAEC,KAAK,CAACP,IAAAA,CAAAA,EAAO;QACjB,MAAM,IAAIQ,OAAOC,aAAa,EAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,KAAKZ,cAAAA,CACRa,OAAO,CAAC,mBAAA,CAAA,CACRC,wBAAwB,CAAC;AAAElB,QAAAA,OAAAA;AAASC,QAAAA,MAAAA;AAAQC,QAAAA;AAAM,KAAA,CAAA;AAErD,IAAA,MAAMiB,SAAAA,GAAYP,CAAAA,CAAEQ,GAAG,CAACd,IAAAA,EAAM;QAACG,YAAAA,CAAkBC,SAAS,CAACC,oBAAoB;AAAE,QAAA;AAAK,KAAA,CAAA;IACtF,MAAMU,MAAAA,GAASF,YACX,MAAMf,cAAAA,CAAea,OAAO,CAAC,aAAA,CAAA,CAAeT,OAAO,CAACW,SAAAA,EAAW;AAAC,QAAA;KAAQ,CAAA,GACxE,IAAA;IAEJ,MAAMG,aAAAA,GAAgBV,EAAEW,GAAG,CAACX,EAAEY,SAAS,CAAClB,OAAO,WAAA,EAAae,MAAAA,CAAAA;IAE5D,IAAIL,EAAAA,CAAGhB,OAAO,CAACyB,MAAM,CAACT,EAAAA,CAAGf,MAAM,EAAEe,EAAAA,CAAGU,SAAS,CAACJ,aAAAA,CAAAA,CAAAA,EAAiB;QAC7D,MAAM,IAAIR,OAAOa,cAAc,EAAA;AACjC,IAAA;IAEA,OAAO;AAAEX,QAAAA,EAAAA;AAAIV,QAAAA;AAAK,KAAA;AACpB;;;;"}
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- const isFolderOrChild = (folderOrChild, folder)=>folderOrChild.path === folder.path || folderOrChild.path.startsWith(`${folder.path}/`);
3
+ /** Only the materialized `path` is compared, so any row carrying one can be passed. */ const isFolderOrChild = (folderOrChild, folder)=>folderOrChild.path === folder.path || folderOrChild.path.startsWith(`${folder.path}/`);
4
4
 
5
5
  exports.isFolderOrChild = isFolderOrChild;
6
6
  //# sourceMappingURL=folders.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"folders.js","sources":["../../../../server/src/controllers/utils/folders.ts"],"sourcesContent":["import { Folder } from '../../types';\n\nconst isFolderOrChild = (folderOrChild: Folder, folder: Folder) =>\n folderOrChild.path === folder.path || folderOrChild.path.startsWith(`${folder.path}/`);\n\nexport { isFolderOrChild };\n"],"names":["isFolderOrChild","folderOrChild","folder","path","startsWith"],"mappings":";;AAEA,MAAMA,eAAAA,GAAkB,CAACC,aAAAA,EAAuBC,MAAAA,GAC9CD,cAAcE,IAAI,KAAKD,OAAOC,IAAI,IAAIF,cAAcE,IAAI,CAACC,UAAU,CAAC,CAAA,EAAGF,OAAOC,IAAI,CAAC,CAAC,CAAC;;;;"}
1
+ {"version":3,"file":"folders.js","sources":["../../../../server/src/controllers/utils/folders.ts"],"sourcesContent":["import { Folder } from '../../types';\n\n/** Only the materialized `path` is compared, so any row carrying one can be passed. */\nconst isFolderOrChild = (folderOrChild: Pick<Folder, 'path'>, folder: Pick<Folder, 'path'>) =>\n folderOrChild.path === folder.path || folderOrChild.path.startsWith(`${folder.path}/`);\n\nexport { isFolderOrChild };\n"],"names":["isFolderOrChild","folderOrChild","folder","path","startsWith"],"mappings":";;AAEA,8FACMA,eAAAA,GAAkB,CAACC,eAAqCC,MAAAA,GAC5DD,aAAAA,CAAcE,IAAI,KAAKD,MAAAA,CAAOC,IAAI,IAAIF,aAAAA,CAAcE,IAAI,CAACC,UAAU,CAAC,GAAGF,MAAAA,CAAOC,IAAI,CAAC,CAAC,CAAC;;;;"}
@@ -1,4 +1,4 @@
1
- const isFolderOrChild = (folderOrChild, folder)=>folderOrChild.path === folder.path || folderOrChild.path.startsWith(`${folder.path}/`);
1
+ /** Only the materialized `path` is compared, so any row carrying one can be passed. */ const isFolderOrChild = (folderOrChild, folder)=>folderOrChild.path === folder.path || folderOrChild.path.startsWith(`${folder.path}/`);
2
2
 
3
3
  export { isFolderOrChild };
4
4
  //# sourceMappingURL=folders.mjs.map
@@ -1 +1 @@
1
- {"version":3,"file":"folders.mjs","sources":["../../../../server/src/controllers/utils/folders.ts"],"sourcesContent":["import { Folder } from '../../types';\n\nconst isFolderOrChild = (folderOrChild: Folder, folder: Folder) =>\n folderOrChild.path === folder.path || folderOrChild.path.startsWith(`${folder.path}/`);\n\nexport { isFolderOrChild };\n"],"names":["isFolderOrChild","folderOrChild","folder","path","startsWith"],"mappings":"AAEA,MAAMA,eAAAA,GAAkB,CAACC,aAAAA,EAAuBC,MAAAA,GAC9CD,cAAcE,IAAI,KAAKD,OAAOC,IAAI,IAAIF,cAAcE,IAAI,CAACC,UAAU,CAAC,CAAA,EAAGF,OAAOC,IAAI,CAAC,CAAC,CAAC;;;;"}
1
+ {"version":3,"file":"folders.mjs","sources":["../../../../server/src/controllers/utils/folders.ts"],"sourcesContent":["import { Folder } from '../../types';\n\n/** Only the materialized `path` is compared, so any row carrying one can be passed. */\nconst isFolderOrChild = (folderOrChild: Pick<Folder, 'path'>, folder: Pick<Folder, 'path'>) =>\n folderOrChild.path === folder.path || folderOrChild.path.startsWith(`${folder.path}/`);\n\nexport { isFolderOrChild };\n"],"names":["isFolderOrChild","folderOrChild","folder","path","startsWith"],"mappings":"AAEA,8FACMA,eAAAA,GAAkB,CAACC,eAAqCC,MAAAA,GAC5DD,aAAAA,CAAcE,IAAI,KAAKD,MAAAA,CAAOC,IAAI,IAAIF,aAAAA,CAAcE,IAAI,CAACC,UAAU,CAAC,GAAGF,MAAAA,CAAOC,IAAI,CAAC,CAAC,CAAC;;;;"}