@strapi/upload 5.57.0 → 5.58.0

package/dist/server/services/extensions/utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"utils.mjs","sources":["../../../../server/src/services/extensions/utils.ts"],"sourcesContent":["import path from 'path';\n\nimport { async, traverseEntity } from '@strapi/utils';\n\nimport type { Schema, UID } from '@strapi/types';\n\nimport { getService } from '../../utils';\nimport { FILE_MODEL_UID } from '../../constants';\n\nimport type { Config, File } from '../../types';\n\ntype SignEntityMediaVisitor = (\n  args: {\n    key: string;\n    value: unknown;\n    attribute: Schema.Attribute.AnyAttribute;\n  },\n  utils: {\n    set: (key: string, value: unknown) => void;\n  }\n) => Promise<void>;\n\n/**\n * One presign per distinct URL, keyed by the bare (unsigned) URL. The promise\n * is stored rather than its result so concurrent occurrences of the same URL\n * (the `async.map` in `mapRichtextUrls`, or several entries of a `findMany`)\n * share a single provider call.\n *\n * A cache must never outlive the document service call or migration run that\n * created it: a signed URL is only as fresh as the request that produced it.\n */\ntype SignCache = Map<string, Promise<string | null>>;\n\nconst createSignCache = (): SignCache => new Map();\n\n/**\n * URL bearing syntaxes found in a richtext (markdown) value. Each pattern\n * captures a prefix (group 1) and the URL (group 2) so the rebuild loop in\n * `mapRichtextUrls` can splice a new URL in place without touching anything\n * else.\n *\n * - markdown image / link: `![alt](url)` or `[text](url)`. The URL is captured\n *   up to the first whitespace or closing parenthesis, which also covers the\n *   optional title form `[text](url \"title\")`.\n * - raw HTML `src` / `href` attributes, double or single quoted, on the\n *   elements the editor lets users write by hand (`<img src=\"...\" width=\"200\">`\n *   is the usual way to size an image).\n */\nconst RICHTEXT_URL_REGEXES = [\n  /(!?\\[[^\\]]*\\]\\()([^)\\s]+)/g,\n  /(<(?:img|a|source|video|audio)\\b[^>]*?\\b(?:src|href)=\")([^\"]+)/gi,\n  /(<(?:img|a|source|video|audio)\\b[^>]*?\\b(?:src|href)=')([^']+)/gi,\n];\n\n/** Cheap short circuit for richtext values that cannot contain a URL we would rewrite. */\nconst RICHTEXT_URL_HINTS = ['](', 'src=', 'href='];\n\ntype BlocksNode = {\n  type?: string;\n  image?: File;\n  children?: unknown;\n  [key: string]: unknown;\n};\n\ntype ImageFormat = { url?: string; isUrlSigned?: boolean; [key: string]: unknown };\n\nfunction isFile(value: unknown, attribute: Schema.Attribute.AnyAttribute): value is File {\n  if (!value || attribute.type !== 'media') {\n    return false;\n  }\n\n  return true;\n}\n\nconst stripQueryString = (url: string) => url.split('?')[0];\n\nconst decodeQueryParamName = (pair: string) => {\n  const name = pair.split('=')[0];\n\n  try {\n    return decodeURIComponent(name);\n  } catch {\n    return name;\n  }\n};\n\n/**\n * Split a URL into what precedes the `?`, the raw `key=value` pairs of its\n * query string and the `#fragment`, if any. Plain string work on purpose:\n * `new URL` throws on the relative `/uploads/...` paths a local provider\n * writes, and would re-encode the pairs we want to hand back untouched.\n */\nconst splitUrl = (url: string) => {\n  const hashIndex = url.indexOf('#');\n  const fragment = hashIndex === -1 ? '' : url.slice(hashIndex);\n  const withoutFragment = hashIndex === -1 ? url : url.slice(0, hashIndex);\n\n  const queryIndex = withoutFragment.indexOf('?');\n\n  if (queryIndex === -1) {\n    return { base: withoutFragment, pairs: [] as string[], fragment };\n  }\n\n  return {\n    base: withoutFragment.slice(0, queryIndex),\n    pairs: withoutFragment\n      .slice(queryIndex + 1)\n      .split('&')\n      .filter(Boolean),\n    fragment,\n  };\n};\n\n/** Names of the query parameters of `url`, decoded, in order. */\nconst getQueryParamNames = (url: string): string[] => splitUrl(url).pairs.map(decodeQueryParamName);\n\n/**\n * `url` with every query parameter whose name is in `names` removed. The\n * surviving pairs keep their order and encoding; the `?` is dropped when\n * nothing is left.\n */\nconst removeQueryParams = (url: string, names: string[]): string => {\n  const { base, pairs, fragment } = splitUrl(url);\n\n  if (pairs.length === 0 || names.length === 0) {\n    return url;\n  }\n\n  const kept = pairs.filter((pair) => !names.includes(decodeQueryParamName(pair)));\n\n  return kept.length === 0 ? `${base}${fragment}` : `${base}?${kept.join('&')}${fragment}`;\n};\n\n/**\n * Build the minimal file shape `signFileUrls` needs out of a bare URL, as found\n * in a richtext value.\n *\n * `hash` and `ext` are taken from the last path segment and `path` is left\n * unset, which rebuilds the S3 key for the default layout and for the\n * `rootPath` provider option (the provider prefixes it itself). A URL whose key\n * has extra segments (a file uploaded with the per-file `path` option, or an\n * older key layout) is still recognised as ours by the provider, but it is\n * signed with a key that does not exist and the link returns 403. Media\n * signing has the same limit because `path` is not persisted on the file\n * (`content-types/file.ts`). Not addressed here.\n */\nconst getFileFromUrl = (url: string): File => {\n  const unsignedUrl = stripQueryString(url);\n  const { provider } = strapi.config.get<Config>('plugin::upload');\n  const { name, ext } = path.parse(unsignedUrl.split('/').pop() ?? '');\n\n  return { url: unsignedUrl, hash: name, ext, provider } as File;\n};\n\n/**\n * Ask the provider to sign `file` and return the signed URL if the provider\n * owns it, otherwise `null`. Memoised in `cache` by the bare URL.\n *\n * Ownership is decided by whether the provider changed the URL: `signFileUrls`\n * flags every file of the configured provider as signed, but the provider\n * itself returns URLs it does not own untouched (an S3 URL from another\n * bucket, an external site, a local `/uploads` path), so a changed URL is the\n * only reliable signal. `file.url` must already be the bare URL so the\n * comparison is meaningful.\n */\nconst signFileIfOwned = (file: File, cache: SignCache): Promise<string | null> => {\n  const bareUrl = file.url ?? '';\n  const cached = cache.get(bareUrl);\n\n  if (cached) {\n    return cached;\n  }\n\n  const pending = (async () => {\n    const { signFileUrls } = getService('file');\n    const signedFile = await signFileUrls(file);\n\n    return signedFile.url && signedFile.url !== bareUrl ? signedFile.url : null;\n  })();\n\n  cache.set(bareUrl, pending);\n\n  return pending;\n};\n\n/**\n * Signs a richtext URL if the configured provider owns it, otherwise `null`.\n * See `signFileIfOwned` for how ownership is decided. A single predicate means\n * the read path (sign) and the write path (unsign) can never disagree about\n * what they own.\n */\nconst signIfOwned = (url: string, cache: SignCache): Promise<string | null> =>\n  signFileIfOwned(getFileFromUrl(url), cache);\n\n/**\n * Returns a richtext URL with its signature removed, if we own it.\n *\n * Only the query parameters the provider's own fresh signature introduces are\n * removed (for S3, the `X-Amz-*` family), every other parameter is kept. That\n * way a provider that signs whatever it is handed cannot make us drop `?v=x`\n * from a link to an external site. A parameter of an old signature that the\n * fresh one no longer carries (an `X-Amz-Security-Token` from credentials no\n * longer in use, say) survives in the row; it is not a signature, and the read\n * path replaces the whole URL with the provider output anyway.\n */\nconst stripSignedUrl = async (url: string, cache: SignCache) => {\n  // Nothing to strip, and no reason to ask the provider\n  if (!url.includes('?')) {\n    return url;\n  }\n\n  const signedUrl = await signIfOwned(url, cache);\n\n  if (signedUrl === null) {\n    return url;\n  }\n\n  return removeQueryParams(url, getQueryParamNames(signedUrl));\n};\n\n/** Returns a freshly signed richtext URL, if we own it. */\nconst signUrl = async (url: string, cache: SignCache) => (await signIfOwned(url, cache)) ?? url;\n\n/**\n * Apply `mapUrl` to every markdown image / link URL and every raw HTML\n * `src` / `href` URL of a richtext value.\n */\nconst mapRichtextUrls = async (value: unknown, mapUrl: (url: string) => Promise<string>) => {\n  if (typeof value !== 'string' || !RICHTEXT_URL_HINTS.some((hint) => value.includes(hint))) {\n    return value;\n  }\n\n  // The rebuild loop splices by match index, so matches must be in ascending order\n  const matches = RICHTEXT_URL_REGEXES.flatMap((regex) => Array.from(value.matchAll(regex))).sort(\n    (a, b) => (a.index as number) - (b.index as number)\n  );\n\n  if (matches.length === 0) {\n    return value;\n  }\n\n  const urls: string[] = await async.map(matches, (match: RegExpMatchArray) => mapUrl(match[2]));\n\n  let result = '';\n  let cursor = 0;\n\n  matches.forEach((match, index) => {\n    const urlStart = (match.index as number) + match[1].length;\n\n    // Two patterns matched overlapping text: keep the first, never splice twice\n    if (urlStart < cursor) {\n      return;\n    }\n\n    result += value.slice(cursor, urlStart) + urls[index];\n    cursor = urlStart + match[2].length;\n  });\n\n  return result + value.slice(cursor);\n};\n\n/**\n * Apply `mapImage` to every `image` node of a blocks value, recursively.\n * A new array is always returned, the original value is never mutated.\n */\nconst mapBlocksImages = async (\n  value: unknown,\n  mapImage: (image: File) => Promise<File>\n): Promise<unknown> => {\n  if (!Array.isArray(value)) {\n    return value;\n  }\n\n  return async.map(value, async (node: BlocksNode) => {\n    if (!node || typeof node !== 'object') {\n      return node;\n    }\n\n    let result = node;\n\n    if (node.type === 'image' && node.image) {\n      result = { ...result, image: await mapImage(node.image) };\n    }\n\n    if (Array.isArray(node.children)) {\n      result = { ...result, children: await mapBlocksImages(node.children, mapImage) };\n    }\n\n    return result;\n  });\n};\n\nconst getImageFormats = (image: File): [string, ImageFormat][] =>\n  Object.entries(image.formats ?? {}) as [string, ImageFormat][];\n\n/** True when the node still carries anything `unsignImage` would remove. */\nconst hasSignatureTraces = (image: File) => {\n  if (image.isUrlSigned !== undefined || (image.url ?? '').includes('?')) {\n    return true;\n  }\n\n  return getImageFormats(image).some(\n    ([, format]) => format?.isUrlSigned !== undefined || (format?.url ?? '').includes('?')\n  );\n};\n\n/**\n * Remove the signature from a blocks `image` node: the signature parameters on\n * the file URL and on every format URL (the same presigner signs them all, so\n * the same parameter names apply), and the `isUrlSigned` flag `signFileUrls`\n * sets on the file and on each format. The node carries a full file object, so\n * the ownership check is made with it rather than with a URL derived stand in.\n */\nconst unsignImage = async (image: File, cache: SignCache = createSignCache()) => {\n  // Already bare: nothing to do, and no reason to ask the provider\n  if (!hasSignatureTraces(image)) {\n    return image;\n  }\n\n  const bareUrl = stripQueryString(image.url ?? '');\n  const signedUrl = await signFileIfOwned({ ...image, url: bareUrl }, cache);\n\n  // Not one of ours (different provider, external URL, public provider): the\n  // provider hands the URL back unchanged, leave the node as is\n  if (signedUrl === null) {\n    return image;\n  }\n\n  const names = getQueryParamNames(signedUrl);\n  const { isUrlSigned: _isUrlSigned, ...result }: File = {\n    ...image,\n    url: removeQueryParams(image.url ?? '', names),\n  };\n\n  if (image.formats) {\n    result.formats = Object.fromEntries(\n      getImageFormats(image).map(([key, format]) => {\n        if (!format || typeof format !== 'object') {\n          return [key, format];\n        }\n\n        const { isUrlSigned: _formatIsUrlSigned, ...unsignedFormat } = {\n          ...format,\n          ...(format.url ? { url: removeQueryParams(format.url, names) } : {}),\n        };\n\n        return [key, unsignedFormat];\n      })\n    );\n  }\n\n  return result;\n};\n\n/**\n * Visitor function to sign media URLs\n */\nconst createSignEntityMediaVisitor =\n  (cache: SignCache): SignEntityMediaVisitor =>\n  async ({ key, value, attribute }, { set }) => {\n    const { signFileUrls } = getService('file');\n\n    if (!attribute) {\n      return;\n    }\n\n    switch (attribute.type) {\n      case 'blocks':\n        set(key, await mapBlocksImages(value, signFileUrls));\n        return;\n\n      case 'richtext':\n        set(key, await mapRichtextUrls(value, (url) => signUrl(url, cache)));\n        return;\n\n      case 'media': {\n        if (isFile(value, attribute)) {\n          // If the attribute is repeatable sign each file\n          if (attribute.multiple) {\n            const signedFiles = await async.map(value, signFileUrls);\n            set(key, signedFiles);\n            return;\n          }\n\n          // If the attribute is not repeatable only sign a single file\n          const signedFile = await signFileUrls(value);\n          set(key, signedFile);\n        }\n        break;\n      }\n\n      default:\n        break;\n    }\n  };\n\n/**\n * Visitor function to remove the signature from richtext / blocks URLs before\n * they are persisted. Media attributes are left alone: the files table already\n * holds the unsigned URL.\n */\nconst createUnsignEntityMediaVisitor =\n  (cache: SignCache): SignEntityMediaVisitor =>\n  async ({ key, value, attribute }, { set }) => {\n    if (!attribute) {\n      return;\n    }\n\n    if (attribute.type === 'blocks') {\n      set(key, await mapBlocksImages(value, (image) => unsignImage(image, cache)));\n      return;\n    }\n\n    if (attribute.type === 'richtext') {\n      set(key, await mapRichtextUrls(value, (url) => stripSignedUrl(url, cache)));\n    }\n  };\n\n/**\n *\n * Iterate through an entity manager result\n * Check which modelAttributes are media and pre sign the image URLs\n * if they are from the current upload provider\n *\n * @param {Object} entity\n * @param {Object} modelAttributes\n * @param {Map} cache one per document service call, see `SignCache`\n * @returns\n */\nconst signEntityMedia = async (\n  entity: any,\n  uid: UID.Schema,\n  cache: SignCache = createSignCache()\n) => {\n  if (!entity) {\n    return entity;\n  }\n\n  // If the entity itself is a file, sign it directly\n  if (uid === FILE_MODEL_UID) {\n    const { signFileUrls } = getService('file');\n    return signFileUrls(entity);\n  }\n\n  // If the entity is a regular content type, look for media attributes\n  const model = strapi.getModel(uid);\n  return traverseEntity(\n    // @ts-expect-error - FIXME: fix traverseEntity using wrong types\n    createSignEntityMediaVisitor(cache),\n    { schema: model, getModel: strapi.getModel.bind(strapi) },\n    entity\n  );\n};\n\n/**\n * Iterate through the input data of a create / update / clone and replace\n * every signed provider URL found in a richtext or blocks attribute with its\n * unsigned form, so that a short lived signature is never persisted.\n */\nconst unsignEntityMedia = async (\n  data: any,\n  uid: UID.Schema,\n  cache: SignCache = createSignCache()\n) => {\n  if (!data || uid === FILE_MODEL_UID) {\n    return data;\n  }\n\n  const model = strapi.getModel(uid);\n\n  return traverseEntity(\n    // @ts-expect-error - FIXME: fix traverseEntity using wrong types\n    createUnsignEntityMediaVisitor(cache),\n    { schema: model, getModel: strapi.getModel.bind(strapi) },\n    data\n  );\n};\n\nexport type { SignCache };\n\nexport {\n  createSignCache,\n  signEntityMedia,\n  unsignEntityMedia,\n  mapRichtextUrls,\n  mapBlocksImages,\n  stripSignedUrl,\n  unsignImage,\n};\n"],"names":["createSignCache","Map","RICHTEXT_URL_REGEXES","RICHTEXT_URL_HINTS","isFile","value","attribute","type","stripQueryString","url","split","decodeQueryParamName","pair","name","decodeURIComponent","splitUrl","hashIndex","indexOf","fragment","slice","withoutFragment","queryIndex","base","pairs","filter","Boolean","getQueryParamNames","map","removeQueryParams","names","length","kept","includes","join","getFileFromUrl","unsignedUrl","provider","strapi","config","get","ext","path","parse","pop","hash","signFileIfOwned","file","cache","bareUrl","cached","pending","signFileUrls","getService","signedFile","set","signIfOwned","stripSignedUrl","signedUrl","signUrl","mapRichtextUrls","mapUrl","some","hint","matches","flatMap","regex","Array","from","matchAll","sort","a","b","index","urls","async","match","result","cursor","forEach","urlStart","mapBlocksImages","mapImage","isArray","node","image","children","getImageFormats","Object","entries","formats","hasSignatureTraces","isUrlSigned","undefined","format","unsignImage","_isUrlSigned","fromEntries","key","_formatIsUrlSigned","unsignedFormat","createSignEntityMediaVisitor","multiple","signedFiles","createUnsignEntityMediaVisitor","signEntityMedia","entity","uid","FILE_MODEL_UID","model","getModel","traverseEntity","schema","bind","unsignEntityMedia","data"],"mappings":";;;;;AAiCA,MAAMA,eAAAA,GAAkB,IAAiB,IAAIC,GAAAA;AAE7C;;;;;;;;;;;;AAYC,IACD,MAAMC,oBAAAA,GAAuB;AAC3B,IAAA,4BAAA;AACA,IAAA,kEAAA;AACA,IAAA;AACD,CAAA;AAED,2FACA,MAAMC,kBAAAA,GAAqB;AAAC,IAAA,IAAA;AAAM,IAAA,MAAA;AAAQ,IAAA;AAAQ,CAAA;AAWlD,SAASC,MAAAA,CAAOC,KAAc,EAAEC,SAAwC,EAAA;AACtE,IAAA,IAAI,CAACD,KAAAA,IAASC,SAAAA,CAAUC,IAAI,KAAK,OAAA,EAAS;QACxC,OAAO,KAAA;AACT,IAAA;IAEA,OAAO,IAAA;AACT;AAEA,MAAMC,gBAAAA,GAAmB,CAACC,GAAAA,GAAgBA,GAAAA,CAAIC,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAE3D,MAAMC,uBAAuB,CAACC,IAAAA,GAAAA;AAC5B,IAAA,MAAMC,OAAOD,IAAAA,CAAKF,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;IAE/B,IAAI;AACF,QAAA,OAAOI,kBAAAA,CAAmBD,IAAAA,CAAAA;AAC5B,IAAA,CAAA,CAAE,OAAM;QACN,OAAOA,IAAAA;AACT,IAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAME,WAAW,CAACN,GAAAA,GAAAA;IAChB,MAAMO,SAAAA,GAAYP,GAAAA,CAAIQ,OAAO,CAAC,GAAA,CAAA;AAC9B,IAAA,MAAMC,WAAWF,SAAAA,KAAc,KAAK,EAAA,GAAKP,GAAAA,CAAIU,KAAK,CAACH,SAAAA,CAAAA;IACnD,MAAMI,eAAAA,GAAkBJ,cAAc,EAAC,GAAIP,MAAMA,GAAAA,CAAIU,KAAK,CAAC,CAAA,EAAGH,SAAAA,CAAAA;IAE9D,MAAMK,UAAAA,GAAaD,eAAAA,CAAgBH,OAAO,CAAC,GAAA,CAAA;IAE3C,IAAII,UAAAA,KAAe,EAAC,EAAG;QACrB,OAAO;YAAEC,IAAAA,EAAMF,eAAAA;AAAiBG,YAAAA,KAAAA,EAAO,EAAE;AAAcL,YAAAA;AAAS,SAAA;AAClE,IAAA;IAEA,OAAO;QACLI,IAAAA,EAAMF,eAAAA,CAAgBD,KAAK,CAAC,CAAA,EAAGE,UAAAA,CAAAA;QAC/BE,KAAAA,EAAOH,eAAAA,CACJD,KAAK,CAACE,UAAAA,GAAa,GACnBX,KAAK,CAAC,GAAA,CAAA,CACNc,MAAM,CAACC,OAAAA,CAAAA;AACVP,QAAAA;AACF,KAAA;AACF,CAAA;AAEA,kEACA,MAAMQ,kBAAAA,GAAqB,CAACjB,GAAAA,GAA0BM,SAASN,GAAAA,CAAAA,CAAKc,KAAK,CAACI,GAAG,CAAChB,oBAAAA,CAAAA;AAE9E;;;;IAKA,MAAMiB,iBAAAA,GAAoB,CAACnB,GAAAA,EAAaoB,KAAAA,GAAAA;IACtC,MAAM,EAAEP,IAAI,EAAEC,KAAK,EAAEL,QAAQ,EAAE,GAAGH,QAAAA,CAASN,GAAAA,CAAAA;AAE3C,IAAA,IAAIc,MAAMO,MAAM,KAAK,KAAKD,KAAAA,CAAMC,MAAM,KAAK,CAAA,EAAG;QAC5C,OAAOrB,GAAAA;AACT,IAAA;IAEA,MAAMsB,IAAAA,GAAOR,KAAAA,CAAMC,MAAM,CAAC,CAACZ,OAAS,CAACiB,KAAAA,CAAMG,QAAQ,CAACrB,oBAAAA,CAAqBC,IAAAA,CAAAA,CAAAA,CAAAA;AAEzE,IAAA,OAAOmB,KAAKD,MAAM,KAAK,CAAA,GAAI,CAAA,EAAGR,OAAOJ,QAAAA,CAAAA,CAAU,GAAG,CAAA,EAAGI,IAAAA,CAAK,CAAC,EAAES,IAAAA,CAAKE,IAAI,CAAC,OAAOf,QAAAA,CAAAA,CAAU;AAC1F,CAAA;AAEA;;;;;;;;;;;;IAaA,MAAMgB,iBAAiB,CAACzB,GAAAA,GAAAA;AACtB,IAAA,MAAM0B,cAAc3B,gBAAAA,CAAiBC,GAAAA,CAAAA;IACrC,MAAM,EAAE2B,QAAQ,EAAE,GAAGC,OAAOC,MAAM,CAACC,GAAG,CAAS,gBAAA,CAAA;AAC/C,IAAA,MAAM,EAAE1B,IAAI,EAAE2B,GAAG,EAAE,GAAGC,IAAAA,CAAKC,KAAK,CAACP,WAAAA,CAAYzB,KAAK,CAAC,GAAA,CAAA,CAAKiC,GAAG,EAAA,IAAM,EAAA,CAAA;IAEjE,OAAO;QAAElC,GAAAA,EAAK0B,WAAAA;QAAaS,IAAAA,EAAM/B,IAAAA;AAAM2B,QAAAA,GAAAA;AAAKJ,QAAAA;AAAS,KAAA;AACvD,CAAA;AAEA;;;;;;;;;;IAWA,MAAMS,eAAAA,GAAkB,CAACC,IAAAA,EAAYC,KAAAA,GAAAA;IACnC,MAAMC,OAAAA,GAAUF,IAAAA,CAAKrC,GAAG,IAAI,EAAA;IAC5B,MAAMwC,MAAAA,GAASF,KAAAA,CAAMR,GAAG,CAACS,OAAAA,CAAAA;AAEzB,IAAA,IAAIC,MAAAA,EAAQ;QACV,OAAOA,MAAAA;AACT,IAAA;IAEA,MAAMC,OAAAA,GAAU,CAAC,UAAA;AACf,QAAA,MAAM,EAAEC,YAAY,EAAE,GAAGC,UAAAA,CAAW,MAAA,CAAA;QACpC,MAAMC,UAAAA,GAAa,MAAMF,YAAAA,CAAaL,IAAAA,CAAAA;QAEtC,OAAOO,UAAAA,CAAW5C,GAAG,IAAI4C,UAAAA,CAAW5C,GAAG,KAAKuC,OAAAA,GAAUK,UAAAA,CAAW5C,GAAG,GAAG,IAAA;IACzE,CAAA,GAAA;IAEAsC,KAAAA,CAAMO,GAAG,CAACN,OAAAA,EAASE,OAAAA,CAAAA;IAEnB,OAAOA,OAAAA;AACT,CAAA;AAEA;;;;;AAKC,IACD,MAAMK,WAAAA,GAAc,CAAC9C,KAAasC,KAAAA,GAChCF,eAAAA,CAAgBX,eAAezB,GAAAA,CAAAA,EAAMsC,KAAAA,CAAAA;AAEvC;;;;;;;;;;IAWA,MAAMS,cAAAA,GAAiB,OAAO/C,GAAAA,EAAasC,KAAAA,GAAAA;;AAEzC,IAAA,IAAI,CAACtC,GAAAA,CAAIuB,QAAQ,CAAC,GAAA,CAAA,EAAM;QACtB,OAAOvB,GAAAA;AACT,IAAA;IAEA,MAAMgD,SAAAA,GAAY,MAAMF,WAAAA,CAAY9C,GAAAA,EAAKsC,KAAAA,CAAAA;AAEzC,IAAA,IAAIU,cAAc,IAAA,EAAM;QACtB,OAAOhD,GAAAA;AACT,IAAA;IAEA,OAAOmB,iBAAAA,CAAkBnB,KAAKiB,kBAAAA,CAAmB+B,SAAAA,CAAAA,CAAAA;AACnD;AAEA,4DACA,MAAMC,OAAAA,GAAU,OAAOjD,GAAAA,EAAasC,QAAqB,MAAOQ,WAAAA,CAAY9C,GAAAA,EAAKsC,KAAAA,CAAAA,IAAWtC,GAAAA;AAE5F;;;IAIA,MAAMkD,eAAAA,GAAkB,OAAOtD,KAAAA,EAAgBuD,MAAAA,GAAAA;AAC7C,IAAA,IAAI,OAAOvD,KAAAA,KAAU,QAAA,IAAY,CAACF,kBAAAA,CAAmB0D,IAAI,CAAC,CAACC,IAAAA,GAASzD,KAAAA,CAAM2B,QAAQ,CAAC8B,IAAAA,CAAAA,CAAAA,EAAQ;QACzF,OAAOzD,KAAAA;AACT,IAAA;;IAGA,MAAM0D,OAAAA,GAAU7D,qBAAqB8D,OAAO,CAAC,CAACC,KAAAA,GAAUC,KAAAA,CAAMC,IAAI,CAAC9D,KAAAA,CAAM+D,QAAQ,CAACH,KAAAA,CAAAA,CAAAA,CAAAA,CAASI,IAAI,CAC7F,CAACC,CAAAA,EAAGC,CAAAA,GAAM,CAACD,CAAEE,KAAK,GAAeD,CAAAA,CAAEC,KAAK,CAAA;IAG1C,IAAIT,OAAAA,CAAQjC,MAAM,KAAK,CAAA,EAAG;QACxB,OAAOzB,KAAAA;AACT,IAAA;IAEA,MAAMoE,IAAAA,GAAiB,MAAMC,KAAAA,CAAM/C,GAAG,CAACoC,OAAAA,EAAS,CAACY,KAAAA,GAA4Bf,MAAAA,CAAOe,KAAK,CAAC,CAAA,CAAE,CAAA,CAAA;AAE5F,IAAA,IAAIC,MAAAA,GAAS,EAAA;AACb,IAAA,IAAIC,MAAAA,GAAS,CAAA;IAEbd,OAAAA,CAAQe,OAAO,CAAC,CAACH,KAAAA,EAAOH,KAAAA,GAAAA;QACtB,MAAMO,QAAAA,GAAW,KAACJ,CAAMH,KAAK,GAAcG,KAAK,CAAC,CAAA,CAAE,CAAC7C,MAAM;;AAG1D,QAAA,IAAIiD,WAAWF,MAAAA,EAAQ;AACrB,YAAA;AACF,QAAA;AAEAD,QAAAA,MAAAA,IAAUvE,MAAMc,KAAK,CAAC0D,QAAQE,QAAAA,CAAAA,GAAYN,IAAI,CAACD,KAAAA,CAAM;AACrDK,QAAAA,MAAAA,GAASE,QAAAA,GAAWJ,KAAK,CAAC,CAAA,CAAE,CAAC7C,MAAM;AACrC,IAAA,CAAA,CAAA;IAEA,OAAO8C,MAAAA,GAASvE,KAAAA,CAAMc,KAAK,CAAC0D,MAAAA,CAAAA;AAC9B;AAEA;;;IAIA,MAAMG,eAAAA,GAAkB,OACtB3E,KAAAA,EACA4E,QAAAA,GAAAA;AAEA,IAAA,IAAI,CAACf,KAAAA,CAAMgB,OAAO,CAAC7E,KAAAA,CAAAA,EAAQ;QACzB,OAAOA,KAAAA;AACT,IAAA;AAEA,IAAA,OAAOqE,KAAAA,CAAM/C,GAAG,CAACtB,KAAAA,EAAO,OAAO8E,IAAAA,GAAAA;AAC7B,QAAA,IAAI,CAACA,IAAAA,IAAQ,OAAOA,IAAAA,KAAS,QAAA,EAAU;YACrC,OAAOA,IAAAA;AACT,QAAA;AAEA,QAAA,IAAIP,MAAAA,GAASO,IAAAA;AAEb,QAAA,IAAIA,KAAK5E,IAAI,KAAK,OAAA,IAAW4E,IAAAA,CAAKC,KAAK,EAAE;YACvCR,MAAAA,GAAS;AAAE,gBAAA,GAAGA,MAAM;gBAAEQ,KAAAA,EAAO,MAAMH,QAAAA,CAASE,IAAAA,CAAKC,KAAK;AAAE,aAAA;AAC1D,QAAA;AAEA,QAAA,IAAIlB,KAAAA,CAAMgB,OAAO,CAACC,IAAAA,CAAKE,QAAQ,CAAA,EAAG;YAChCT,MAAAA,GAAS;AAAE,gBAAA,GAAGA,MAAM;AAAES,gBAAAA,QAAAA,EAAU,MAAML,eAAAA,CAAgBG,IAAAA,CAAKE,QAAQ,EAAEJ,QAAAA;AAAU,aAAA;AACjF,QAAA;QAEA,OAAOL,MAAAA;AACT,IAAA,CAAA,CAAA;AACF;AAEA,MAAMU,eAAAA,GAAkB,CAACF,KAAAA,GACvBG,MAAAA,CAAOC,OAAO,CAACJ,KAAAA,CAAMK,OAAO,IAAI,EAAC,CAAA;AAEnC,6EACA,MAAMC,kBAAAA,GAAqB,CAACN,KAAAA,GAAAA;AAC1B,IAAA,IAAIA,KAAAA,CAAMO,WAAW,KAAKC,SAAAA,IAAa,CAACR,KAAAA,CAAM3E,GAAG,IAAI,EAAC,EAAGuB,QAAQ,CAAC,GAAA,CAAA,EAAM;QACtE,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOsD,gBAAgBF,KAAAA,CAAAA,CAAOvB,IAAI,CAChC,CAAC,GAAGgC,OAAO,GAAKA,MAAAA,EAAQF,WAAAA,KAAgBC,SAAAA,IAAa,CAACC,MAAAA,EAAQpF,OAAO,EAAC,EAAGuB,QAAQ,CAAC,GAAA,CAAA,CAAA;AAEtF,CAAA;AAEA;;;;;;AAMC,IACD,MAAM8D,WAAAA,GAAc,OAAOV,KAAAA,EAAarC,QAAmB/C,eAAAA,EAAiB,GAAA;;IAE1E,IAAI,CAAC0F,mBAAmBN,KAAAA,CAAAA,EAAQ;QAC9B,OAAOA,KAAAA;AACT,IAAA;AAEA,IAAA,MAAMpC,OAAAA,GAAUxC,gBAAAA,CAAiB4E,KAAAA,CAAM3E,GAAG,IAAI,EAAA,CAAA;IAC9C,MAAMgD,SAAAA,GAAY,MAAMZ,eAAAA,CAAgB;AAAE,QAAA,GAAGuC,KAAK;QAAE3E,GAAAA,EAAKuC;KAAQ,EAAGD,KAAAA,CAAAA;;;AAIpE,IAAA,IAAIU,cAAc,IAAA,EAAM;QACtB,OAAO2B,KAAAA;AACT,IAAA;AAEA,IAAA,MAAMvD,QAAQH,kBAAAA,CAAmB+B,SAAAA,CAAAA;AACjC,IAAA,MAAM,EAAEkC,WAAAA,EAAaI,YAAY,EAAE,GAAGnB,QAAQ,GAAS;AACrD,QAAA,GAAGQ,KAAK;AACR3E,QAAAA,GAAAA,EAAKmB,iBAAAA,CAAkBwD,KAAAA,CAAM3E,GAAG,IAAI,EAAA,EAAIoB,KAAAA;AAC1C,KAAA;IAEA,IAAIuD,KAAAA,CAAMK,OAAO,EAAE;AACjBb,QAAAA,MAAAA,CAAOa,OAAO,GAAGF,MAAAA,CAAOS,WAAW,CACjCV,eAAAA,CAAgBF,KAAAA,CAAAA,CAAOzD,GAAG,CAAC,CAAC,CAACsE,GAAAA,EAAKJ,MAAAA,CAAO,GAAA;AACvC,YAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAA,EAAU;gBACzC,OAAO;AAACI,oBAAAA,GAAAA;AAAKJ,oBAAAA;AAAO,iBAAA;AACtB,YAAA;AAEA,YAAA,MAAM,EAAEF,WAAAA,EAAaO,kBAAkB,EAAE,GAAGC,gBAAgB,GAAG;AAC7D,gBAAA,GAAGN,MAAM;gBACT,GAAIA,MAAAA,CAAOpF,GAAG,GAAG;oBAAEA,GAAAA,EAAKmB,iBAAAA,CAAkBiE,MAAAA,CAAOpF,GAAG,EAAEoB,KAAAA;AAAO,iBAAA,GAAI;AACnE,aAAA;YAEA,OAAO;AAACoE,gBAAAA,GAAAA;AAAKE,gBAAAA;AAAe,aAAA;AAC9B,QAAA,CAAA,CAAA,CAAA;AAEJ,IAAA;IAEA,OAAOvB,MAAAA;AACT;AAEA;;AAEC,IACD,MAAMwB,4BAAAA,GACJ,CAACrD,KAAAA,GACD,OAAO,EAAEkD,GAAG,EAAE5F,KAAK,EAAEC,SAAS,EAAE,EAAE,EAAEgD,GAAG,EAAE,GAAA;AACvC,QAAA,MAAM,EAAEH,YAAY,EAAE,GAAGC,UAAAA,CAAW,MAAA,CAAA;AAEpC,QAAA,IAAI,CAAC9C,SAAAA,EAAW;AACd,YAAA;AACF,QAAA;AAEA,QAAA,OAAQA,UAAUC,IAAI;YACpB,KAAK,QAAA;gBACH+C,GAAAA,CAAI2C,GAAAA,EAAK,MAAMjB,eAAAA,CAAgB3E,KAAAA,EAAO8C,YAAAA,CAAAA,CAAAA;AACtC,gBAAA;YAEF,KAAK,UAAA;AACHG,gBAAAA,GAAAA,CAAI2C,KAAK,MAAMtC,eAAAA,CAAgBtD,OAAO,CAACI,GAAAA,GAAQiD,QAAQjD,GAAAA,EAAKsC,KAAAA,CAAAA,CAAAA,CAAAA;AAC5D,gBAAA;YAEF,KAAK,OAAA;AAAS,gBAAA;oBACZ,IAAI3C,MAAAA,CAAOC,OAAOC,SAAAA,CAAAA,EAAY;;wBAE5B,IAAIA,SAAAA,CAAU+F,QAAQ,EAAE;AACtB,4BAAA,MAAMC,WAAAA,GAAc,MAAM5B,KAAAA,CAAM/C,GAAG,CAACtB,KAAAA,EAAO8C,YAAAA,CAAAA;AAC3CG,4BAAAA,GAAAA,CAAI2C,GAAAA,EAAKK,WAAAA,CAAAA;AACT,4BAAA;AACF,wBAAA;;wBAGA,MAAMjD,UAAAA,GAAa,MAAMF,YAAAA,CAAa9C,KAAAA,CAAAA;AACtCiD,wBAAAA,GAAAA,CAAI2C,GAAAA,EAAK5C,UAAAA,CAAAA;AACX,oBAAA;AACA,oBAAA;AACF,gBAAA;AAIF;AACF,IAAA,CAAA;AAEF;;;;AAIC,IACD,MAAMkD,8BAAAA,GACJ,CAACxD,KAAAA,GACD,OAAO,EAAEkD,GAAG,EAAE5F,KAAK,EAAEC,SAAS,EAAE,EAAE,EAAEgD,GAAG,EAAE,GAAA;AACvC,QAAA,IAAI,CAAChD,SAAAA,EAAW;AACd,YAAA;AACF,QAAA;QAEA,IAAIA,SAAAA,CAAUC,IAAI,KAAK,QAAA,EAAU;AAC/B+C,YAAAA,GAAAA,CAAI2C,KAAK,MAAMjB,eAAAA,CAAgB3E,OAAO,CAAC+E,KAAAA,GAAUU,YAAYV,KAAAA,EAAOrC,KAAAA,CAAAA,CAAAA,CAAAA;AACpE,YAAA;AACF,QAAA;QAEA,IAAIzC,SAAAA,CAAUC,IAAI,KAAK,UAAA,EAAY;AACjC+C,YAAAA,GAAAA,CAAI2C,KAAK,MAAMtC,eAAAA,CAAgBtD,OAAO,CAACI,GAAAA,GAAQ+C,eAAe/C,GAAAA,EAAKsC,KAAAA,CAAAA,CAAAA,CAAAA;AACrE,QAAA;AACF,IAAA,CAAA;AAEF;;;;;;;;;;AAUC,UACKyD,eAAAA,GAAkB,OACtBC,MAAAA,EACAC,GAAAA,EACA3D,QAAmB/C,eAAAA,EAAiB,GAAA;AAEpC,IAAA,IAAI,CAACyG,MAAAA,EAAQ;QACX,OAAOA,MAAAA;AACT,IAAA;;AAGA,IAAA,IAAIC,QAAQC,cAAAA,EAAgB;AAC1B,QAAA,MAAM,EAAExD,YAAY,EAAE,GAAGC,UAAAA,CAAW,MAAA,CAAA;AACpC,QAAA,OAAOD,YAAAA,CAAasD,MAAAA,CAAAA;AACtB,IAAA;;IAGA,MAAMG,KAAAA,GAAQvE,MAAAA,CAAOwE,QAAQ,CAACH,GAAAA,CAAAA;AAC9B,IAAA,OAAOI;AAELV,IAAAA,4BAAAA,CAA6BrD,KAAAA,CAAAA,EAC7B;QAAEgE,MAAAA,EAAQH,KAAAA;AAAOC,QAAAA,QAAAA,EAAUxE,MAAAA,CAAOwE,QAAQ,CAACG,IAAI,CAAC3E,MAAAA;KAAQ,EACxDoE,MAAAA,CAAAA;AAEJ;AAEA;;;;AAIC,UACKQ,iBAAAA,GAAoB,OACxBC,IAAAA,EACAR,GAAAA,EACA3D,QAAmB/C,eAAAA,EAAiB,GAAA;IAEpC,IAAI,CAACkH,IAAAA,IAAQR,GAAAA,KAAQC,cAAAA,EAAgB;QACnC,OAAOO,IAAAA;AACT,IAAA;IAEA,MAAMN,KAAAA,GAAQvE,MAAAA,CAAOwE,QAAQ,CAACH,GAAAA,CAAAA;AAE9B,IAAA,OAAOI;AAELP,IAAAA,8BAAAA,CAA+BxD,KAAAA,CAAAA,EAC/B;QAAEgE,MAAAA,EAAQH,KAAAA;AAAOC,QAAAA,QAAAA,EAAUxE,MAAAA,CAAOwE,QAAQ,CAACG,IAAI,CAAC3E,MAAAA;KAAQ,EACxD6E,IAAAA,CAAAA;AAEJ;;;;"}
+{"version":3,"file":"utils.mjs","sources":["../../../../server/src/services/extensions/utils.ts"],"sourcesContent":["import path from 'path';\n\nimport { async, traverseEntity } from '@strapi/utils';\n\nimport type { Schema, UID } from '@strapi/types';\n\nimport { getService } from '../../utils';\nimport { FILE_MODEL_UID } from '../../constants';\n\nimport type { Config, File } from '../../types';\n\ntype SignEntityMediaVisitor = (\n  args: {\n    key: string;\n    value: unknown;\n    attribute: Schema.Attribute.AnyAttribute;\n  },\n  utils: {\n    set: (key: string, value: unknown) => void;\n  }\n) => Promise<void>;\n\n/**\n * One presign per distinct URL, keyed by the bare (unsigned) URL. The promise\n * is stored rather than its result so concurrent occurrences of the same URL\n * (the `async.map` in `mapRichtextUrls`, or several entries of a `findMany`)\n * share a single provider call.\n *\n * A cache must never outlive the document service call or migration run that\n * created it: a signed URL is only as fresh as the request that produced it.\n */\ntype SignCache = Map<string, Promise<string | null>>;\n\nconst createSignCache = (): SignCache => new Map();\n\n/**\n * URL bearing syntaxes found in a richtext (markdown) value. Each pattern\n * captures a prefix (group 1) and the URL (group 2) so the rebuild loop in\n * `mapRichtextUrls` can splice a new URL in place without touching anything\n * else.\n *\n * - markdown image / link: `![alt](url)` or `[text](url)`. The URL is captured\n *   up to the first whitespace or closing parenthesis, which also covers the\n *   optional title form `[text](url \"title\")`.\n * - raw HTML `src` / `href` attributes, double or single quoted, on the\n *   elements the editor lets users write by hand (`<img src=\"...\" width=\"200\">`\n *   is the usual way to size an image).\n */\nconst RICHTEXT_URL_REGEXES = [\n  /(!?\\[[^\\]]*\\]\\()([^)\\s]+)/g,\n  /(<(?:img|a|source|video|audio)\\b[^>]*?\\b(?:src|href)=\")([^\"]+)/gi,\n  /(<(?:img|a|source|video|audio)\\b[^>]*?\\b(?:src|href)=')([^']+)/gi,\n];\n\n/** Cheap short circuit for richtext values that cannot contain a URL we would rewrite. */\nconst RICHTEXT_URL_HINTS = ['](', 'src=', 'href='];\n\ntype BlocksNode = {\n  type?: string;\n  image?: File;\n  children?: unknown;\n  [key: string]: unknown;\n};\n\ntype ImageFormat = { url?: string; isUrlSigned?: boolean; [key: string]: unknown };\n\nfunction isFile(value: unknown, attribute: Schema.Attribute.AnyAttribute): value is File {\n  if (!value || attribute.type !== 'media') {\n    return false;\n  }\n\n  return true;\n}\n\nconst stripQueryString = (url: string) => url.split('?')[0];\n\nconst decodeQueryParamName = (pair: string) => {\n  const name = pair.split('=')[0];\n\n  try {\n    return decodeURIComponent(name);\n  } catch {\n    return name;\n  }\n};\n\n/**\n * Split a URL into what precedes the `?`, the raw `key=value` pairs of its\n * query string and the `#fragment`, if any. Plain string work on purpose:\n * `new URL` throws on the relative `/uploads/...` paths a local provider\n * writes, and would re-encode the pairs we want to hand back untouched.\n */\nconst splitUrl = (url: string) => {\n  const hashIndex = url.indexOf('#');\n  const fragment = hashIndex === -1 ? '' : url.slice(hashIndex);\n  const withoutFragment = hashIndex === -1 ? url : url.slice(0, hashIndex);\n\n  const queryIndex = withoutFragment.indexOf('?');\n\n  if (queryIndex === -1) {\n    return { base: withoutFragment, pairs: [] as string[], fragment };\n  }\n\n  return {\n    base: withoutFragment.slice(0, queryIndex),\n    pairs: withoutFragment\n      .slice(queryIndex + 1)\n      .split('&')\n      .filter(Boolean),\n    fragment,\n  };\n};\n\n/** Names of the query parameters of `url`, decoded, in order. */\nconst getQueryParamNames = (url: string): string[] => splitUrl(url).pairs.map(decodeQueryParamName);\n\n/**\n * `url` with every query parameter whose name is in `names` removed. The\n * surviving pairs keep their order and encoding; the `?` is dropped when\n * nothing is left.\n */\nconst removeQueryParams = (url: string, names: string[]): string => {\n  const { base, pairs, fragment } = splitUrl(url);\n\n  if (pairs.length === 0 || names.length === 0) {\n    return url;\n  }\n\n  const kept = pairs.filter((pair) => !names.includes(decodeQueryParamName(pair)));\n\n  return kept.length === 0 ? `${base}${fragment}` : `${base}?${kept.join('&')}${fragment}`;\n};\n\n/**\n * Build the minimal file shape `signFileUrls` needs out of a bare URL, as found\n * in a richtext value.\n *\n * `hash` and `ext` are taken from the last path segment and `path` is left\n * unset, which rebuilds the S3 key for the default layout and for the\n * `rootPath` provider option (the provider prefixes it itself). A URL whose key\n * has extra segments (a file uploaded with the per-file `path` option, or an\n * older key layout) is still recognised as ours by the provider, but it is\n * signed with a key that does not exist and the link returns 403. Media\n * signing has the same limit because `path` is not persisted on the file\n * (`content-types/file.ts`). Not addressed here.\n */\nconst getFileFromUrl = (url: string): File => {\n  const unsignedUrl = stripQueryString(url);\n  const { provider } = strapi.config.get<Config>('plugin::upload');\n  const { name, ext } = path.parse(unsignedUrl.split('/').pop() ?? '');\n\n  return { url: unsignedUrl, hash: name, ext, provider } as File;\n};\n\n/**\n * Ask the provider to sign `file` and return the signed URL if the provider\n * owns it, otherwise `null`. Memoised in `cache` by the bare URL.\n *\n * Ownership is decided by whether the provider changed the URL: `signFileUrls`\n * flags every file of the configured provider as signed, but the provider\n * itself returns URLs it does not own untouched (an S3 URL from another\n * bucket, an external site, a local `/uploads` path), so a changed URL is the\n * only reliable signal. `file.url` must already be the bare URL so the\n * comparison is meaningful.\n */\nconst signFileIfOwned = (file: File, cache: SignCache): Promise<string | null> => {\n  const bareUrl = file.url ?? '';\n  const cached = cache.get(bareUrl);\n\n  if (cached) {\n    return cached;\n  }\n\n  const pending = (async () => {\n    const { signFileUrls } = getService('file');\n    const signedFile = await signFileUrls(file);\n\n    return signedFile.url && signedFile.url !== bareUrl ? signedFile.url : null;\n  })();\n\n  cache.set(bareUrl, pending);\n\n  return pending;\n};\n\n/**\n * Signs a richtext URL if the configured provider owns it, otherwise `null`.\n * See `signFileIfOwned` for how ownership is decided. A single predicate means\n * the read path (sign) and the write path (unsign) can never disagree about\n * what they own.\n */\nconst signIfOwned = (url: string, cache: SignCache): Promise<string | null> =>\n  signFileIfOwned(getFileFromUrl(url), cache);\n\n/**\n * Returns a richtext URL with its signature removed, if we own it.\n *\n * Only the query parameters the provider's own fresh signature introduces are\n * removed (for S3, the `X-Amz-*` family), every other parameter is kept. That\n * way a provider that signs whatever it is handed cannot make us drop `?v=x`\n * from a link to an external site. A parameter of an old signature that the\n * fresh one no longer carries (an `X-Amz-Security-Token` from credentials no\n * longer in use, say) survives in the row; it is not a signature, and the read\n * path replaces the whole URL with the provider output anyway.\n */\nconst stripSignedUrl = async (url: string, cache: SignCache) => {\n  // Nothing to strip, and no reason to ask the provider\n  if (!url.includes('?')) {\n    return url;\n  }\n\n  const signedUrl = await signIfOwned(url, cache);\n\n  if (signedUrl === null) {\n    return url;\n  }\n\n  return removeQueryParams(url, getQueryParamNames(signedUrl));\n};\n\n/** Returns a freshly signed richtext URL, if we own it. */\nconst signUrl = async (url: string, cache: SignCache) => (await signIfOwned(url, cache)) ?? url;\n\n/**\n * Apply `mapUrl` to every markdown image / link URL and every raw HTML\n * `src` / `href` URL of a richtext value.\n */\nconst mapRichtextUrls = async (value: unknown, mapUrl: (url: string) => Promise<string>) => {\n  if (typeof value !== 'string' || !RICHTEXT_URL_HINTS.some((hint) => value.includes(hint))) {\n    return value;\n  }\n\n  // The rebuild loop splices by match index, so matches must be in ascending order\n  const matches = RICHTEXT_URL_REGEXES.flatMap((regex) => Array.from(value.matchAll(regex))).sort(\n    (a, b) => (a.index as number) - (b.index as number)\n  );\n\n  if (matches.length === 0) {\n    return value;\n  }\n\n  const urls: string[] = await async.map(matches, (match: RegExpMatchArray) => mapUrl(match[2]));\n\n  let result = '';\n  let cursor = 0;\n\n  matches.forEach((match, index) => {\n    const urlStart = (match.index as number) + match[1].length;\n\n    // Two patterns matched overlapping text: keep the first, never splice twice\n    if (urlStart < cursor) {\n      return;\n    }\n\n    result += value.slice(cursor, urlStart) + urls[index];\n    cursor = urlStart + match[2].length;\n  });\n\n  return result + value.slice(cursor);\n};\n\n/**\n * Apply `mapImage` to every `image` node of a blocks value, recursively.\n * A new array is always returned, the original value is never mutated.\n */\nconst mapBlocksImages = async (\n  value: unknown,\n  mapImage: (image: File) => Promise<File>\n): Promise<unknown> => {\n  if (!Array.isArray(value)) {\n    return value;\n  }\n\n  return async.map(value, async (node: BlocksNode) => {\n    if (!node || typeof node !== 'object') {\n      return node;\n    }\n\n    let result = node;\n\n    if (node.type === 'image' && node.image) {\n      result = { ...result, image: await mapImage(node.image) };\n    }\n\n    if (Array.isArray(node.children)) {\n      result = { ...result, children: await mapBlocksImages(node.children, mapImage) };\n    }\n\n    return result;\n  });\n};\n\nconst getImageFormats = (image: File): [string, ImageFormat][] =>\n  Object.entries(image.formats ?? {}) as [string, ImageFormat][];\n\n/** True when the node still carries anything `unsignImage` would remove. */\nconst hasSignatureTraces = (image: File) => {\n  if (image.isUrlSigned !== undefined || (image.url ?? '').includes('?')) {\n    return true;\n  }\n\n  return getImageFormats(image).some(\n    ([, format]) => format?.isUrlSigned !== undefined || (format?.url ?? '').includes('?')\n  );\n};\n\n/**\n * Remove the signature from a blocks `image` node: the signature parameters on\n * the file URL and on every format URL (the same presigner signs them all, so\n * the same parameter names apply), and the `isUrlSigned` flag `signFileUrls`\n * sets on the file and on each format. The node carries a full file object, so\n * the ownership check is made with it rather than with a URL derived stand in.\n */\nconst unsignImage = async (image: File, cache: SignCache = createSignCache()) => {\n  // Already bare: nothing to do, and no reason to ask the provider\n  if (!hasSignatureTraces(image)) {\n    return image;\n  }\n\n  const bareUrl = stripQueryString(image.url ?? '');\n  const signedUrl = await signFileIfOwned({ ...image, url: bareUrl }, cache);\n\n  // Not one of ours (different provider, external URL, public provider): the\n  // provider hands the URL back unchanged, leave the node as is\n  if (signedUrl === null) {\n    return image;\n  }\n\n  const names = getQueryParamNames(signedUrl);\n  const { isUrlSigned: _isUrlSigned, ...result }: File = {\n    ...image,\n    url: removeQueryParams(image.url ?? '', names),\n  };\n\n  if (image.formats) {\n    result.formats = Object.fromEntries(\n      getImageFormats(image).map(([key, format]) => {\n        if (!format || typeof format !== 'object') {\n          return [key, format];\n        }\n\n        const { isUrlSigned: _formatIsUrlSigned, ...unsignedFormat } = {\n          ...format,\n          ...(format.url ? { url: removeQueryParams(format.url, names) } : {}),\n        };\n\n        return [key, unsignedFormat];\n      })\n    );\n  }\n\n  return result;\n};\n\n/**\n * Visitor function to sign media URLs\n */\nconst createSignEntityMediaVisitor =\n  (cache: SignCache): SignEntityMediaVisitor =>\n  async ({ key, value, attribute }, { set }) => {\n    const { signFileUrls } = getService('file');\n\n    if (!attribute) {\n      return;\n    }\n\n    switch (attribute.type) {\n      case 'blocks':\n        set(key, await mapBlocksImages(value, signFileUrls));\n        return;\n\n      case 'richtext':\n        set(key, await mapRichtextUrls(value, (url) => signUrl(url, cache)));\n        return;\n\n      case 'media': {\n        if (isFile(value, attribute)) {\n          // If the attribute is repeatable sign each file\n          if (attribute.multiple) {\n            const signedFiles = await async.map(value, signFileUrls);\n            set(key, signedFiles);\n            return;\n          }\n\n          // If the attribute is not repeatable only sign a single file\n          const signedFile = await signFileUrls(value);\n          set(key, signedFile);\n        }\n        break;\n      }\n\n      default:\n        break;\n    }\n  };\n\n/**\n * Visitor function to remove the signature from richtext / blocks URLs before\n * they are persisted. Media attributes are left alone: the files table already\n * holds the unsigned URL.\n */\nconst createUnsignEntityMediaVisitor =\n  (cache: SignCache): SignEntityMediaVisitor =>\n  async ({ key, value, attribute }, { set }) => {\n    if (!attribute) {\n      return;\n    }\n\n    if (attribute.type === 'blocks') {\n      set(key, await mapBlocksImages(value, (image) => unsignImage(image, cache)));\n      return;\n    }\n\n    if (attribute.type === 'richtext') {\n      set(key, await mapRichtextUrls(value, (url) => stripSignedUrl(url, cache)));\n    }\n  };\n\n/**\n *\n * Iterate through an entity manager result\n * Check which modelAttributes are media and pre sign the image URLs\n * if they are from the current upload provider\n *\n * @param {Object} entity\n * @param {UID.Schema} uid - UID of the model the entity belongs to\n * @param {Map} cache one per document service call, see `SignCache`\n * @returns\n */\nconst signEntityMedia = async (\n  entity: any,\n  uid: UID.Schema,\n  cache: SignCache = createSignCache()\n) => {\n  if (!entity) {\n    return entity;\n  }\n\n  // If the entity itself is a file, sign it directly\n  if (uid === FILE_MODEL_UID) {\n    const { signFileUrls } = getService('file');\n    return signFileUrls(entity);\n  }\n\n  // If the entity is a regular content type, look for media attributes\n  const model = strapi.getModel(uid);\n  return traverseEntity(\n    // @ts-expect-error - FIXME: fix traverseEntity using wrong types\n    createSignEntityMediaVisitor(cache),\n    { schema: model, getModel: strapi.getModel.bind(strapi) },\n    entity\n  );\n};\n\n/**\n * Iterate through the input data of a create / update / clone and replace\n * every signed provider URL found in a richtext or blocks attribute with its\n * unsigned form, so that a short lived signature is never persisted.\n */\nconst unsignEntityMedia = async (\n  data: any,\n  uid: UID.Schema,\n  cache: SignCache = createSignCache()\n) => {\n  if (!data || uid === FILE_MODEL_UID) {\n    return data;\n  }\n\n  const model = strapi.getModel(uid);\n\n  return traverseEntity(\n    // @ts-expect-error - FIXME: fix traverseEntity using wrong types\n    createUnsignEntityMediaVisitor(cache),\n    { schema: model, getModel: strapi.getModel.bind(strapi) },\n    data\n  );\n};\n\nexport type { SignCache };\n\nexport {\n  createSignCache,\n  signEntityMedia,\n  unsignEntityMedia,\n  mapRichtextUrls,\n  mapBlocksImages,\n  stripSignedUrl,\n  unsignImage,\n};\n"],"names":["createSignCache","Map","RICHTEXT_URL_REGEXES","RICHTEXT_URL_HINTS","isFile","value","attribute","type","stripQueryString","url","split","decodeQueryParamName","pair","name","decodeURIComponent","splitUrl","hashIndex","indexOf","fragment","slice","withoutFragment","queryIndex","base","pairs","filter","Boolean","getQueryParamNames","map","removeQueryParams","names","length","kept","includes","join","getFileFromUrl","unsignedUrl","provider","strapi","config","get","ext","path","parse","pop","hash","signFileIfOwned","file","cache","bareUrl","cached","pending","signFileUrls","getService","signedFile","set","signIfOwned","stripSignedUrl","signedUrl","signUrl","mapRichtextUrls","mapUrl","some","hint","matches","flatMap","regex","Array","from","matchAll","sort","a","b","index","urls","async","match","result","cursor","forEach","urlStart","mapBlocksImages","mapImage","isArray","node","image","children","getImageFormats","Object","entries","formats","hasSignatureTraces","isUrlSigned","undefined","format","unsignImage","_isUrlSigned","fromEntries","key","_formatIsUrlSigned","unsignedFormat","createSignEntityMediaVisitor","multiple","signedFiles","createUnsignEntityMediaVisitor","signEntityMedia","entity","uid","FILE_MODEL_UID","model","getModel","traverseEntity","schema","bind","unsignEntityMedia","data"],"mappings":";;;;;AAiCA,MAAMA,eAAAA,GAAkB,IAAiB,IAAIC,GAAAA;AAE7C;;;;;;;;;;;;AAYC,IACD,MAAMC,oBAAAA,GAAuB;AAC3B,IAAA,4BAAA;AACA,IAAA,kEAAA;AACA,IAAA;AACD,CAAA;AAED,2FACA,MAAMC,kBAAAA,GAAqB;AAAC,IAAA,IAAA;AAAM,IAAA,MAAA;AAAQ,IAAA;AAAQ,CAAA;AAWlD,SAASC,MAAAA,CAAOC,KAAc,EAAEC,SAAwC,EAAA;AACtE,IAAA,IAAI,CAACD,KAAAA,IAASC,SAAAA,CAAUC,IAAI,KAAK,OAAA,EAAS;QACxC,OAAO,KAAA;AACT,IAAA;IAEA,OAAO,IAAA;AACT;AAEA,MAAMC,gBAAAA,GAAmB,CAACC,GAAAA,GAAgBA,GAAAA,CAAIC,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAE3D,MAAMC,uBAAuB,CAACC,IAAAA,GAAAA;AAC5B,IAAA,MAAMC,OAAOD,IAAAA,CAAKF,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;IAE/B,IAAI;AACF,QAAA,OAAOI,kBAAAA,CAAmBD,IAAAA,CAAAA;AAC5B,IAAA,CAAA,CAAE,OAAM;QACN,OAAOA,IAAAA;AACT,IAAA;AACF,CAAA;AAEA;;;;;IAMA,MAAME,WAAW,CAACN,GAAAA,GAAAA;IAChB,MAAMO,SAAAA,GAAYP,GAAAA,CAAIQ,OAAO,CAAC,GAAA,CAAA;AAC9B,IAAA,MAAMC,WAAWF,SAAAA,KAAc,KAAK,EAAA,GAAKP,GAAAA,CAAIU,KAAK,CAACH,SAAAA,CAAAA;IACnD,MAAMI,eAAAA,GAAkBJ,cAAc,EAAC,GAAIP,MAAMA,GAAAA,CAAIU,KAAK,CAAC,CAAA,EAAGH,SAAAA,CAAAA;IAE9D,MAAMK,UAAAA,GAAaD,eAAAA,CAAgBH,OAAO,CAAC,GAAA,CAAA;IAE3C,IAAII,UAAAA,KAAe,EAAC,EAAG;QACrB,OAAO;YAAEC,IAAAA,EAAMF,eAAAA;AAAiBG,YAAAA,KAAAA,EAAO,EAAE;AAAcL,YAAAA;AAAS,SAAA;AAClE,IAAA;IAEA,OAAO;QACLI,IAAAA,EAAMF,eAAAA,CAAgBD,KAAK,CAAC,CAAA,EAAGE,UAAAA,CAAAA;QAC/BE,KAAAA,EAAOH,eAAAA,CACJD,KAAK,CAACE,UAAAA,GAAa,GACnBX,KAAK,CAAC,GAAA,CAAA,CACNc,MAAM,CAACC,OAAAA,CAAAA;AACVP,QAAAA;AACF,KAAA;AACF,CAAA;AAEA,kEACA,MAAMQ,kBAAAA,GAAqB,CAACjB,GAAAA,GAA0BM,SAASN,GAAAA,CAAAA,CAAKc,KAAK,CAACI,GAAG,CAAChB,oBAAAA,CAAAA;AAE9E;;;;IAKA,MAAMiB,iBAAAA,GAAoB,CAACnB,GAAAA,EAAaoB,KAAAA,GAAAA;IACtC,MAAM,EAAEP,IAAI,EAAEC,KAAK,EAAEL,QAAQ,EAAE,GAAGH,QAAAA,CAASN,GAAAA,CAAAA;AAE3C,IAAA,IAAIc,MAAMO,MAAM,KAAK,KAAKD,KAAAA,CAAMC,MAAM,KAAK,CAAA,EAAG;QAC5C,OAAOrB,GAAAA;AACT,IAAA;IAEA,MAAMsB,IAAAA,GAAOR,KAAAA,CAAMC,MAAM,CAAC,CAACZ,OAAS,CAACiB,KAAAA,CAAMG,QAAQ,CAACrB,oBAAAA,CAAqBC,IAAAA,CAAAA,CAAAA,CAAAA;AAEzE,IAAA,OAAOmB,KAAKD,MAAM,KAAK,CAAA,GAAI,CAAA,EAAGR,OAAOJ,QAAAA,CAAAA,CAAU,GAAG,CAAA,EAAGI,IAAAA,CAAK,CAAC,EAAES,IAAAA,CAAKE,IAAI,CAAC,OAAOf,QAAAA,CAAAA,CAAU;AAC1F,CAAA;AAEA;;;;;;;;;;;;IAaA,MAAMgB,iBAAiB,CAACzB,GAAAA,GAAAA;AACtB,IAAA,MAAM0B,cAAc3B,gBAAAA,CAAiBC,GAAAA,CAAAA;IACrC,MAAM,EAAE2B,QAAQ,EAAE,GAAGC,OAAOC,MAAM,CAACC,GAAG,CAAS,gBAAA,CAAA;AAC/C,IAAA,MAAM,EAAE1B,IAAI,EAAE2B,GAAG,EAAE,GAAGC,IAAAA,CAAKC,KAAK,CAACP,WAAAA,CAAYzB,KAAK,CAAC,GAAA,CAAA,CAAKiC,GAAG,EAAA,IAAM,EAAA,CAAA;IAEjE,OAAO;QAAElC,GAAAA,EAAK0B,WAAAA;QAAaS,IAAAA,EAAM/B,IAAAA;AAAM2B,QAAAA,GAAAA;AAAKJ,QAAAA;AAAS,KAAA;AACvD,CAAA;AAEA;;;;;;;;;;IAWA,MAAMS,eAAAA,GAAkB,CAACC,IAAAA,EAAYC,KAAAA,GAAAA;IACnC,MAAMC,OAAAA,GAAUF,IAAAA,CAAKrC,GAAG,IAAI,EAAA;IAC5B,MAAMwC,MAAAA,GAASF,KAAAA,CAAMR,GAAG,CAACS,OAAAA,CAAAA;AAEzB,IAAA,IAAIC,MAAAA,EAAQ;QACV,OAAOA,MAAAA;AACT,IAAA;IAEA,MAAMC,OAAAA,GAAU,CAAC,UAAA;AACf,QAAA,MAAM,EAAEC,YAAY,EAAE,GAAGC,UAAAA,CAAW,MAAA,CAAA;QACpC,MAAMC,UAAAA,GAAa,MAAMF,YAAAA,CAAaL,IAAAA,CAAAA;QAEtC,OAAOO,UAAAA,CAAW5C,GAAG,IAAI4C,UAAAA,CAAW5C,GAAG,KAAKuC,OAAAA,GAAUK,UAAAA,CAAW5C,GAAG,GAAG,IAAA;IACzE,CAAA,GAAA;IAEAsC,KAAAA,CAAMO,GAAG,CAACN,OAAAA,EAASE,OAAAA,CAAAA;IAEnB,OAAOA,OAAAA;AACT,CAAA;AAEA;;;;;AAKC,IACD,MAAMK,WAAAA,GAAc,CAAC9C,KAAasC,KAAAA,GAChCF,eAAAA,CAAgBX,eAAezB,GAAAA,CAAAA,EAAMsC,KAAAA,CAAAA;AAEvC;;;;;;;;;;IAWA,MAAMS,cAAAA,GAAiB,OAAO/C,GAAAA,EAAasC,KAAAA,GAAAA;;AAEzC,IAAA,IAAI,CAACtC,GAAAA,CAAIuB,QAAQ,CAAC,GAAA,CAAA,EAAM;QACtB,OAAOvB,GAAAA;AACT,IAAA;IAEA,MAAMgD,SAAAA,GAAY,MAAMF,WAAAA,CAAY9C,GAAAA,EAAKsC,KAAAA,CAAAA;AAEzC,IAAA,IAAIU,cAAc,IAAA,EAAM;QACtB,OAAOhD,GAAAA;AACT,IAAA;IAEA,OAAOmB,iBAAAA,CAAkBnB,KAAKiB,kBAAAA,CAAmB+B,SAAAA,CAAAA,CAAAA;AACnD;AAEA,4DACA,MAAMC,OAAAA,GAAU,OAAOjD,GAAAA,EAAasC,QAAqB,MAAOQ,WAAAA,CAAY9C,GAAAA,EAAKsC,KAAAA,CAAAA,IAAWtC,GAAAA;AAE5F;;;IAIA,MAAMkD,eAAAA,GAAkB,OAAOtD,KAAAA,EAAgBuD,MAAAA,GAAAA;AAC7C,IAAA,IAAI,OAAOvD,KAAAA,KAAU,QAAA,IAAY,CAACF,kBAAAA,CAAmB0D,IAAI,CAAC,CAACC,IAAAA,GAASzD,KAAAA,CAAM2B,QAAQ,CAAC8B,IAAAA,CAAAA,CAAAA,EAAQ;QACzF,OAAOzD,KAAAA;AACT,IAAA;;IAGA,MAAM0D,OAAAA,GAAU7D,qBAAqB8D,OAAO,CAAC,CAACC,KAAAA,GAAUC,KAAAA,CAAMC,IAAI,CAAC9D,KAAAA,CAAM+D,QAAQ,CAACH,KAAAA,CAAAA,CAAAA,CAAAA,CAASI,IAAI,CAC7F,CAACC,CAAAA,EAAGC,CAAAA,GAAM,CAACD,CAAEE,KAAK,GAAeD,CAAAA,CAAEC,KAAK,CAAA;IAG1C,IAAIT,OAAAA,CAAQjC,MAAM,KAAK,CAAA,EAAG;QACxB,OAAOzB,KAAAA;AACT,IAAA;IAEA,MAAMoE,IAAAA,GAAiB,MAAMC,KAAAA,CAAM/C,GAAG,CAACoC,OAAAA,EAAS,CAACY,KAAAA,GAA4Bf,MAAAA,CAAOe,KAAK,CAAC,CAAA,CAAE,CAAA,CAAA;AAE5F,IAAA,IAAIC,MAAAA,GAAS,EAAA;AACb,IAAA,IAAIC,MAAAA,GAAS,CAAA;IAEbd,OAAAA,CAAQe,OAAO,CAAC,CAACH,KAAAA,EAAOH,KAAAA,GAAAA;QACtB,MAAMO,QAAAA,GAAW,KAACJ,CAAMH,KAAK,GAAcG,KAAK,CAAC,CAAA,CAAE,CAAC7C,MAAM;;AAG1D,QAAA,IAAIiD,WAAWF,MAAAA,EAAQ;AACrB,YAAA;AACF,QAAA;AAEAD,QAAAA,MAAAA,IAAUvE,MAAMc,KAAK,CAAC0D,QAAQE,QAAAA,CAAAA,GAAYN,IAAI,CAACD,KAAAA,CAAM;AACrDK,QAAAA,MAAAA,GAASE,QAAAA,GAAWJ,KAAK,CAAC,CAAA,CAAE,CAAC7C,MAAM;AACrC,IAAA,CAAA,CAAA;IAEA,OAAO8C,MAAAA,GAASvE,KAAAA,CAAMc,KAAK,CAAC0D,MAAAA,CAAAA;AAC9B;AAEA;;;IAIA,MAAMG,eAAAA,GAAkB,OACtB3E,KAAAA,EACA4E,QAAAA,GAAAA;AAEA,IAAA,IAAI,CAACf,KAAAA,CAAMgB,OAAO,CAAC7E,KAAAA,CAAAA,EAAQ;QACzB,OAAOA,KAAAA;AACT,IAAA;AAEA,IAAA,OAAOqE,KAAAA,CAAM/C,GAAG,CAACtB,KAAAA,EAAO,OAAO8E,IAAAA,GAAAA;AAC7B,QAAA,IAAI,CAACA,IAAAA,IAAQ,OAAOA,IAAAA,KAAS,QAAA,EAAU;YACrC,OAAOA,IAAAA;AACT,QAAA;AAEA,QAAA,IAAIP,MAAAA,GAASO,IAAAA;AAEb,QAAA,IAAIA,KAAK5E,IAAI,KAAK,OAAA,IAAW4E,IAAAA,CAAKC,KAAK,EAAE;YACvCR,MAAAA,GAAS;AAAE,gBAAA,GAAGA,MAAM;gBAAEQ,KAAAA,EAAO,MAAMH,QAAAA,CAASE,IAAAA,CAAKC,KAAK;AAAE,aAAA;AAC1D,QAAA;AAEA,QAAA,IAAIlB,KAAAA,CAAMgB,OAAO,CAACC,IAAAA,CAAKE,QAAQ,CAAA,EAAG;YAChCT,MAAAA,GAAS;AAAE,gBAAA,GAAGA,MAAM;AAAES,gBAAAA,QAAAA,EAAU,MAAML,eAAAA,CAAgBG,IAAAA,CAAKE,QAAQ,EAAEJ,QAAAA;AAAU,aAAA;AACjF,QAAA;QAEA,OAAOL,MAAAA;AACT,IAAA,CAAA,CAAA;AACF;AAEA,MAAMU,eAAAA,GAAkB,CAACF,KAAAA,GACvBG,MAAAA,CAAOC,OAAO,CAACJ,KAAAA,CAAMK,OAAO,IAAI,EAAC,CAAA;AAEnC,6EACA,MAAMC,kBAAAA,GAAqB,CAACN,KAAAA,GAAAA;AAC1B,IAAA,IAAIA,KAAAA,CAAMO,WAAW,KAAKC,SAAAA,IAAa,CAACR,KAAAA,CAAM3E,GAAG,IAAI,EAAC,EAAGuB,QAAQ,CAAC,GAAA,CAAA,EAAM;QACtE,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOsD,gBAAgBF,KAAAA,CAAAA,CAAOvB,IAAI,CAChC,CAAC,GAAGgC,OAAO,GAAKA,MAAAA,EAAQF,WAAAA,KAAgBC,SAAAA,IAAa,CAACC,MAAAA,EAAQpF,OAAO,EAAC,EAAGuB,QAAQ,CAAC,GAAA,CAAA,CAAA;AAEtF,CAAA;AAEA;;;;;;AAMC,IACD,MAAM8D,WAAAA,GAAc,OAAOV,KAAAA,EAAarC,QAAmB/C,eAAAA,EAAiB,GAAA;;IAE1E,IAAI,CAAC0F,mBAAmBN,KAAAA,CAAAA,EAAQ;QAC9B,OAAOA,KAAAA;AACT,IAAA;AAEA,IAAA,MAAMpC,OAAAA,GAAUxC,gBAAAA,CAAiB4E,KAAAA,CAAM3E,GAAG,IAAI,EAAA,CAAA;IAC9C,MAAMgD,SAAAA,GAAY,MAAMZ,eAAAA,CAAgB;AAAE,QAAA,GAAGuC,KAAK;QAAE3E,GAAAA,EAAKuC;KAAQ,EAAGD,KAAAA,CAAAA;;;AAIpE,IAAA,IAAIU,cAAc,IAAA,EAAM;QACtB,OAAO2B,KAAAA;AACT,IAAA;AAEA,IAAA,MAAMvD,QAAQH,kBAAAA,CAAmB+B,SAAAA,CAAAA;AACjC,IAAA,MAAM,EAAEkC,WAAAA,EAAaI,YAAY,EAAE,GAAGnB,QAAQ,GAAS;AACrD,QAAA,GAAGQ,KAAK;AACR3E,QAAAA,GAAAA,EAAKmB,iBAAAA,CAAkBwD,KAAAA,CAAM3E,GAAG,IAAI,EAAA,EAAIoB,KAAAA;AAC1C,KAAA;IAEA,IAAIuD,KAAAA,CAAMK,OAAO,EAAE;AACjBb,QAAAA,MAAAA,CAAOa,OAAO,GAAGF,MAAAA,CAAOS,WAAW,CACjCV,eAAAA,CAAgBF,KAAAA,CAAAA,CAAOzD,GAAG,CAAC,CAAC,CAACsE,GAAAA,EAAKJ,MAAAA,CAAO,GAAA;AACvC,YAAA,IAAI,CAACA,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAA,EAAU;gBACzC,OAAO;AAACI,oBAAAA,GAAAA;AAAKJ,oBAAAA;AAAO,iBAAA;AACtB,YAAA;AAEA,YAAA,MAAM,EAAEF,WAAAA,EAAaO,kBAAkB,EAAE,GAAGC,gBAAgB,GAAG;AAC7D,gBAAA,GAAGN,MAAM;gBACT,GAAIA,MAAAA,CAAOpF,GAAG,GAAG;oBAAEA,GAAAA,EAAKmB,iBAAAA,CAAkBiE,MAAAA,CAAOpF,GAAG,EAAEoB,KAAAA;AAAO,iBAAA,GAAI;AACnE,aAAA;YAEA,OAAO;AAACoE,gBAAAA,GAAAA;AAAKE,gBAAAA;AAAe,aAAA;AAC9B,QAAA,CAAA,CAAA,CAAA;AAEJ,IAAA;IAEA,OAAOvB,MAAAA;AACT;AAEA;;AAEC,IACD,MAAMwB,4BAAAA,GACJ,CAACrD,KAAAA,GACD,OAAO,EAAEkD,GAAG,EAAE5F,KAAK,EAAEC,SAAS,EAAE,EAAE,EAAEgD,GAAG,EAAE,GAAA;AACvC,QAAA,MAAM,EAAEH,YAAY,EAAE,GAAGC,UAAAA,CAAW,MAAA,CAAA;AAEpC,QAAA,IAAI,CAAC9C,SAAAA,EAAW;AACd,YAAA;AACF,QAAA;AAEA,QAAA,OAAQA,UAAUC,IAAI;YACpB,KAAK,QAAA;gBACH+C,GAAAA,CAAI2C,GAAAA,EAAK,MAAMjB,eAAAA,CAAgB3E,KAAAA,EAAO8C,YAAAA,CAAAA,CAAAA;AACtC,gBAAA;YAEF,KAAK,UAAA;AACHG,gBAAAA,GAAAA,CAAI2C,KAAK,MAAMtC,eAAAA,CAAgBtD,OAAO,CAACI,GAAAA,GAAQiD,QAAQjD,GAAAA,EAAKsC,KAAAA,CAAAA,CAAAA,CAAAA;AAC5D,gBAAA;YAEF,KAAK,OAAA;AAAS,gBAAA;oBACZ,IAAI3C,MAAAA,CAAOC,OAAOC,SAAAA,CAAAA,EAAY;;wBAE5B,IAAIA,SAAAA,CAAU+F,QAAQ,EAAE;AACtB,4BAAA,MAAMC,WAAAA,GAAc,MAAM5B,KAAAA,CAAM/C,GAAG,CAACtB,KAAAA,EAAO8C,YAAAA,CAAAA;AAC3CG,4BAAAA,GAAAA,CAAI2C,GAAAA,EAAKK,WAAAA,CAAAA;AACT,4BAAA;AACF,wBAAA;;wBAGA,MAAMjD,UAAAA,GAAa,MAAMF,YAAAA,CAAa9C,KAAAA,CAAAA;AACtCiD,wBAAAA,GAAAA,CAAI2C,GAAAA,EAAK5C,UAAAA,CAAAA;AACX,oBAAA;AACA,oBAAA;AACF,gBAAA;AAIF;AACF,IAAA,CAAA;AAEF;;;;AAIC,IACD,MAAMkD,8BAAAA,GACJ,CAACxD,KAAAA,GACD,OAAO,EAAEkD,GAAG,EAAE5F,KAAK,EAAEC,SAAS,EAAE,EAAE,EAAEgD,GAAG,EAAE,GAAA;AACvC,QAAA,IAAI,CAAChD,SAAAA,EAAW;AACd,YAAA;AACF,QAAA;QAEA,IAAIA,SAAAA,CAAUC,IAAI,KAAK,QAAA,EAAU;AAC/B+C,YAAAA,GAAAA,CAAI2C,KAAK,MAAMjB,eAAAA,CAAgB3E,OAAO,CAAC+E,KAAAA,GAAUU,YAAYV,KAAAA,EAAOrC,KAAAA,CAAAA,CAAAA,CAAAA;AACpE,YAAA;AACF,QAAA;QAEA,IAAIzC,SAAAA,CAAUC,IAAI,KAAK,UAAA,EAAY;AACjC+C,YAAAA,GAAAA,CAAI2C,KAAK,MAAMtC,eAAAA,CAAgBtD,OAAO,CAACI,GAAAA,GAAQ+C,eAAe/C,GAAAA,EAAKsC,KAAAA,CAAAA,CAAAA,CAAAA;AACrE,QAAA;AACF,IAAA,CAAA;AAEF;;;;;;;;;;AAUC,UACKyD,eAAAA,GAAkB,OACtBC,MAAAA,EACAC,GAAAA,EACA3D,QAAmB/C,eAAAA,EAAiB,GAAA;AAEpC,IAAA,IAAI,CAACyG,MAAAA,EAAQ;QACX,OAAOA,MAAAA;AACT,IAAA;;AAGA,IAAA,IAAIC,QAAQC,cAAAA,EAAgB;AAC1B,QAAA,MAAM,EAAExD,YAAY,EAAE,GAAGC,UAAAA,CAAW,MAAA,CAAA;AACpC,QAAA,OAAOD,YAAAA,CAAasD,MAAAA,CAAAA;AACtB,IAAA;;IAGA,MAAMG,KAAAA,GAAQvE,MAAAA,CAAOwE,QAAQ,CAACH,GAAAA,CAAAA;AAC9B,IAAA,OAAOI;AAELV,IAAAA,4BAAAA,CAA6BrD,KAAAA,CAAAA,EAC7B;QAAEgE,MAAAA,EAAQH,KAAAA;AAAOC,QAAAA,QAAAA,EAAUxE,MAAAA,CAAOwE,QAAQ,CAACG,IAAI,CAAC3E,MAAAA;KAAQ,EACxDoE,MAAAA,CAAAA;AAEJ;AAEA;;;;AAIC,UACKQ,iBAAAA,GAAoB,OACxBC,IAAAA,EACAR,GAAAA,EACA3D,QAAmB/C,eAAAA,EAAiB,GAAA;IAEpC,IAAI,CAACkH,IAAAA,IAAQR,GAAAA,KAAQC,cAAAA,EAAgB;QACnC,OAAOO,IAAAA;AACT,IAAA;IAEA,MAAMN,KAAAA,GAAQvE,MAAAA,CAAOwE,QAAQ,CAACH,GAAAA,CAAAA;AAE9B,IAAA,OAAOI;AAELP,IAAAA,8BAAAA,CAA+BxD,KAAAA,CAAAA,EAC/B;QAAEgE,MAAAA,EAAQH,KAAAA;AAAOC,QAAAA,QAAAA,EAAUxE,MAAAA,CAAOwE,QAAQ,CAACG,IAAI,CAAC3E,MAAAA;KAAQ,EACxD6E,IAAAA,CAAAA;AAEJ;;;;"}

package/dist/server/src/services/extensions/utils.d.ts

@@ -80,7 +80,7 @@ declare const unsignImage: (image: File, cache?: SignCache) => Promise<{
  * if they are from the current upload provider
  *
  * @param {Object} entity
- * @param {Object} modelAttributes
+ * @param {UID.Schema} uid - UID of the model the entity belongs to
  * @param {Map} cache one per document service call, see `SignCache`
  * @returns
  */

package/dist/server/utils/mime-validation.js

@@ -60,7 +60,7 @@ function matchesMimePattern(mimeType, patterns) {
 }
 /**
  * Single gate for allow/deny. Returns ValidationResult.
- * Doc: docs/docs/01-core/upload/01-backend/01-mime-validation.md
+ * Doc: docs/docs/packages/core/upload/01-backend/01-mime-validation.md
  */ function validateAllowBanLists(mimetype, fileName, declaredType, detectedType, config) {
     if (!mimetype) {
         return {

package/dist/server/utils/mime-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"mime-validation.js","sources":["../../../server/src/utils/mime-validation.ts"],"sourcesContent":["import { open } from 'node:fs/promises';\nimport { extname } from 'node:path';\nimport { lookup } from 'mime-types';\nimport type { Core } from '@strapi/types';\nimport { errors } from '@strapi/utils';\n\nexport type SecurityConfig = {\n  allowedTypes?: string[];\n  deniedTypes?: string[];\n};\ntype UploadValidationError = {\n  code: 'MIME_TYPE_NOT_ALLOWED' | 'VALIDATION_ERROR' | 'UNKNOWN_ERROR';\n  message: string;\n  details: Record<string, any>;\n};\n\ntype ValidationResult = {\n  isValid: boolean;\n  error?: UploadValidationError;\n  detectedMime?: string;\n};\n\ntype ErrorDetail = {\n  file: any;\n  originalIndex: number;\n  error: UploadValidationError;\n};\n\nasync function readFileChunk(filePath: string, chunkSize: number = 4100): Promise<Buffer> {\n  const file = await open(filePath, 'r');\n\n  try {\n    const buffer = Buffer.alloc(chunkSize);\n    const { bytesRead } = await file.read(buffer, 0, chunkSize, 0);\n\n    return buffer.subarray(0, bytesRead);\n  } finally {\n    await file.close();\n  }\n}\n\nexport async function detectMimeType(file: any): Promise<string | undefined> {\n  let buffer: Buffer;\n\n  // Support multiple property names used by different multipart parsers (formidable uses filepath)\n  const filePath = file.filepath ?? file.path ?? file.tempFilePath ?? file.filePath;\n\n  if (filePath) {\n    try {\n      buffer = await readFileChunk(filePath, 4100);\n    } catch (error) {\n      throw new Error(\n        `Failed to read file: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  } else if (file.buffer) {\n    buffer = file.buffer.length > 4100 ? file.buffer.subarray(0, 4100) : file.buffer;\n  } else {\n    // No file path or buffer; cannot detect MIME. Validation will use declared/extension or reject.\n    return undefined;\n  }\n\n  try {\n    /**\n     * Use dynamic import to support file-type which is ESM-only\n     * Static imports fail during CommonJS build since bundler can't transform ESM-only packages\n     * @see https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c\n     */\n    const { fileTypeFromBuffer } = await import('file-type');\n\n    const result = await fileTypeFromBuffer(new Uint8Array(buffer));\n    return result?.mime;\n  } catch (error) {\n    throw new Error(\n      `Failed to detect MIME type: ${error instanceof Error ? error.message : String(error)}`\n    );\n  }\n}\n\nfunction matchesMimePattern(mimeType: string, patterns: string[]): boolean {\n  if (!patterns?.length) return false;\n\n  return patterns.some((pattern) => {\n    const normalizedPattern = pattern.toLowerCase();\n    const normalizedMimeType = mimeType.toLowerCase();\n\n    if (normalizedPattern.includes('*')) {\n      const regexPattern = normalizedPattern.replace(/\\*/g, '.*');\n\n      const regex = new RegExp(`^${regexPattern}$`);\n      const matches = regex.test(normalizedMimeType);\n      return matches;\n    }\n\n    const exactMatch = normalizedPattern === normalizedMimeType;\n    return exactMatch;\n  });\n}\n\nexport function isMimeTypeAllowed(mimeType: string, config: SecurityConfig): boolean {\n  const { allowedTypes, deniedTypes } = config;\n\n  if (!mimeType) return false;\n\n  if (deniedTypes?.length && matchesMimePattern(mimeType, deniedTypes)) {\n    return false;\n  }\n\n  if (Array.isArray(allowedTypes)) {\n    return allowedTypes.length > 0 && matchesMimePattern(mimeType, allowedTypes);\n  }\n\n  return true;\n}\n\n/**\n * Single gate for allow/deny. Returns ValidationResult.\n * Doc: docs/docs/01-core/upload/01-backend/01-mime-validation.md\n */\nfunction validateAllowBanLists(\n  mimetype: string,\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  config: SecurityConfig\n): ValidationResult {\n  if (!mimetype) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'No MIME type to validate',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (config.deniedTypes?.length && matchesMimePattern(mimetype, config.deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredType, detectedType, mimetype, config);\n  }\n  if (!Array.isArray(config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  if (config.allowedTypes.length === 0) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'Allow list is empty',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (matchesMimePattern(mimetype, config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${mimetype}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: mimetype,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n      },\n    },\n  };\n}\n\nfunction isDeclaredGeneric(declaredMimeType: string): boolean {\n  return !declaredMimeType || declaredMimeType === 'application/octet-stream';\n}\n\nexport function extractFileInfo(file: any) {\n  const fileName =\n    file.originalFilename ||\n    file.name ||\n    file.filename ||\n    file.newFilename ||\n    file.originalname ||\n    'unknown';\n  const declaredMimeType = file.mimetype || file.type || file.mimeType || file.mime || '';\n\n  return { fileName, declaredMimeType };\n}\n\nexport async function validateFile(\n  file: any,\n  config: SecurityConfig,\n  strapi: Core.Strapi\n): Promise<ValidationResult> {\n  const { allowedTypes, deniedTypes } = config;\n\n  const { fileName, declaredMimeType } = extractFileInfo(file);\n\n  const fileExt = extname(fileName).toLowerCase();\n  const expectedMimeFromExt = fileExt ? lookup(fileExt) || null : null;\n\n  // Reject if declared type is denied.\n  if (\n    !isDeclaredGeneric(declaredMimeType) &&\n    deniedTypes?.length &&\n    matchesMimePattern(declaredMimeType, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, declaredMimeType, config);\n  }\n\n  // Reject if extension's type is denied.\n  if (\n    expectedMimeFromExt &&\n    deniedTypes?.length &&\n    matchesMimePattern(expectedMimeFromExt, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, expectedMimeFromExt, config);\n  }\n\n  // Run content detection.\n  let detectedMime: string | undefined;\n  try {\n    detectedMime = await detectMimeType(file);\n  } catch (error) {\n    const errMsg = error instanceof Error ? error.message : String(error);\n    strapi.log.warn(`Failed to detect MIME type from file: ${errMsg}`, {\n      fileName,\n      error: errMsg,\n    });\n  }\n\n  const declaredMatchesExtension =\n    !isDeclaredGeneric(declaredMimeType) &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    (matchesMimePattern(declaredMimeType, [expectedMimeFromExt]) ||\n      matchesMimePattern(expectedMimeFromExt, [declaredMimeType]));\n  const detectedMatchesDeclared =\n    detectedMime && declaredMimeType && matchesMimePattern(detectedMime, [declaredMimeType]);\n\n  // Trusted declaration: declared matches extension and detection confirms.\n  if (declaredMatchesExtension && detectedMatchesDeclared) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject if detected type is denied.\n  if (detectedMime && deniedTypes?.length && matchesMimePattern(detectedMime, deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredMimeType, detectedMime, detectedMime, config);\n  }\n\n  // Reject if detected is not in allow list (extension/declared cannot override).\n  // Exception: file-type often returns application/zip for Office formats (docx, xlsx); skip so the next block can allow via extension type.\n  const isZipWithAllowedExt =\n    detectedMime === 'application/zip' &&\n    expectedMimeFromExt &&\n    expectedMimeFromExt !== 'application/zip' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  // Exception: file-type often returns application/xml for SVG; trust .svg extension when image/svg+xml is allowed.\n  const isSvgXmlWithAllowedExt =\n    detectedMime === 'application/xml' &&\n    fileExt === '.svg' &&\n    expectedMimeFromExt === 'image/svg+xml' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  if (\n    detectedMime &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    !matchesMimePattern(detectedMime, allowedTypes) &&\n    !isZipWithAllowedExt &&\n    !isSvgXmlWithAllowedExt\n  ) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason:\n            'File content was detected as a type not in the allow list; extension or declared type cannot override',\n          declaredType: declaredMimeType,\n          detectedType: detectedMime,\n          expectedMimeFromExtension: expectedMimeFromExt,\n          allowedTypes,\n          deniedTypes,\n        },\n      },\n    };\n  }\n\n  // Use detected type when defined and (no extension, or detected matches extension, or declared is generic).\n  const detectedMatchesExtension =\n    detectedMime &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    matchesMimePattern(detectedMime, [expectedMimeFromExt]);\n  if (\n    detectedMime &&\n    (!expectedMimeFromExt || detectedMatchesExtension || isDeclaredGeneric(declaredMimeType))\n  ) {\n    // Office/zip exception: use extension type when detection returned application/zip and extension is in allow list.\n    if (\n      detectedMime === 'application/zip' &&\n      expectedMimeFromExt &&\n      expectedMimeFromExt !== 'application/zip'\n    ) {\n      const extResult = validateAllowBanLists(\n        expectedMimeFromExt,\n        fileName,\n        declaredMimeType,\n        detectedMime,\n        config\n      );\n      if (extResult.isValid) {\n        strapi.log.warn(\n          'MIME type detection returned application/zip; trusting extension for allow list',\n          { fileName, fileExtension: fileExt, expectedMimeFromExtension: expectedMimeFromExt }\n        );\n        return extResult;\n      }\n    }\n    return validateAllowBanLists(detectedMime, fileName, declaredMimeType, detectedMime, config);\n  }\n\n  // Use extension's type when present.\n  if (expectedMimeFromExt) {\n    return validateAllowBanLists(\n      expectedMimeFromExt,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Use declared type as last resort.\n  if (declaredMimeType) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject when no type can be chosen.\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: 'Cannot verify file type for security reasons',\n      details: {\n        fileName,\n        reason: 'No MIME type to validate (no declared type, no extension, no detection)',\n        declaredType: declaredMimeType,\n        detectedType: detectedMime,\n        allowedTypes,\n        deniedTypes,\n      },\n    },\n  };\n}\n\nfunction buildNotAllowedError(\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  rejectedType: string,\n  config: SecurityConfig\n): ValidationResult {\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${rejectedType}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: rejectedType,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n        reason: 'MIME type is in the denied list',\n      },\n    },\n  };\n}\n\nexport async function validateFiles(files: any, strapi: Core.Strapi): Promise<ValidationResult[]> {\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  if (!filesArray.length) {\n    return [];\n  }\n\n  // Use array path so 'plugin::upload' is a single key (lodash string path splits on '.')\n  let config: SecurityConfig = strapi.config.get(\n    ['plugin::upload', 'security'],\n    {}\n  ) as SecurityConfig;\n  if (!config || typeof config !== 'object') {\n    config = {};\n  }\n  if (\n    config.allowedTypes &&\n    (!Array.isArray(config.allowedTypes) ||\n      !config.allowedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: allowedTypes must be an array of strings.'\n    );\n  }\n\n  if (\n    config.deniedTypes &&\n    (!Array.isArray(config.deniedTypes) ||\n      !config.deniedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: deniedTypes must be an array of strings.'\n    );\n  }\n\n  if (!config.allowedTypes && !config.deniedTypes) {\n    strapi.log.warn(\n      'No upload security configuration found. Consider configuring plugin.upload.security for enhanced file validation.'\n    );\n    // Do not return; we still run validation so MIME detection runs and stored file gets detected type when possible\n  }\n\n  const validationPromises = filesArray.map(async (file, index) => {\n    try {\n      return await validateFile(file, config, strapi);\n    } catch (error) {\n      strapi.log.error('Unexpected error during file validation', {\n        fileIndex: index,\n        fileName: file?.name || file?.originalname,\n        error: error instanceof Error ? error.message : String(error),\n      });\n\n      return {\n        isValid: false,\n        error: {\n          code: 'VALIDATION_ERROR' as const,\n          message: `Validation failed for file at index ${index}`,\n          details: {\n            index,\n            fileName: file?.name || file?.originalname,\n            originalError: error instanceof Error ? error.message : String(error),\n          },\n        },\n      };\n    }\n  });\n\n  return Promise.all(validationPromises);\n}\n\nexport async function enforceUploadSecurity(\n  files: any,\n  strapi: Core.Strapi\n): Promise<{\n  validFiles: any[];\n  validFileNames: string[];\n  errors: Array<ErrorDetail>;\n}> {\n  const validationResults = await validateFiles(files, strapi);\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  const validFiles: any[] = [];\n  const validFileNames: string[] = [];\n  const errors: Array<ErrorDetail> = [];\n\n  for (const [index, result] of validationResults.entries()) {\n    if (result.isValid) {\n      const file = filesArray[index];\n      // Enrich file with detected MIME type for use in storage\n      if (result.detectedMime) {\n        file.detectedMimeType = result.detectedMime;\n      }\n      validFiles.push(file);\n      validFileNames.push(file.originalFilename || file.name);\n    } else if (result.error) {\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: result.error,\n      });\n    } else {\n      // Handle case where validation failed but no error details are provided\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: {\n          code: 'UNKNOWN_ERROR' as const,\n          message: 'File validation failed for unknown reason',\n          details: {\n            index,\n            fileName: filesArray[index]?.name || filesArray[index]?.originalname,\n          },\n        },\n      });\n    }\n  }\n\n  return { validFiles, validFileNames, errors };\n}\n\nexport type FileUploadError = {\n  name: string;\n  message: string;\n};\n\nexport type PrepareUploadResult = {\n  validFiles: any[];\n  filteredBody: any;\n  errors: FileUploadError[];\n};\n\n/**\n * Prepare files and body for upload by enforcing security and parsing fileInfo\n */\nexport async function prepareUploadRequest(\n  filesInput: any,\n  body: any,\n  strapi: Core.Strapi\n): Promise<PrepareUploadResult> {\n  const securityResults = await enforceUploadSecurity(filesInput, strapi);\n\n  let filteredBody = body;\n  if (body?.fileInfo) {\n    // Parse JSON strings in fileInfo\n    let parsedFileInfo = body.fileInfo;\n    if (Array.isArray(body.fileInfo)) {\n      parsedFileInfo = body.fileInfo.map((fi: any) =>\n        typeof fi === 'string' ? JSON.parse(fi) : fi\n      );\n    } else if (typeof body.fileInfo === 'string') {\n      parsedFileInfo = JSON.parse(body.fileInfo);\n    }\n\n    // Filter fileInfo by index - only keep entries for files that passed validation\n    if (Array.isArray(parsedFileInfo)) {\n      const invalidIndices = new Set(securityResults.errors.map((e) => e.originalIndex));\n      const filteredFileInfo = parsedFileInfo.filter(\n        (_: any, index: number) => !invalidIndices.has(index)\n      );\n\n      if (filteredFileInfo.length === 1) {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo[0],\n        };\n      } else {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo,\n        };\n      }\n    } else {\n      filteredBody = {\n        ...body,\n        fileInfo: parsedFileInfo,\n      };\n    }\n  }\n\n  // Map errors to simplified format\n  const uploadErrors: FileUploadError[] = securityResults.errors.map((e) => ({\n    name: e.file?.originalFilename || e.file?.name || 'unknown',\n    message: e.error.message,\n  }));\n\n  return {\n    validFiles: securityResults.validFiles,\n    filteredBody,\n    errors: uploadErrors,\n  };\n}\n"],"names":["readFileChunk","filePath","chunkSize","file","open","buffer","Buffer","alloc","bytesRead","read","subarray","close","detectMimeType","filepath","path","tempFilePath","error","Error","message","String","length","undefined","fileTypeFromBuffer","result","Uint8Array","mime","matchesMimePattern","mimeType","patterns","some","pattern","normalizedPattern","toLowerCase","normalizedMimeType","includes","regexPattern","replace","regex","RegExp","matches","test","exactMatch","validateAllowBanLists","mimetype","fileName","declaredType","detectedType","config","isValid","code","details","reason","allowedTypes","deniedTypes","buildNotAllowedError","Array","isArray","detectedMime","finalType","isDeclaredGeneric","declaredMimeType","extractFileInfo","originalFilename","name","filename","newFilename","originalname","type","validateFile","strapi","fileExt","extname","expectedMimeFromExt","lookup","errMsg","log","warn","declaredMatchesExtension","detectedMatchesDeclared","isZipWithAllowedExt","isSvgXmlWithAllowedExt","expectedMimeFromExtension","detectedMatchesExtension","extResult","fileExtension","rejectedType","validateFiles","files","filesArray","get","every","item","errors","ApplicationError","validationPromises","map","index","fileIndex","originalError","Promise","all","enforceUploadSecurity","validationResults","validFiles","validFileNames","entries","detectedMimeType","push","originalIndex","prepareUploadRequest","filesInput","body","securityResults","filteredBody","fileInfo","parsedFileInfo","fi","JSON","parse","invalidIndices","Set","e","filteredFileInfo","filter","_","has","uploadErrors"],"mappings":";;;;;;;AA4BA,eAAeA,aAAAA,CAAcC,QAAgB,EAAEC,SAAAA,GAAoB,IAAI,EAAA;IACrE,MAAMC,IAAAA,GAAO,MAAMC,aAAAA,CAAKH,QAAAA,EAAU,GAAA,CAAA;IAElC,IAAI;QACF,MAAMI,MAAAA,GAASC,MAAAA,CAAOC,KAAK,CAACL,SAAAA,CAAAA;QAC5B,MAAM,EAAEM,SAAS,EAAE,GAAG,MAAML,KAAKM,IAAI,CAACJ,MAAAA,EAAQ,CAAA,EAAGH,SAAAA,EAAW,CAAA,CAAA;QAE5D,OAAOG,MAAAA,CAAOK,QAAQ,CAAC,CAAA,EAAGF,SAAAA,CAAAA;IAC5B,CAAA,QAAU;AACR,QAAA,MAAML,KAAKQ,KAAK,EAAA;AAClB,IAAA;AACF;AAEO,eAAeC,eAAeT,IAAS,EAAA;IAC5C,IAAIE,MAAAA;;IAGJ,MAAMJ,QAAAA,GAAWE,IAAAA,CAAKU,QAAQ,IAAIV,IAAAA,CAAKW,IAAI,IAAIX,IAAAA,CAAKY,YAAY,IAAIZ,IAAAA,CAAKF,QAAQ;AAEjF,IAAA,IAAIA,QAAAA,EAAU;QACZ,IAAI;YACFI,MAAAA,GAAS,MAAML,cAAcC,QAAAA,EAAU,IAAA,CAAA;AACzC,QAAA,CAAA,CAAE,OAAOe,KAAAA,EAAO;YACd,MAAM,IAAIC,KAAAA,CACR,CAAC,qBAAqB,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAEpF,QAAA;IACF,CAAA,MAAO,IAAIb,IAAAA,CAAKE,MAAM,EAAE;AACtBA,QAAAA,MAAAA,GAASF,IAAAA,CAAKE,MAAM,CAACe,MAAM,GAAG,IAAA,GAAOjB,IAAAA,CAAKE,MAAM,CAACK,QAAQ,CAAC,CAAA,EAAG,IAAA,CAAA,GAAQP,KAAKE,MAAM;IAClF,CAAA,MAAO;;QAEL,OAAOgB,SAAAA;AACT,IAAA;IAEA,IAAI;AACF;;;;AAIC,QACD,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAM,OAAO,WAAA,CAAA;AAE5C,QAAA,MAAMC,MAAAA,GAAS,MAAMD,kBAAAA,CAAmB,IAAIE,UAAAA,CAAWnB,MAAAA,CAAAA,CAAAA;AACvD,QAAA,OAAOkB,MAAAA,EAAQE,IAAAA;AACjB,IAAA,CAAA,CAAE,OAAOT,KAAAA,EAAO;QACd,MAAM,IAAIC,KAAAA,CACR,CAAC,4BAA4B,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAE3F,IAAA;AACF;AAEA,SAASU,kBAAAA,CAAmBC,QAAgB,EAAEC,QAAkB,EAAA;IAC9D,IAAI,CAACA,QAAAA,EAAUR,MAAAA,EAAQ,OAAO,KAAA;IAE9B,OAAOQ,QAAAA,CAASC,IAAI,CAAC,CAACC,OAAAA,GAAAA;QACpB,MAAMC,iBAAAA,GAAoBD,QAAQE,WAAW,EAAA;QAC7C,MAAMC,kBAAAA,GAAqBN,SAASK,WAAW,EAAA;QAE/C,IAAID,iBAAAA,CAAkBG,QAAQ,CAAC,GAAA,CAAA,EAAM;AACnC,YAAA,MAAMC,YAAAA,GAAeJ,iBAAAA,CAAkBK,OAAO,CAAC,KAAA,EAAO,IAAA,CAAA;YAEtD,MAAMC,KAAAA,GAAQ,IAAIC,MAAAA,CAAO,CAAC,CAAC,EAAEH,YAAAA,CAAa,CAAC,CAAC,CAAA;YAC5C,MAAMI,OAAAA,GAAUF,KAAAA,CAAMG,IAAI,CAACP,kBAAAA,CAAAA;YAC3B,OAAOM,OAAAA;AACT,QAAA;AAEA,QAAA,MAAME,aAAaV,iBAAAA,KAAsBE,kBAAAA;QACzC,OAAOQ,UAAAA;AACT,IAAA,CAAA,CAAA;AACF;AAkBA;;;IAIA,SAASC,qBAAAA,CACPC,QAAgB,EAChBC,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCC,MAAsB,EAAA;AAEtB,IAAA,IAAI,CAACJ,QAAAA,EAAU;QACb,OAAO;YACLK,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,0BAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;IACA,IAAIN,MAAAA,CAAOM,WAAW,EAAEjC,MAAAA,IAAUM,mBAAmBiB,QAAAA,EAAUI,MAAAA,CAAOM,WAAW,CAAA,EAAG;AAClF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUC,YAAAA,EAAcC,YAAAA,EAAcH,QAAAA,EAAUI,MAAAA,CAAAA;AAC9E,IAAA;AACA,IAAA,IAAI,CAACQ,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACvC,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;AACA,IAAA,IAAII,MAAAA,CAAOK,YAAY,CAAChC,MAAM,KAAK,CAAA,EAAG;QACpC,OAAO;YACL4B,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,qBAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;AACA,IAAA,IAAI3B,kBAAAA,CAAmBiB,QAAAA,EAAUI,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACrD,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;IACA,OAAO;QACLK,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEyB,QAAAA,CAAS,gBAAgB,CAAC;YACjDO,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAWf,QAAAA;AACXS,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,KAAA;AACF;AAEA,SAASM,kBAAkBC,gBAAwB,EAAA;IACjD,OAAO,CAACA,oBAAoBA,gBAAAA,KAAqB,0BAAA;AACnD;AAEO,SAASC,gBAAgB1D,IAAS,EAAA;AACvC,IAAA,MAAMyC,QAAAA,GACJzC,IAAAA,CAAK2D,gBAAgB,IACrB3D,KAAK4D,IAAI,IACT5D,IAAAA,CAAK6D,QAAQ,IACb7D,IAAAA,CAAK8D,WAAW,IAChB9D,IAAAA,CAAK+D,YAAY,IACjB,SAAA;AACF,IAAA,MAAMN,gBAAAA,GAAmBzD,IAAAA,CAAKwC,QAAQ,IAAIxC,IAAAA,CAAKgE,IAAI,IAAIhE,IAAAA,CAAKwB,QAAQ,IAAIxB,IAAAA,CAAKsB,IAAI,IAAI,EAAA;IAErF,OAAO;AAAEmB,QAAAA,QAAAA;AAAUgB,QAAAA;AAAiB,KAAA;AACtC;AAEO,eAAeQ,YAAAA,CACpBjE,IAAS,EACT4C,MAAsB,EACtBsB,MAAmB,EAAA;AAEnB,IAAA,MAAM,EAAEjB,YAAY,EAAEC,WAAW,EAAE,GAAGN,MAAAA;AAEtC,IAAA,MAAM,EAAEH,QAAQ,EAAEgB,gBAAgB,EAAE,GAAGC,eAAAA,CAAgB1D,IAAAA,CAAAA;IAEvD,MAAMmE,OAAAA,GAAUC,iBAAAA,CAAQ3B,QAAAA,CAAAA,CAAUZ,WAAW,EAAA;AAC7C,IAAA,MAAMwC,mBAAAA,GAAsBF,OAAAA,GAAUG,gBAAAA,CAAOH,OAAAA,CAAAA,IAAY,IAAA,GAAO,IAAA;;AAGhE,IAAA,IACE,CAACX,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBP,aAAajC,MAAAA,IACbM,kBAAAA,CAAmBkC,kBAAkBP,WAAAA,CAAAA,EACrC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWuC,gBAAAA,EAAkBb,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IACEyB,mBAAAA,IACAnB,WAAAA,EAAajC,MAAAA,IACbM,kBAAAA,CAAmB8C,qBAAqBnB,WAAAA,CAAAA,EACxC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWmD,mBAAAA,EAAqBzB,MAAAA,CAAAA;AAC1F,IAAA;;IAGA,IAAIU,YAAAA;IACJ,IAAI;AACFA,QAAAA,YAAAA,GAAe,MAAM7C,cAAAA,CAAeT,IAAAA,CAAAA;AACtC,IAAA,CAAA,CAAE,OAAOa,KAAAA,EAAO;AACd,QAAA,MAAM0D,SAAS1D,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA;QAC/DqD,MAAAA,CAAOM,GAAG,CAACC,IAAI,CAAC,CAAC,sCAAsC,EAAEF,QAAQ,EAAE;AACjE9B,YAAAA,QAAAA;YACA5B,KAAAA,EAAO0D;AACT,SAAA,CAAA;AACF,IAAA;IAEA,MAAMG,wBAAAA,GACJ,CAAClB,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBY,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,KACvBK,kBAAAA,CAAmBkC,gBAAAA,EAAkB;AAACY,QAAAA;AAAoB,KAAA,CAAA,IACzD9C,mBAAmB8C,mBAAAA,EAAqB;AAACZ,QAAAA;KAAiB,CAAA,CAAA;AAC9D,IAAA,MAAMkB,uBAAAA,GACJrB,YAAAA,IAAgBG,gBAAAA,IAAoBlC,kBAAAA,CAAmB+B,YAAAA,EAAc;AAACG,QAAAA;AAAiB,KAAA,CAAA;;AAGzF,IAAA,IAAIiB,4BAA4BC,uBAAAA,EAAyB;AACvD,QAAA,OAAOpC,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIU,YAAAA,IAAgBJ,WAAAA,EAAajC,MAAAA,IAAUM,kBAAAA,CAAmB+B,cAAcJ,WAAAA,CAAAA,EAAc;AACxF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcA,YAAAA,EAAcV,MAAAA,CAAAA;AACtF,IAAA;;;AAIA,IAAA,MAAMgC,mBAAAA,GACJtB,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,wBAAwB,iBAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;;AAE1C,IAAA,MAAM4B,yBACJvB,YAAAA,KAAiB,iBAAA,IACjBa,OAAAA,KAAY,MAAA,IACZE,wBAAwB,eAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;AAC1C,IAAA,IACEK,gBACAF,KAAAA,CAAMC,OAAO,CAACJ,YAAAA,CAAAA,IACdA,aAAahC,MAAM,GAAG,CAAA,IACtB,CAACM,mBAAmB+B,YAAAA,EAAcL,YAAAA,CAAAA,IAClC,CAAC2B,mBAAAA,IACD,CAACC,sBAAAA,EACD;QACA,OAAO;YACLhC,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EACE,uGAAA;oBACFN,YAAAA,EAAce,gBAAAA;oBACdd,YAAAA,EAAcW,YAAAA;oBACdwB,yBAAAA,EAA2BT,mBAAAA;AAC3BpB,oBAAAA,YAAAA;AACAC,oBAAAA;AACF;AACF;AACF,SAAA;AACF,IAAA;;AAGA,IAAA,MAAM6B,2BACJzB,YAAAA,IACAe,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,IACxBK,mBAAmB+B,YAAAA,EAAc;AAACe,QAAAA;AAAoB,KAAA,CAAA;AACxD,IAAA,IACEf,iBACC,CAACe,uBAAuBU,wBAAAA,IAA4BvB,iBAAAA,CAAkBC,iBAAgB,CAAA,EACvF;;AAEA,QAAA,IACEH,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,mBAAAA,KAAwB,iBAAA,EACxB;AACA,YAAA,MAAMW,SAAAA,GAAYzC,qBAAAA,CAChB8B,mBAAAA,EACA5B,QAAAA,EACAgB,kBACAH,YAAAA,EACAV,MAAAA,CAAAA;YAEF,IAAIoC,SAAAA,CAAUnC,OAAO,EAAE;AACrBqB,gBAAAA,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,iFAAA,EACA;AAAEhC,oBAAAA,QAAAA;oBAAUwC,aAAAA,EAAed,OAAAA;oBAASW,yBAAAA,EAA2BT;AAAoB,iBAAA,CAAA;gBAErF,OAAOW,SAAAA;AACT,YAAA;AACF,QAAA;AACA,QAAA,OAAOzC,qBAAAA,CAAsBe,YAAAA,EAAcb,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcV,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IAAIyB,mBAAAA,EAAqB;AACvB,QAAA,OAAO9B,qBAAAA,CACL8B,mBAAAA,EACA5B,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIa,gBAAAA,EAAkB;AACpB,QAAA,OAAOlB,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;IAGA,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;YACN/B,OAAAA,EAAS,8CAAA;YACTgC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;gBACAO,MAAAA,EAAQ,yEAAA;gBACRN,YAAAA,EAAce,gBAAAA;gBACdd,YAAAA,EAAcW,YAAAA;AACdL,gBAAAA,YAAAA;AACAC,gBAAAA;AACF;AACF;AACF,KAAA;AACF;AAEA,SAASC,oBAAAA,CACPV,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCuC,YAAoB,EACpBtC,MAAsB,EAAA;IAEtB,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEmE,YAAAA,CAAa,gBAAgB,CAAC;YACrDnC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAW2B,YAAAA;AACXjC,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM,WAAW;gBAC/BF,MAAAA,EAAQ;AACV;AACF;AACF,KAAA;AACF;AAEO,eAAemC,aAAAA,CAAcC,KAAU,EAAElB,MAAmB,EAAA;AACjE,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;IAEzD,IAAI,CAACC,UAAAA,CAAWpE,MAAM,EAAE;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;;AAGA,IAAA,IAAI2B,MAAAA,GAAyBsB,MAAAA,CAAOtB,MAAM,CAAC0C,GAAG,CAC5C;AAAC,QAAA,gBAAA;AAAkB,QAAA;AAAW,KAAA,EAC9B,EAAC,CAAA;AAEH,IAAA,IAAI,CAAC1C,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAA,EAAU;AACzCA,QAAAA,MAAAA,GAAS,EAAC;AACZ,IAAA;IACA,IACEA,MAAAA,CAAOK,YAAY,KAClB,CAACG,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,IACjC,CAACL,MAAAA,CAAOK,YAAY,CAACsC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC/D;QACA,MAAM,IAAIC,YAAAA,CAAOC,gBAAgB,CAC/B,kEAAA,CAAA;AAEJ,IAAA;IAEA,IACE9C,MAAAA,CAAOM,WAAW,KACjB,CAACE,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOM,WAAW,CAAA,IAChC,CAACN,MAAAA,CAAOM,WAAW,CAACqC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC9D;QACA,MAAM,IAAIC,YAAAA,CAAOC,gBAAgB,CAC/B,iEAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAI,CAAC9C,MAAAA,CAAOK,YAAY,IAAI,CAACL,MAAAA,CAAOM,WAAW,EAAE;QAC/CgB,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,mHAAA,CAAA;;AAGJ,IAAA;AAEA,IAAA,MAAMkB,kBAAAA,GAAqBN,UAAAA,CAAWO,GAAG,CAAC,OAAO5F,IAAAA,EAAM6F,KAAAA,GAAAA;QACrD,IAAI;YACF,OAAO,MAAM5B,YAAAA,CAAajE,IAAAA,EAAM4C,MAAAA,EAAQsB,MAAAA,CAAAA;AAC1C,QAAA,CAAA,CAAE,OAAOrD,KAAAA,EAAO;AACdqD,YAAAA,MAAAA,CAAOM,GAAG,CAAC3D,KAAK,CAAC,yCAAA,EAA2C;gBAC1DiF,SAAAA,EAAWD,KAAAA;gBACXpD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BlD,gBAAAA,KAAAA,EAAOA,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACzD,aAAA,CAAA;YAEA,OAAO;gBACLgC,OAAAA,EAAS,KAAA;gBACThC,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,kBAAA;oBACN/B,OAAAA,EAAS,CAAC,oCAAoC,EAAE8E,KAAAA,CAAAA,CAAO;oBACvD9C,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BgC,wBAAAA,aAAAA,EAAelF,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACjE;AACF;AACF,aAAA;AACF,QAAA;AACF,IAAA,CAAA,CAAA;IAEA,OAAOmF,OAAAA,CAAQC,GAAG,CAACN,kBAAAA,CAAAA;AACrB;AAEO,eAAeO,qBAAAA,CACpBd,KAAU,EACVlB,MAAmB,EAAA;IAMnB,MAAMiC,iBAAAA,GAAoB,MAAMhB,aAAAA,CAAcC,KAAAA,EAAOlB,MAAAA,CAAAA;AACrD,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;AAEzD,IAAA,MAAMgB,aAAoB,EAAE;AAC5B,IAAA,MAAMC,iBAA2B,EAAE;AACnC,IAAA,MAAMZ,SAA6B,EAAE;AAErC,IAAA,KAAK,MAAM,CAACI,KAAAA,EAAOzE,OAAO,IAAI+E,iBAAAA,CAAkBG,OAAO,EAAA,CAAI;QACzD,IAAIlF,MAAAA,CAAOyB,OAAO,EAAE;YAClB,MAAM7C,IAAAA,GAAOqF,UAAU,CAACQ,KAAAA,CAAM;;YAE9B,IAAIzE,MAAAA,CAAOkC,YAAY,EAAE;gBACvBtD,IAAAA,CAAKuG,gBAAgB,GAAGnF,MAAAA,CAAOkC,YAAY;AAC7C,YAAA;AACA8C,YAAAA,UAAAA,CAAWI,IAAI,CAACxG,IAAAA,CAAAA;AAChBqG,YAAAA,cAAAA,CAAeG,IAAI,CAACxG,IAAAA,CAAK2D,gBAAgB,IAAI3D,KAAK4D,IAAI,CAAA;QACxD,CAAA,MAAO,IAAIxC,MAAAA,CAAOP,KAAK,EAAE;AACvB4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;AACfhF,gBAAAA,KAAAA,EAAOO,OAAOP;AAChB,aAAA,CAAA;QACF,CAAA,MAAO;;AAEL4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;gBACfhF,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,eAAA;oBACN/B,OAAAA,EAAS,2CAAA;oBACTgC,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAU4C,UAAU,CAACQ,KAAAA,CAAM,EAAEjC,QAAQyB,UAAU,CAACQ,MAAM,EAAE9B;AAC1D;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;IAEA,OAAO;AAAEqC,QAAAA,UAAAA;AAAYC,QAAAA,cAAAA;AAAgBZ,QAAAA;AAAO,KAAA;AAC9C;AAaA;;AAEC,IACM,eAAeiB,oBAAAA,CACpBC,UAAe,EACfC,IAAS,EACT1C,MAAmB,EAAA;IAEnB,MAAM2C,eAAAA,GAAkB,MAAMX,qBAAAA,CAAsBS,UAAAA,EAAYzC,MAAAA,CAAAA;AAEhE,IAAA,IAAI4C,YAAAA,GAAeF,IAAAA;AACnB,IAAA,IAAIA,MAAMG,QAAAA,EAAU;;QAElB,IAAIC,cAAAA,GAAiBJ,KAAKG,QAAQ;AAClC,QAAA,IAAI3D,KAAAA,CAAMC,OAAO,CAACuD,IAAAA,CAAKG,QAAQ,CAAA,EAAG;AAChCC,YAAAA,cAAAA,GAAiBJ,IAAAA,CAAKG,QAAQ,CAACnB,GAAG,CAAC,CAACqB,EAAAA,GAClC,OAAOA,EAAAA,KAAO,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,EAAAA,CAAAA,GAAMA,EAAAA,CAAAA;AAE9C,QAAA,CAAA,MAAO,IAAI,OAAOL,IAAAA,CAAKG,QAAQ,KAAK,QAAA,EAAU;AAC5CC,YAAAA,cAAAA,GAAiBE,IAAAA,CAAKC,KAAK,CAACP,IAAAA,CAAKG,QAAQ,CAAA;AAC3C,QAAA;;QAGA,IAAI3D,KAAAA,CAAMC,OAAO,CAAC2D,cAAAA,CAAAA,EAAiB;YACjC,MAAMI,cAAAA,GAAiB,IAAIC,GAAAA,CAAIR,eAAAA,CAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,CAAAA,GAAMA,CAAAA,CAAEb,aAAa,CAAA,CAAA;YAChF,MAAMc,gBAAAA,GAAmBP,cAAAA,CAAeQ,MAAM,CAC5C,CAACC,GAAQ5B,KAAAA,GAAkB,CAACuB,cAAAA,CAAeM,GAAG,CAAC7B,KAAAA,CAAAA,CAAAA;YAGjD,IAAI0B,gBAAAA,CAAiBtG,MAAM,KAAK,CAAA,EAAG;gBACjC6F,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ,gBAAgB,CAAC,CAAA;AAC7B,iBAAA;YACF,CAAA,MAAO;gBACLT,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ;AACZ,iBAAA;AACF,YAAA;QACF,CAAA,MAAO;YACLT,YAAAA,GAAe;AACb,gBAAA,GAAGF,IAAI;gBACPG,QAAAA,EAAUC;AACZ,aAAA;AACF,QAAA;AACF,IAAA;;IAGA,MAAMW,YAAAA,GAAkCd,gBAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,KAAO;AACzE1D,YAAAA,IAAAA,EAAM0D,EAAEtH,IAAI,EAAE2D,oBAAoB2D,CAAAA,CAAEtH,IAAI,EAAE4D,IAAAA,IAAQ,SAAA;YAClD7C,OAAAA,EAASuG,CAAAA,CAAEzG,KAAK,CAACE;SACnB,CAAA,CAAA;IAEA,OAAO;AACLqF,QAAAA,UAAAA,EAAYS,gBAAgBT,UAAU;AACtCU,QAAAA,YAAAA;QACArB,MAAAA,EAAQkC;AACV,KAAA;AACF;;;;;;;;;"}
+{"version":3,"file":"mime-validation.js","sources":["../../../server/src/utils/mime-validation.ts"],"sourcesContent":["import { open } from 'node:fs/promises';\nimport { extname } from 'node:path';\nimport { lookup } from 'mime-types';\nimport type { Core } from '@strapi/types';\nimport { errors } from '@strapi/utils';\n\nexport type SecurityConfig = {\n  allowedTypes?: string[];\n  deniedTypes?: string[];\n};\ntype UploadValidationError = {\n  code: 'MIME_TYPE_NOT_ALLOWED' | 'VALIDATION_ERROR' | 'UNKNOWN_ERROR';\n  message: string;\n  details: Record<string, any>;\n};\n\ntype ValidationResult = {\n  isValid: boolean;\n  error?: UploadValidationError;\n  detectedMime?: string;\n};\n\ntype ErrorDetail = {\n  file: any;\n  originalIndex: number;\n  error: UploadValidationError;\n};\n\nasync function readFileChunk(filePath: string, chunkSize: number = 4100): Promise<Buffer> {\n  const file = await open(filePath, 'r');\n\n  try {\n    const buffer = Buffer.alloc(chunkSize);\n    const { bytesRead } = await file.read(buffer, 0, chunkSize, 0);\n\n    return buffer.subarray(0, bytesRead);\n  } finally {\n    await file.close();\n  }\n}\n\nexport async function detectMimeType(file: any): Promise<string | undefined> {\n  let buffer: Buffer;\n\n  // Support multiple property names used by different multipart parsers (formidable uses filepath)\n  const filePath = file.filepath ?? file.path ?? file.tempFilePath ?? file.filePath;\n\n  if (filePath) {\n    try {\n      buffer = await readFileChunk(filePath, 4100);\n    } catch (error) {\n      throw new Error(\n        `Failed to read file: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  } else if (file.buffer) {\n    buffer = file.buffer.length > 4100 ? file.buffer.subarray(0, 4100) : file.buffer;\n  } else {\n    // No file path or buffer; cannot detect MIME. Validation will use declared/extension or reject.\n    return undefined;\n  }\n\n  try {\n    /**\n     * Use dynamic import to support file-type which is ESM-only\n     * Static imports fail during CommonJS build since bundler can't transform ESM-only packages\n     * @see https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c\n     */\n    const { fileTypeFromBuffer } = await import('file-type');\n\n    const result = await fileTypeFromBuffer(new Uint8Array(buffer));\n    return result?.mime;\n  } catch (error) {\n    throw new Error(\n      `Failed to detect MIME type: ${error instanceof Error ? error.message : String(error)}`\n    );\n  }\n}\n\nfunction matchesMimePattern(mimeType: string, patterns: string[]): boolean {\n  if (!patterns?.length) return false;\n\n  return patterns.some((pattern) => {\n    const normalizedPattern = pattern.toLowerCase();\n    const normalizedMimeType = mimeType.toLowerCase();\n\n    if (normalizedPattern.includes('*')) {\n      const regexPattern = normalizedPattern.replace(/\\*/g, '.*');\n\n      const regex = new RegExp(`^${regexPattern}$`);\n      const matches = regex.test(normalizedMimeType);\n      return matches;\n    }\n\n    const exactMatch = normalizedPattern === normalizedMimeType;\n    return exactMatch;\n  });\n}\n\nexport function isMimeTypeAllowed(mimeType: string, config: SecurityConfig): boolean {\n  const { allowedTypes, deniedTypes } = config;\n\n  if (!mimeType) return false;\n\n  if (deniedTypes?.length && matchesMimePattern(mimeType, deniedTypes)) {\n    return false;\n  }\n\n  if (Array.isArray(allowedTypes)) {\n    return allowedTypes.length > 0 && matchesMimePattern(mimeType, allowedTypes);\n  }\n\n  return true;\n}\n\n/**\n * Single gate for allow/deny. Returns ValidationResult.\n * Doc: docs/docs/packages/core/upload/01-backend/01-mime-validation.md\n */\nfunction validateAllowBanLists(\n  mimetype: string,\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  config: SecurityConfig\n): ValidationResult {\n  if (!mimetype) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'No MIME type to validate',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (config.deniedTypes?.length && matchesMimePattern(mimetype, config.deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredType, detectedType, mimetype, config);\n  }\n  if (!Array.isArray(config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  if (config.allowedTypes.length === 0) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'Allow list is empty',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (matchesMimePattern(mimetype, config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${mimetype}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: mimetype,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n      },\n    },\n  };\n}\n\nfunction isDeclaredGeneric(declaredMimeType: string): boolean {\n  return !declaredMimeType || declaredMimeType === 'application/octet-stream';\n}\n\nexport function extractFileInfo(file: any) {\n  const fileName =\n    file.originalFilename ||\n    file.name ||\n    file.filename ||\n    file.newFilename ||\n    file.originalname ||\n    'unknown';\n  const declaredMimeType = file.mimetype || file.type || file.mimeType || file.mime || '';\n\n  return { fileName, declaredMimeType };\n}\n\nexport async function validateFile(\n  file: any,\n  config: SecurityConfig,\n  strapi: Core.Strapi\n): Promise<ValidationResult> {\n  const { allowedTypes, deniedTypes } = config;\n\n  const { fileName, declaredMimeType } = extractFileInfo(file);\n\n  const fileExt = extname(fileName).toLowerCase();\n  const expectedMimeFromExt = fileExt ? lookup(fileExt) || null : null;\n\n  // Reject if declared type is denied.\n  if (\n    !isDeclaredGeneric(declaredMimeType) &&\n    deniedTypes?.length &&\n    matchesMimePattern(declaredMimeType, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, declaredMimeType, config);\n  }\n\n  // Reject if extension's type is denied.\n  if (\n    expectedMimeFromExt &&\n    deniedTypes?.length &&\n    matchesMimePattern(expectedMimeFromExt, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, expectedMimeFromExt, config);\n  }\n\n  // Run content detection.\n  let detectedMime: string | undefined;\n  try {\n    detectedMime = await detectMimeType(file);\n  } catch (error) {\n    const errMsg = error instanceof Error ? error.message : String(error);\n    strapi.log.warn(`Failed to detect MIME type from file: ${errMsg}`, {\n      fileName,\n      error: errMsg,\n    });\n  }\n\n  const declaredMatchesExtension =\n    !isDeclaredGeneric(declaredMimeType) &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    (matchesMimePattern(declaredMimeType, [expectedMimeFromExt]) ||\n      matchesMimePattern(expectedMimeFromExt, [declaredMimeType]));\n  const detectedMatchesDeclared =\n    detectedMime && declaredMimeType && matchesMimePattern(detectedMime, [declaredMimeType]);\n\n  // Trusted declaration: declared matches extension and detection confirms.\n  if (declaredMatchesExtension && detectedMatchesDeclared) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject if detected type is denied.\n  if (detectedMime && deniedTypes?.length && matchesMimePattern(detectedMime, deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredMimeType, detectedMime, detectedMime, config);\n  }\n\n  // Reject if detected is not in allow list (extension/declared cannot override).\n  // Exception: file-type often returns application/zip for Office formats (docx, xlsx); skip so the next block can allow via extension type.\n  const isZipWithAllowedExt =\n    detectedMime === 'application/zip' &&\n    expectedMimeFromExt &&\n    expectedMimeFromExt !== 'application/zip' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  // Exception: file-type often returns application/xml for SVG; trust .svg extension when image/svg+xml is allowed.\n  const isSvgXmlWithAllowedExt =\n    detectedMime === 'application/xml' &&\n    fileExt === '.svg' &&\n    expectedMimeFromExt === 'image/svg+xml' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  if (\n    detectedMime &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    !matchesMimePattern(detectedMime, allowedTypes) &&\n    !isZipWithAllowedExt &&\n    !isSvgXmlWithAllowedExt\n  ) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason:\n            'File content was detected as a type not in the allow list; extension or declared type cannot override',\n          declaredType: declaredMimeType,\n          detectedType: detectedMime,\n          expectedMimeFromExtension: expectedMimeFromExt,\n          allowedTypes,\n          deniedTypes,\n        },\n      },\n    };\n  }\n\n  // Use detected type when defined and (no extension, or detected matches extension, or declared is generic).\n  const detectedMatchesExtension =\n    detectedMime &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    matchesMimePattern(detectedMime, [expectedMimeFromExt]);\n  if (\n    detectedMime &&\n    (!expectedMimeFromExt || detectedMatchesExtension || isDeclaredGeneric(declaredMimeType))\n  ) {\n    // Office/zip exception: use extension type when detection returned application/zip and extension is in allow list.\n    if (\n      detectedMime === 'application/zip' &&\n      expectedMimeFromExt &&\n      expectedMimeFromExt !== 'application/zip'\n    ) {\n      const extResult = validateAllowBanLists(\n        expectedMimeFromExt,\n        fileName,\n        declaredMimeType,\n        detectedMime,\n        config\n      );\n      if (extResult.isValid) {\n        strapi.log.warn(\n          'MIME type detection returned application/zip; trusting extension for allow list',\n          { fileName, fileExtension: fileExt, expectedMimeFromExtension: expectedMimeFromExt }\n        );\n        return extResult;\n      }\n    }\n    return validateAllowBanLists(detectedMime, fileName, declaredMimeType, detectedMime, config);\n  }\n\n  // Use extension's type when present.\n  if (expectedMimeFromExt) {\n    return validateAllowBanLists(\n      expectedMimeFromExt,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Use declared type as last resort.\n  if (declaredMimeType) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject when no type can be chosen.\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: 'Cannot verify file type for security reasons',\n      details: {\n        fileName,\n        reason: 'No MIME type to validate (no declared type, no extension, no detection)',\n        declaredType: declaredMimeType,\n        detectedType: detectedMime,\n        allowedTypes,\n        deniedTypes,\n      },\n    },\n  };\n}\n\nfunction buildNotAllowedError(\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  rejectedType: string,\n  config: SecurityConfig\n): ValidationResult {\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${rejectedType}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: rejectedType,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n        reason: 'MIME type is in the denied list',\n      },\n    },\n  };\n}\n\nexport async function validateFiles(files: any, strapi: Core.Strapi): Promise<ValidationResult[]> {\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  if (!filesArray.length) {\n    return [];\n  }\n\n  // Use array path so 'plugin::upload' is a single key (lodash string path splits on '.')\n  let config: SecurityConfig = strapi.config.get(\n    ['plugin::upload', 'security'],\n    {}\n  ) as SecurityConfig;\n  if (!config || typeof config !== 'object') {\n    config = {};\n  }\n  if (\n    config.allowedTypes &&\n    (!Array.isArray(config.allowedTypes) ||\n      !config.allowedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: allowedTypes must be an array of strings.'\n    );\n  }\n\n  if (\n    config.deniedTypes &&\n    (!Array.isArray(config.deniedTypes) ||\n      !config.deniedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: deniedTypes must be an array of strings.'\n    );\n  }\n\n  if (!config.allowedTypes && !config.deniedTypes) {\n    strapi.log.warn(\n      'No upload security configuration found. Consider configuring plugin.upload.security for enhanced file validation.'\n    );\n    // Do not return; we still run validation so MIME detection runs and stored file gets detected type when possible\n  }\n\n  const validationPromises = filesArray.map(async (file, index) => {\n    try {\n      return await validateFile(file, config, strapi);\n    } catch (error) {\n      strapi.log.error('Unexpected error during file validation', {\n        fileIndex: index,\n        fileName: file?.name || file?.originalname,\n        error: error instanceof Error ? error.message : String(error),\n      });\n\n      return {\n        isValid: false,\n        error: {\n          code: 'VALIDATION_ERROR' as const,\n          message: `Validation failed for file at index ${index}`,\n          details: {\n            index,\n            fileName: file?.name || file?.originalname,\n            originalError: error instanceof Error ? error.message : String(error),\n          },\n        },\n      };\n    }\n  });\n\n  return Promise.all(validationPromises);\n}\n\nexport async function enforceUploadSecurity(\n  files: any,\n  strapi: Core.Strapi\n): Promise<{\n  validFiles: any[];\n  validFileNames: string[];\n  errors: Array<ErrorDetail>;\n}> {\n  const validationResults = await validateFiles(files, strapi);\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  const validFiles: any[] = [];\n  const validFileNames: string[] = [];\n  const errors: Array<ErrorDetail> = [];\n\n  for (const [index, result] of validationResults.entries()) {\n    if (result.isValid) {\n      const file = filesArray[index];\n      // Enrich file with detected MIME type for use in storage\n      if (result.detectedMime) {\n        file.detectedMimeType = result.detectedMime;\n      }\n      validFiles.push(file);\n      validFileNames.push(file.originalFilename || file.name);\n    } else if (result.error) {\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: result.error,\n      });\n    } else {\n      // Handle case where validation failed but no error details are provided\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: {\n          code: 'UNKNOWN_ERROR' as const,\n          message: 'File validation failed for unknown reason',\n          details: {\n            index,\n            fileName: filesArray[index]?.name || filesArray[index]?.originalname,\n          },\n        },\n      });\n    }\n  }\n\n  return { validFiles, validFileNames, errors };\n}\n\nexport type FileUploadError = {\n  name: string;\n  message: string;\n};\n\nexport type PrepareUploadResult = {\n  validFiles: any[];\n  filteredBody: any;\n  errors: FileUploadError[];\n};\n\n/**\n * Prepare files and body for upload by enforcing security and parsing fileInfo\n */\nexport async function prepareUploadRequest(\n  filesInput: any,\n  body: any,\n  strapi: Core.Strapi\n): Promise<PrepareUploadResult> {\n  const securityResults = await enforceUploadSecurity(filesInput, strapi);\n\n  let filteredBody = body;\n  if (body?.fileInfo) {\n    // Parse JSON strings in fileInfo\n    let parsedFileInfo = body.fileInfo;\n    if (Array.isArray(body.fileInfo)) {\n      parsedFileInfo = body.fileInfo.map((fi: any) =>\n        typeof fi === 'string' ? JSON.parse(fi) : fi\n      );\n    } else if (typeof body.fileInfo === 'string') {\n      parsedFileInfo = JSON.parse(body.fileInfo);\n    }\n\n    // Filter fileInfo by index - only keep entries for files that passed validation\n    if (Array.isArray(parsedFileInfo)) {\n      const invalidIndices = new Set(securityResults.errors.map((e) => e.originalIndex));\n      const filteredFileInfo = parsedFileInfo.filter(\n        (_: any, index: number) => !invalidIndices.has(index)\n      );\n\n      if (filteredFileInfo.length === 1) {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo[0],\n        };\n      } else {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo,\n        };\n      }\n    } else {\n      filteredBody = {\n        ...body,\n        fileInfo: parsedFileInfo,\n      };\n    }\n  }\n\n  // Map errors to simplified format\n  const uploadErrors: FileUploadError[] = securityResults.errors.map((e) => ({\n    name: e.file?.originalFilename || e.file?.name || 'unknown',\n    message: e.error.message,\n  }));\n\n  return {\n    validFiles: securityResults.validFiles,\n    filteredBody,\n    errors: uploadErrors,\n  };\n}\n"],"names":["readFileChunk","filePath","chunkSize","file","open","buffer","Buffer","alloc","bytesRead","read","subarray","close","detectMimeType","filepath","path","tempFilePath","error","Error","message","String","length","undefined","fileTypeFromBuffer","result","Uint8Array","mime","matchesMimePattern","mimeType","patterns","some","pattern","normalizedPattern","toLowerCase","normalizedMimeType","includes","regexPattern","replace","regex","RegExp","matches","test","exactMatch","validateAllowBanLists","mimetype","fileName","declaredType","detectedType","config","isValid","code","details","reason","allowedTypes","deniedTypes","buildNotAllowedError","Array","isArray","detectedMime","finalType","isDeclaredGeneric","declaredMimeType","extractFileInfo","originalFilename","name","filename","newFilename","originalname","type","validateFile","strapi","fileExt","extname","expectedMimeFromExt","lookup","errMsg","log","warn","declaredMatchesExtension","detectedMatchesDeclared","isZipWithAllowedExt","isSvgXmlWithAllowedExt","expectedMimeFromExtension","detectedMatchesExtension","extResult","fileExtension","rejectedType","validateFiles","files","filesArray","get","every","item","errors","ApplicationError","validationPromises","map","index","fileIndex","originalError","Promise","all","enforceUploadSecurity","validationResults","validFiles","validFileNames","entries","detectedMimeType","push","originalIndex","prepareUploadRequest","filesInput","body","securityResults","filteredBody","fileInfo","parsedFileInfo","fi","JSON","parse","invalidIndices","Set","e","filteredFileInfo","filter","_","has","uploadErrors"],"mappings":";;;;;;;AA4BA,eAAeA,aAAAA,CAAcC,QAAgB,EAAEC,SAAAA,GAAoB,IAAI,EAAA;IACrE,MAAMC,IAAAA,GAAO,MAAMC,aAAAA,CAAKH,QAAAA,EAAU,GAAA,CAAA;IAElC,IAAI;QACF,MAAMI,MAAAA,GAASC,MAAAA,CAAOC,KAAK,CAACL,SAAAA,CAAAA;QAC5B,MAAM,EAAEM,SAAS,EAAE,GAAG,MAAML,KAAKM,IAAI,CAACJ,MAAAA,EAAQ,CAAA,EAAGH,SAAAA,EAAW,CAAA,CAAA;QAE5D,OAAOG,MAAAA,CAAOK,QAAQ,CAAC,CAAA,EAAGF,SAAAA,CAAAA;IAC5B,CAAA,QAAU;AACR,QAAA,MAAML,KAAKQ,KAAK,EAAA;AAClB,IAAA;AACF;AAEO,eAAeC,eAAeT,IAAS,EAAA;IAC5C,IAAIE,MAAAA;;IAGJ,MAAMJ,QAAAA,GAAWE,IAAAA,CAAKU,QAAQ,IAAIV,IAAAA,CAAKW,IAAI,IAAIX,IAAAA,CAAKY,YAAY,IAAIZ,IAAAA,CAAKF,QAAQ;AAEjF,IAAA,IAAIA,QAAAA,EAAU;QACZ,IAAI;YACFI,MAAAA,GAAS,MAAML,cAAcC,QAAAA,EAAU,IAAA,CAAA;AACzC,QAAA,CAAA,CAAE,OAAOe,KAAAA,EAAO;YACd,MAAM,IAAIC,KAAAA,CACR,CAAC,qBAAqB,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAEpF,QAAA;IACF,CAAA,MAAO,IAAIb,IAAAA,CAAKE,MAAM,EAAE;AACtBA,QAAAA,MAAAA,GAASF,IAAAA,CAAKE,MAAM,CAACe,MAAM,GAAG,IAAA,GAAOjB,IAAAA,CAAKE,MAAM,CAACK,QAAQ,CAAC,CAAA,EAAG,IAAA,CAAA,GAAQP,KAAKE,MAAM;IAClF,CAAA,MAAO;;QAEL,OAAOgB,SAAAA;AACT,IAAA;IAEA,IAAI;AACF;;;;AAIC,QACD,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAM,OAAO,WAAA,CAAA;AAE5C,QAAA,MAAMC,MAAAA,GAAS,MAAMD,kBAAAA,CAAmB,IAAIE,UAAAA,CAAWnB,MAAAA,CAAAA,CAAAA;AACvD,QAAA,OAAOkB,MAAAA,EAAQE,IAAAA;AACjB,IAAA,CAAA,CAAE,OAAOT,KAAAA,EAAO;QACd,MAAM,IAAIC,KAAAA,CACR,CAAC,4BAA4B,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAE3F,IAAA;AACF;AAEA,SAASU,kBAAAA,CAAmBC,QAAgB,EAAEC,QAAkB,EAAA;IAC9D,IAAI,CAACA,QAAAA,EAAUR,MAAAA,EAAQ,OAAO,KAAA;IAE9B,OAAOQ,QAAAA,CAASC,IAAI,CAAC,CAACC,OAAAA,GAAAA;QACpB,MAAMC,iBAAAA,GAAoBD,QAAQE,WAAW,EAAA;QAC7C,MAAMC,kBAAAA,GAAqBN,SAASK,WAAW,EAAA;QAE/C,IAAID,iBAAAA,CAAkBG,QAAQ,CAAC,GAAA,CAAA,EAAM;AACnC,YAAA,MAAMC,YAAAA,GAAeJ,iBAAAA,CAAkBK,OAAO,CAAC,KAAA,EAAO,IAAA,CAAA;YAEtD,MAAMC,KAAAA,GAAQ,IAAIC,MAAAA,CAAO,CAAC,CAAC,EAAEH,YAAAA,CAAa,CAAC,CAAC,CAAA;YAC5C,MAAMI,OAAAA,GAAUF,KAAAA,CAAMG,IAAI,CAACP,kBAAAA,CAAAA;YAC3B,OAAOM,OAAAA;AACT,QAAA;AAEA,QAAA,MAAME,aAAaV,iBAAAA,KAAsBE,kBAAAA;QACzC,OAAOQ,UAAAA;AACT,IAAA,CAAA,CAAA;AACF;AAkBA;;;IAIA,SAASC,qBAAAA,CACPC,QAAgB,EAChBC,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCC,MAAsB,EAAA;AAEtB,IAAA,IAAI,CAACJ,QAAAA,EAAU;QACb,OAAO;YACLK,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,0BAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;IACA,IAAIN,MAAAA,CAAOM,WAAW,EAAEjC,MAAAA,IAAUM,mBAAmBiB,QAAAA,EAAUI,MAAAA,CAAOM,WAAW,CAAA,EAAG;AAClF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUC,YAAAA,EAAcC,YAAAA,EAAcH,QAAAA,EAAUI,MAAAA,CAAAA;AAC9E,IAAA;AACA,IAAA,IAAI,CAACQ,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACvC,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;AACA,IAAA,IAAII,MAAAA,CAAOK,YAAY,CAAChC,MAAM,KAAK,CAAA,EAAG;QACpC,OAAO;YACL4B,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,qBAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;AACA,IAAA,IAAI3B,kBAAAA,CAAmBiB,QAAAA,EAAUI,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACrD,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;IACA,OAAO;QACLK,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEyB,QAAAA,CAAS,gBAAgB,CAAC;YACjDO,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAWf,QAAAA;AACXS,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,KAAA;AACF;AAEA,SAASM,kBAAkBC,gBAAwB,EAAA;IACjD,OAAO,CAACA,oBAAoBA,gBAAAA,KAAqB,0BAAA;AACnD;AAEO,SAASC,gBAAgB1D,IAAS,EAAA;AACvC,IAAA,MAAMyC,QAAAA,GACJzC,IAAAA,CAAK2D,gBAAgB,IACrB3D,KAAK4D,IAAI,IACT5D,IAAAA,CAAK6D,QAAQ,IACb7D,IAAAA,CAAK8D,WAAW,IAChB9D,IAAAA,CAAK+D,YAAY,IACjB,SAAA;AACF,IAAA,MAAMN,gBAAAA,GAAmBzD,IAAAA,CAAKwC,QAAQ,IAAIxC,IAAAA,CAAKgE,IAAI,IAAIhE,IAAAA,CAAKwB,QAAQ,IAAIxB,IAAAA,CAAKsB,IAAI,IAAI,EAAA;IAErF,OAAO;AAAEmB,QAAAA,QAAAA;AAAUgB,QAAAA;AAAiB,KAAA;AACtC;AAEO,eAAeQ,YAAAA,CACpBjE,IAAS,EACT4C,MAAsB,EACtBsB,MAAmB,EAAA;AAEnB,IAAA,MAAM,EAAEjB,YAAY,EAAEC,WAAW,EAAE,GAAGN,MAAAA;AAEtC,IAAA,MAAM,EAAEH,QAAQ,EAAEgB,gBAAgB,EAAE,GAAGC,eAAAA,CAAgB1D,IAAAA,CAAAA;IAEvD,MAAMmE,OAAAA,GAAUC,iBAAAA,CAAQ3B,QAAAA,CAAAA,CAAUZ,WAAW,EAAA;AAC7C,IAAA,MAAMwC,mBAAAA,GAAsBF,OAAAA,GAAUG,gBAAAA,CAAOH,OAAAA,CAAAA,IAAY,IAAA,GAAO,IAAA;;AAGhE,IAAA,IACE,CAACX,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBP,aAAajC,MAAAA,IACbM,kBAAAA,CAAmBkC,kBAAkBP,WAAAA,CAAAA,EACrC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWuC,gBAAAA,EAAkBb,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IACEyB,mBAAAA,IACAnB,WAAAA,EAAajC,MAAAA,IACbM,kBAAAA,CAAmB8C,qBAAqBnB,WAAAA,CAAAA,EACxC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWmD,mBAAAA,EAAqBzB,MAAAA,CAAAA;AAC1F,IAAA;;IAGA,IAAIU,YAAAA;IACJ,IAAI;AACFA,QAAAA,YAAAA,GAAe,MAAM7C,cAAAA,CAAeT,IAAAA,CAAAA;AACtC,IAAA,CAAA,CAAE,OAAOa,KAAAA,EAAO;AACd,QAAA,MAAM0D,SAAS1D,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA;QAC/DqD,MAAAA,CAAOM,GAAG,CAACC,IAAI,CAAC,CAAC,sCAAsC,EAAEF,QAAQ,EAAE;AACjE9B,YAAAA,QAAAA;YACA5B,KAAAA,EAAO0D;AACT,SAAA,CAAA;AACF,IAAA;IAEA,MAAMG,wBAAAA,GACJ,CAAClB,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBY,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,KACvBK,kBAAAA,CAAmBkC,gBAAAA,EAAkB;AAACY,QAAAA;AAAoB,KAAA,CAAA,IACzD9C,mBAAmB8C,mBAAAA,EAAqB;AAACZ,QAAAA;KAAiB,CAAA,CAAA;AAC9D,IAAA,MAAMkB,uBAAAA,GACJrB,YAAAA,IAAgBG,gBAAAA,IAAoBlC,kBAAAA,CAAmB+B,YAAAA,EAAc;AAACG,QAAAA;AAAiB,KAAA,CAAA;;AAGzF,IAAA,IAAIiB,4BAA4BC,uBAAAA,EAAyB;AACvD,QAAA,OAAOpC,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIU,YAAAA,IAAgBJ,WAAAA,EAAajC,MAAAA,IAAUM,kBAAAA,CAAmB+B,cAAcJ,WAAAA,CAAAA,EAAc;AACxF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcA,YAAAA,EAAcV,MAAAA,CAAAA;AACtF,IAAA;;;AAIA,IAAA,MAAMgC,mBAAAA,GACJtB,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,wBAAwB,iBAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;;AAE1C,IAAA,MAAM4B,yBACJvB,YAAAA,KAAiB,iBAAA,IACjBa,OAAAA,KAAY,MAAA,IACZE,wBAAwB,eAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;AAC1C,IAAA,IACEK,gBACAF,KAAAA,CAAMC,OAAO,CAACJ,YAAAA,CAAAA,IACdA,aAAahC,MAAM,GAAG,CAAA,IACtB,CAACM,mBAAmB+B,YAAAA,EAAcL,YAAAA,CAAAA,IAClC,CAAC2B,mBAAAA,IACD,CAACC,sBAAAA,EACD;QACA,OAAO;YACLhC,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EACE,uGAAA;oBACFN,YAAAA,EAAce,gBAAAA;oBACdd,YAAAA,EAAcW,YAAAA;oBACdwB,yBAAAA,EAA2BT,mBAAAA;AAC3BpB,oBAAAA,YAAAA;AACAC,oBAAAA;AACF;AACF;AACF,SAAA;AACF,IAAA;;AAGA,IAAA,MAAM6B,2BACJzB,YAAAA,IACAe,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,IACxBK,mBAAmB+B,YAAAA,EAAc;AAACe,QAAAA;AAAoB,KAAA,CAAA;AACxD,IAAA,IACEf,iBACC,CAACe,uBAAuBU,wBAAAA,IAA4BvB,iBAAAA,CAAkBC,iBAAgB,CAAA,EACvF;;AAEA,QAAA,IACEH,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,mBAAAA,KAAwB,iBAAA,EACxB;AACA,YAAA,MAAMW,SAAAA,GAAYzC,qBAAAA,CAChB8B,mBAAAA,EACA5B,QAAAA,EACAgB,kBACAH,YAAAA,EACAV,MAAAA,CAAAA;YAEF,IAAIoC,SAAAA,CAAUnC,OAAO,EAAE;AACrBqB,gBAAAA,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,iFAAA,EACA;AAAEhC,oBAAAA,QAAAA;oBAAUwC,aAAAA,EAAed,OAAAA;oBAASW,yBAAAA,EAA2BT;AAAoB,iBAAA,CAAA;gBAErF,OAAOW,SAAAA;AACT,YAAA;AACF,QAAA;AACA,QAAA,OAAOzC,qBAAAA,CAAsBe,YAAAA,EAAcb,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcV,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IAAIyB,mBAAAA,EAAqB;AACvB,QAAA,OAAO9B,qBAAAA,CACL8B,mBAAAA,EACA5B,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIa,gBAAAA,EAAkB;AACpB,QAAA,OAAOlB,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;IAGA,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;YACN/B,OAAAA,EAAS,8CAAA;YACTgC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;gBACAO,MAAAA,EAAQ,yEAAA;gBACRN,YAAAA,EAAce,gBAAAA;gBACdd,YAAAA,EAAcW,YAAAA;AACdL,gBAAAA,YAAAA;AACAC,gBAAAA;AACF;AACF;AACF,KAAA;AACF;AAEA,SAASC,oBAAAA,CACPV,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCuC,YAAoB,EACpBtC,MAAsB,EAAA;IAEtB,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEmE,YAAAA,CAAa,gBAAgB,CAAC;YACrDnC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAW2B,YAAAA;AACXjC,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM,WAAW;gBAC/BF,MAAAA,EAAQ;AACV;AACF;AACF,KAAA;AACF;AAEO,eAAemC,aAAAA,CAAcC,KAAU,EAAElB,MAAmB,EAAA;AACjE,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;IAEzD,IAAI,CAACC,UAAAA,CAAWpE,MAAM,EAAE;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;;AAGA,IAAA,IAAI2B,MAAAA,GAAyBsB,MAAAA,CAAOtB,MAAM,CAAC0C,GAAG,CAC5C;AAAC,QAAA,gBAAA;AAAkB,QAAA;AAAW,KAAA,EAC9B,EAAC,CAAA;AAEH,IAAA,IAAI,CAAC1C,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAA,EAAU;AACzCA,QAAAA,MAAAA,GAAS,EAAC;AACZ,IAAA;IACA,IACEA,MAAAA,CAAOK,YAAY,KAClB,CAACG,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,IACjC,CAACL,MAAAA,CAAOK,YAAY,CAACsC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC/D;QACA,MAAM,IAAIC,YAAAA,CAAOC,gBAAgB,CAC/B,kEAAA,CAAA;AAEJ,IAAA;IAEA,IACE9C,MAAAA,CAAOM,WAAW,KACjB,CAACE,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOM,WAAW,CAAA,IAChC,CAACN,MAAAA,CAAOM,WAAW,CAACqC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC9D;QACA,MAAM,IAAIC,YAAAA,CAAOC,gBAAgB,CAC/B,iEAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAI,CAAC9C,MAAAA,CAAOK,YAAY,IAAI,CAACL,MAAAA,CAAOM,WAAW,EAAE;QAC/CgB,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,mHAAA,CAAA;;AAGJ,IAAA;AAEA,IAAA,MAAMkB,kBAAAA,GAAqBN,UAAAA,CAAWO,GAAG,CAAC,OAAO5F,IAAAA,EAAM6F,KAAAA,GAAAA;QACrD,IAAI;YACF,OAAO,MAAM5B,YAAAA,CAAajE,IAAAA,EAAM4C,MAAAA,EAAQsB,MAAAA,CAAAA;AAC1C,QAAA,CAAA,CAAE,OAAOrD,KAAAA,EAAO;AACdqD,YAAAA,MAAAA,CAAOM,GAAG,CAAC3D,KAAK,CAAC,yCAAA,EAA2C;gBAC1DiF,SAAAA,EAAWD,KAAAA;gBACXpD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BlD,gBAAAA,KAAAA,EAAOA,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACzD,aAAA,CAAA;YAEA,OAAO;gBACLgC,OAAAA,EAAS,KAAA;gBACThC,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,kBAAA;oBACN/B,OAAAA,EAAS,CAAC,oCAAoC,EAAE8E,KAAAA,CAAAA,CAAO;oBACvD9C,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BgC,wBAAAA,aAAAA,EAAelF,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACjE;AACF;AACF,aAAA;AACF,QAAA;AACF,IAAA,CAAA,CAAA;IAEA,OAAOmF,OAAAA,CAAQC,GAAG,CAACN,kBAAAA,CAAAA;AACrB;AAEO,eAAeO,qBAAAA,CACpBd,KAAU,EACVlB,MAAmB,EAAA;IAMnB,MAAMiC,iBAAAA,GAAoB,MAAMhB,aAAAA,CAAcC,KAAAA,EAAOlB,MAAAA,CAAAA;AACrD,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;AAEzD,IAAA,MAAMgB,aAAoB,EAAE;AAC5B,IAAA,MAAMC,iBAA2B,EAAE;AACnC,IAAA,MAAMZ,SAA6B,EAAE;AAErC,IAAA,KAAK,MAAM,CAACI,KAAAA,EAAOzE,OAAO,IAAI+E,iBAAAA,CAAkBG,OAAO,EAAA,CAAI;QACzD,IAAIlF,MAAAA,CAAOyB,OAAO,EAAE;YAClB,MAAM7C,IAAAA,GAAOqF,UAAU,CAACQ,KAAAA,CAAM;;YAE9B,IAAIzE,MAAAA,CAAOkC,YAAY,EAAE;gBACvBtD,IAAAA,CAAKuG,gBAAgB,GAAGnF,MAAAA,CAAOkC,YAAY;AAC7C,YAAA;AACA8C,YAAAA,UAAAA,CAAWI,IAAI,CAACxG,IAAAA,CAAAA;AAChBqG,YAAAA,cAAAA,CAAeG,IAAI,CAACxG,IAAAA,CAAK2D,gBAAgB,IAAI3D,KAAK4D,IAAI,CAAA;QACxD,CAAA,MAAO,IAAIxC,MAAAA,CAAOP,KAAK,EAAE;AACvB4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;AACfhF,gBAAAA,KAAAA,EAAOO,OAAOP;AAChB,aAAA,CAAA;QACF,CAAA,MAAO;;AAEL4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;gBACfhF,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,eAAA;oBACN/B,OAAAA,EAAS,2CAAA;oBACTgC,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAU4C,UAAU,CAACQ,KAAAA,CAAM,EAAEjC,QAAQyB,UAAU,CAACQ,MAAM,EAAE9B;AAC1D;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;IAEA,OAAO;AAAEqC,QAAAA,UAAAA;AAAYC,QAAAA,cAAAA;AAAgBZ,QAAAA;AAAO,KAAA;AAC9C;AAaA;;AAEC,IACM,eAAeiB,oBAAAA,CACpBC,UAAe,EACfC,IAAS,EACT1C,MAAmB,EAAA;IAEnB,MAAM2C,eAAAA,GAAkB,MAAMX,qBAAAA,CAAsBS,UAAAA,EAAYzC,MAAAA,CAAAA;AAEhE,IAAA,IAAI4C,YAAAA,GAAeF,IAAAA;AACnB,IAAA,IAAIA,MAAMG,QAAAA,EAAU;;QAElB,IAAIC,cAAAA,GAAiBJ,KAAKG,QAAQ;AAClC,QAAA,IAAI3D,KAAAA,CAAMC,OAAO,CAACuD,IAAAA,CAAKG,QAAQ,CAAA,EAAG;AAChCC,YAAAA,cAAAA,GAAiBJ,IAAAA,CAAKG,QAAQ,CAACnB,GAAG,CAAC,CAACqB,EAAAA,GAClC,OAAOA,EAAAA,KAAO,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,EAAAA,CAAAA,GAAMA,EAAAA,CAAAA;AAE9C,QAAA,CAAA,MAAO,IAAI,OAAOL,IAAAA,CAAKG,QAAQ,KAAK,QAAA,EAAU;AAC5CC,YAAAA,cAAAA,GAAiBE,IAAAA,CAAKC,KAAK,CAACP,IAAAA,CAAKG,QAAQ,CAAA;AAC3C,QAAA;;QAGA,IAAI3D,KAAAA,CAAMC,OAAO,CAAC2D,cAAAA,CAAAA,EAAiB;YACjC,MAAMI,cAAAA,GAAiB,IAAIC,GAAAA,CAAIR,eAAAA,CAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,CAAAA,GAAMA,CAAAA,CAAEb,aAAa,CAAA,CAAA;YAChF,MAAMc,gBAAAA,GAAmBP,cAAAA,CAAeQ,MAAM,CAC5C,CAACC,GAAQ5B,KAAAA,GAAkB,CAACuB,cAAAA,CAAeM,GAAG,CAAC7B,KAAAA,CAAAA,CAAAA;YAGjD,IAAI0B,gBAAAA,CAAiBtG,MAAM,KAAK,CAAA,EAAG;gBACjC6F,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ,gBAAgB,CAAC,CAAA;AAC7B,iBAAA;YACF,CAAA,MAAO;gBACLT,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ;AACZ,iBAAA;AACF,YAAA;QACF,CAAA,MAAO;YACLT,YAAAA,GAAe;AACb,gBAAA,GAAGF,IAAI;gBACPG,QAAAA,EAAUC;AACZ,aAAA;AACF,QAAA;AACF,IAAA;;IAGA,MAAMW,YAAAA,GAAkCd,gBAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,KAAO;AACzE1D,YAAAA,IAAAA,EAAM0D,EAAEtH,IAAI,EAAE2D,oBAAoB2D,CAAAA,CAAEtH,IAAI,EAAE4D,IAAAA,IAAQ,SAAA;YAClD7C,OAAAA,EAASuG,CAAAA,CAAEzG,KAAK,CAACE;SACnB,CAAA,CAAA;IAEA,OAAO;AACLqF,QAAAA,UAAAA,EAAYS,gBAAgBT,UAAU;AACtCU,QAAAA,YAAAA;QACArB,MAAAA,EAAQkC;AACV,KAAA;AACF;;;;;;;;;"}

package/dist/server/utils/mime-validation.mjs

@@ -58,7 +58,7 @@ function matchesMimePattern(mimeType, patterns) {
 }
 /**
  * Single gate for allow/deny. Returns ValidationResult.
- * Doc: docs/docs/01-core/upload/01-backend/01-mime-validation.md
+ * Doc: docs/docs/packages/core/upload/01-backend/01-mime-validation.md
  */ function validateAllowBanLists(mimetype, fileName, declaredType, detectedType, config) {
     if (!mimetype) {
         return {

package/dist/server/utils/mime-validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mime-validation.mjs","sources":["../../../server/src/utils/mime-validation.ts"],"sourcesContent":["import { open } from 'node:fs/promises';\nimport { extname } from 'node:path';\nimport { lookup } from 'mime-types';\nimport type { Core } from '@strapi/types';\nimport { errors } from '@strapi/utils';\n\nexport type SecurityConfig = {\n  allowedTypes?: string[];\n  deniedTypes?: string[];\n};\ntype UploadValidationError = {\n  code: 'MIME_TYPE_NOT_ALLOWED' | 'VALIDATION_ERROR' | 'UNKNOWN_ERROR';\n  message: string;\n  details: Record<string, any>;\n};\n\ntype ValidationResult = {\n  isValid: boolean;\n  error?: UploadValidationError;\n  detectedMime?: string;\n};\n\ntype ErrorDetail = {\n  file: any;\n  originalIndex: number;\n  error: UploadValidationError;\n};\n\nasync function readFileChunk(filePath: string, chunkSize: number = 4100): Promise<Buffer> {\n  const file = await open(filePath, 'r');\n\n  try {\n    const buffer = Buffer.alloc(chunkSize);\n    const { bytesRead } = await file.read(buffer, 0, chunkSize, 0);\n\n    return buffer.subarray(0, bytesRead);\n  } finally {\n    await file.close();\n  }\n}\n\nexport async function detectMimeType(file: any): Promise<string | undefined> {\n  let buffer: Buffer;\n\n  // Support multiple property names used by different multipart parsers (formidable uses filepath)\n  const filePath = file.filepath ?? file.path ?? file.tempFilePath ?? file.filePath;\n\n  if (filePath) {\n    try {\n      buffer = await readFileChunk(filePath, 4100);\n    } catch (error) {\n      throw new Error(\n        `Failed to read file: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  } else if (file.buffer) {\n    buffer = file.buffer.length > 4100 ? file.buffer.subarray(0, 4100) : file.buffer;\n  } else {\n    // No file path or buffer; cannot detect MIME. Validation will use declared/extension or reject.\n    return undefined;\n  }\n\n  try {\n    /**\n     * Use dynamic import to support file-type which is ESM-only\n     * Static imports fail during CommonJS build since bundler can't transform ESM-only packages\n     * @see https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c\n     */\n    const { fileTypeFromBuffer } = await import('file-type');\n\n    const result = await fileTypeFromBuffer(new Uint8Array(buffer));\n    return result?.mime;\n  } catch (error) {\n    throw new Error(\n      `Failed to detect MIME type: ${error instanceof Error ? error.message : String(error)}`\n    );\n  }\n}\n\nfunction matchesMimePattern(mimeType: string, patterns: string[]): boolean {\n  if (!patterns?.length) return false;\n\n  return patterns.some((pattern) => {\n    const normalizedPattern = pattern.toLowerCase();\n    const normalizedMimeType = mimeType.toLowerCase();\n\n    if (normalizedPattern.includes('*')) {\n      const regexPattern = normalizedPattern.replace(/\\*/g, '.*');\n\n      const regex = new RegExp(`^${regexPattern}$`);\n      const matches = regex.test(normalizedMimeType);\n      return matches;\n    }\n\n    const exactMatch = normalizedPattern === normalizedMimeType;\n    return exactMatch;\n  });\n}\n\nexport function isMimeTypeAllowed(mimeType: string, config: SecurityConfig): boolean {\n  const { allowedTypes, deniedTypes } = config;\n\n  if (!mimeType) return false;\n\n  if (deniedTypes?.length && matchesMimePattern(mimeType, deniedTypes)) {\n    return false;\n  }\n\n  if (Array.isArray(allowedTypes)) {\n    return allowedTypes.length > 0 && matchesMimePattern(mimeType, allowedTypes);\n  }\n\n  return true;\n}\n\n/**\n * Single gate for allow/deny. Returns ValidationResult.\n * Doc: docs/docs/01-core/upload/01-backend/01-mime-validation.md\n */\nfunction validateAllowBanLists(\n  mimetype: string,\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  config: SecurityConfig\n): ValidationResult {\n  if (!mimetype) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'No MIME type to validate',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (config.deniedTypes?.length && matchesMimePattern(mimetype, config.deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredType, detectedType, mimetype, config);\n  }\n  if (!Array.isArray(config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  if (config.allowedTypes.length === 0) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'Allow list is empty',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (matchesMimePattern(mimetype, config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${mimetype}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: mimetype,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n      },\n    },\n  };\n}\n\nfunction isDeclaredGeneric(declaredMimeType: string): boolean {\n  return !declaredMimeType || declaredMimeType === 'application/octet-stream';\n}\n\nexport function extractFileInfo(file: any) {\n  const fileName =\n    file.originalFilename ||\n    file.name ||\n    file.filename ||\n    file.newFilename ||\n    file.originalname ||\n    'unknown';\n  const declaredMimeType = file.mimetype || file.type || file.mimeType || file.mime || '';\n\n  return { fileName, declaredMimeType };\n}\n\nexport async function validateFile(\n  file: any,\n  config: SecurityConfig,\n  strapi: Core.Strapi\n): Promise<ValidationResult> {\n  const { allowedTypes, deniedTypes } = config;\n\n  const { fileName, declaredMimeType } = extractFileInfo(file);\n\n  const fileExt = extname(fileName).toLowerCase();\n  const expectedMimeFromExt = fileExt ? lookup(fileExt) || null : null;\n\n  // Reject if declared type is denied.\n  if (\n    !isDeclaredGeneric(declaredMimeType) &&\n    deniedTypes?.length &&\n    matchesMimePattern(declaredMimeType, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, declaredMimeType, config);\n  }\n\n  // Reject if extension's type is denied.\n  if (\n    expectedMimeFromExt &&\n    deniedTypes?.length &&\n    matchesMimePattern(expectedMimeFromExt, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, expectedMimeFromExt, config);\n  }\n\n  // Run content detection.\n  let detectedMime: string | undefined;\n  try {\n    detectedMime = await detectMimeType(file);\n  } catch (error) {\n    const errMsg = error instanceof Error ? error.message : String(error);\n    strapi.log.warn(`Failed to detect MIME type from file: ${errMsg}`, {\n      fileName,\n      error: errMsg,\n    });\n  }\n\n  const declaredMatchesExtension =\n    !isDeclaredGeneric(declaredMimeType) &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    (matchesMimePattern(declaredMimeType, [expectedMimeFromExt]) ||\n      matchesMimePattern(expectedMimeFromExt, [declaredMimeType]));\n  const detectedMatchesDeclared =\n    detectedMime && declaredMimeType && matchesMimePattern(detectedMime, [declaredMimeType]);\n\n  // Trusted declaration: declared matches extension and detection confirms.\n  if (declaredMatchesExtension && detectedMatchesDeclared) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject if detected type is denied.\n  if (detectedMime && deniedTypes?.length && matchesMimePattern(detectedMime, deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredMimeType, detectedMime, detectedMime, config);\n  }\n\n  // Reject if detected is not in allow list (extension/declared cannot override).\n  // Exception: file-type often returns application/zip for Office formats (docx, xlsx); skip so the next block can allow via extension type.\n  const isZipWithAllowedExt =\n    detectedMime === 'application/zip' &&\n    expectedMimeFromExt &&\n    expectedMimeFromExt !== 'application/zip' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  // Exception: file-type often returns application/xml for SVG; trust .svg extension when image/svg+xml is allowed.\n  const isSvgXmlWithAllowedExt =\n    detectedMime === 'application/xml' &&\n    fileExt === '.svg' &&\n    expectedMimeFromExt === 'image/svg+xml' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  if (\n    detectedMime &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    !matchesMimePattern(detectedMime, allowedTypes) &&\n    !isZipWithAllowedExt &&\n    !isSvgXmlWithAllowedExt\n  ) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason:\n            'File content was detected as a type not in the allow list; extension or declared type cannot override',\n          declaredType: declaredMimeType,\n          detectedType: detectedMime,\n          expectedMimeFromExtension: expectedMimeFromExt,\n          allowedTypes,\n          deniedTypes,\n        },\n      },\n    };\n  }\n\n  // Use detected type when defined and (no extension, or detected matches extension, or declared is generic).\n  const detectedMatchesExtension =\n    detectedMime &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    matchesMimePattern(detectedMime, [expectedMimeFromExt]);\n  if (\n    detectedMime &&\n    (!expectedMimeFromExt || detectedMatchesExtension || isDeclaredGeneric(declaredMimeType))\n  ) {\n    // Office/zip exception: use extension type when detection returned application/zip and extension is in allow list.\n    if (\n      detectedMime === 'application/zip' &&\n      expectedMimeFromExt &&\n      expectedMimeFromExt !== 'application/zip'\n    ) {\n      const extResult = validateAllowBanLists(\n        expectedMimeFromExt,\n        fileName,\n        declaredMimeType,\n        detectedMime,\n        config\n      );\n      if (extResult.isValid) {\n        strapi.log.warn(\n          'MIME type detection returned application/zip; trusting extension for allow list',\n          { fileName, fileExtension: fileExt, expectedMimeFromExtension: expectedMimeFromExt }\n        );\n        return extResult;\n      }\n    }\n    return validateAllowBanLists(detectedMime, fileName, declaredMimeType, detectedMime, config);\n  }\n\n  // Use extension's type when present.\n  if (expectedMimeFromExt) {\n    return validateAllowBanLists(\n      expectedMimeFromExt,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Use declared type as last resort.\n  if (declaredMimeType) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject when no type can be chosen.\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: 'Cannot verify file type for security reasons',\n      details: {\n        fileName,\n        reason: 'No MIME type to validate (no declared type, no extension, no detection)',\n        declaredType: declaredMimeType,\n        detectedType: detectedMime,\n        allowedTypes,\n        deniedTypes,\n      },\n    },\n  };\n}\n\nfunction buildNotAllowedError(\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  rejectedType: string,\n  config: SecurityConfig\n): ValidationResult {\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${rejectedType}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: rejectedType,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n        reason: 'MIME type is in the denied list',\n      },\n    },\n  };\n}\n\nexport async function validateFiles(files: any, strapi: Core.Strapi): Promise<ValidationResult[]> {\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  if (!filesArray.length) {\n    return [];\n  }\n\n  // Use array path so 'plugin::upload' is a single key (lodash string path splits on '.')\n  let config: SecurityConfig = strapi.config.get(\n    ['plugin::upload', 'security'],\n    {}\n  ) as SecurityConfig;\n  if (!config || typeof config !== 'object') {\n    config = {};\n  }\n  if (\n    config.allowedTypes &&\n    (!Array.isArray(config.allowedTypes) ||\n      !config.allowedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: allowedTypes must be an array of strings.'\n    );\n  }\n\n  if (\n    config.deniedTypes &&\n    (!Array.isArray(config.deniedTypes) ||\n      !config.deniedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: deniedTypes must be an array of strings.'\n    );\n  }\n\n  if (!config.allowedTypes && !config.deniedTypes) {\n    strapi.log.warn(\n      'No upload security configuration found. Consider configuring plugin.upload.security for enhanced file validation.'\n    );\n    // Do not return; we still run validation so MIME detection runs and stored file gets detected type when possible\n  }\n\n  const validationPromises = filesArray.map(async (file, index) => {\n    try {\n      return await validateFile(file, config, strapi);\n    } catch (error) {\n      strapi.log.error('Unexpected error during file validation', {\n        fileIndex: index,\n        fileName: file?.name || file?.originalname,\n        error: error instanceof Error ? error.message : String(error),\n      });\n\n      return {\n        isValid: false,\n        error: {\n          code: 'VALIDATION_ERROR' as const,\n          message: `Validation failed for file at index ${index}`,\n          details: {\n            index,\n            fileName: file?.name || file?.originalname,\n            originalError: error instanceof Error ? error.message : String(error),\n          },\n        },\n      };\n    }\n  });\n\n  return Promise.all(validationPromises);\n}\n\nexport async function enforceUploadSecurity(\n  files: any,\n  strapi: Core.Strapi\n): Promise<{\n  validFiles: any[];\n  validFileNames: string[];\n  errors: Array<ErrorDetail>;\n}> {\n  const validationResults = await validateFiles(files, strapi);\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  const validFiles: any[] = [];\n  const validFileNames: string[] = [];\n  const errors: Array<ErrorDetail> = [];\n\n  for (const [index, result] of validationResults.entries()) {\n    if (result.isValid) {\n      const file = filesArray[index];\n      // Enrich file with detected MIME type for use in storage\n      if (result.detectedMime) {\n        file.detectedMimeType = result.detectedMime;\n      }\n      validFiles.push(file);\n      validFileNames.push(file.originalFilename || file.name);\n    } else if (result.error) {\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: result.error,\n      });\n    } else {\n      // Handle case where validation failed but no error details are provided\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: {\n          code: 'UNKNOWN_ERROR' as const,\n          message: 'File validation failed for unknown reason',\n          details: {\n            index,\n            fileName: filesArray[index]?.name || filesArray[index]?.originalname,\n          },\n        },\n      });\n    }\n  }\n\n  return { validFiles, validFileNames, errors };\n}\n\nexport type FileUploadError = {\n  name: string;\n  message: string;\n};\n\nexport type PrepareUploadResult = {\n  validFiles: any[];\n  filteredBody: any;\n  errors: FileUploadError[];\n};\n\n/**\n * Prepare files and body for upload by enforcing security and parsing fileInfo\n */\nexport async function prepareUploadRequest(\n  filesInput: any,\n  body: any,\n  strapi: Core.Strapi\n): Promise<PrepareUploadResult> {\n  const securityResults = await enforceUploadSecurity(filesInput, strapi);\n\n  let filteredBody = body;\n  if (body?.fileInfo) {\n    // Parse JSON strings in fileInfo\n    let parsedFileInfo = body.fileInfo;\n    if (Array.isArray(body.fileInfo)) {\n      parsedFileInfo = body.fileInfo.map((fi: any) =>\n        typeof fi === 'string' ? JSON.parse(fi) : fi\n      );\n    } else if (typeof body.fileInfo === 'string') {\n      parsedFileInfo = JSON.parse(body.fileInfo);\n    }\n\n    // Filter fileInfo by index - only keep entries for files that passed validation\n    if (Array.isArray(parsedFileInfo)) {\n      const invalidIndices = new Set(securityResults.errors.map((e) => e.originalIndex));\n      const filteredFileInfo = parsedFileInfo.filter(\n        (_: any, index: number) => !invalidIndices.has(index)\n      );\n\n      if (filteredFileInfo.length === 1) {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo[0],\n        };\n      } else {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo,\n        };\n      }\n    } else {\n      filteredBody = {\n        ...body,\n        fileInfo: parsedFileInfo,\n      };\n    }\n  }\n\n  // Map errors to simplified format\n  const uploadErrors: FileUploadError[] = securityResults.errors.map((e) => ({\n    name: e.file?.originalFilename || e.file?.name || 'unknown',\n    message: e.error.message,\n  }));\n\n  return {\n    validFiles: securityResults.validFiles,\n    filteredBody,\n    errors: uploadErrors,\n  };\n}\n"],"names":["readFileChunk","filePath","chunkSize","file","open","buffer","Buffer","alloc","bytesRead","read","subarray","close","detectMimeType","filepath","path","tempFilePath","error","Error","message","String","length","undefined","fileTypeFromBuffer","result","Uint8Array","mime","matchesMimePattern","mimeType","patterns","some","pattern","normalizedPattern","toLowerCase","normalizedMimeType","includes","regexPattern","replace","regex","RegExp","matches","test","exactMatch","validateAllowBanLists","mimetype","fileName","declaredType","detectedType","config","isValid","code","details","reason","allowedTypes","deniedTypes","buildNotAllowedError","Array","isArray","detectedMime","finalType","isDeclaredGeneric","declaredMimeType","extractFileInfo","originalFilename","name","filename","newFilename","originalname","type","validateFile","strapi","fileExt","extname","expectedMimeFromExt","lookup","errMsg","log","warn","declaredMatchesExtension","detectedMatchesDeclared","isZipWithAllowedExt","isSvgXmlWithAllowedExt","expectedMimeFromExtension","detectedMatchesExtension","extResult","fileExtension","rejectedType","validateFiles","files","filesArray","get","every","item","errors","ApplicationError","validationPromises","map","index","fileIndex","originalError","Promise","all","enforceUploadSecurity","validationResults","validFiles","validFileNames","entries","detectedMimeType","push","originalIndex","prepareUploadRequest","filesInput","body","securityResults","filteredBody","fileInfo","parsedFileInfo","fi","JSON","parse","invalidIndices","Set","e","filteredFileInfo","filter","_","has","uploadErrors"],"mappings":";;;;;AA4BA,eAAeA,aAAAA,CAAcC,QAAgB,EAAEC,SAAAA,GAAoB,IAAI,EAAA;IACrE,MAAMC,IAAAA,GAAO,MAAMC,IAAAA,CAAKH,QAAAA,EAAU,GAAA,CAAA;IAElC,IAAI;QACF,MAAMI,MAAAA,GAASC,MAAAA,CAAOC,KAAK,CAACL,SAAAA,CAAAA;QAC5B,MAAM,EAAEM,SAAS,EAAE,GAAG,MAAML,KAAKM,IAAI,CAACJ,MAAAA,EAAQ,CAAA,EAAGH,SAAAA,EAAW,CAAA,CAAA;QAE5D,OAAOG,MAAAA,CAAOK,QAAQ,CAAC,CAAA,EAAGF,SAAAA,CAAAA;IAC5B,CAAA,QAAU;AACR,QAAA,MAAML,KAAKQ,KAAK,EAAA;AAClB,IAAA;AACF;AAEO,eAAeC,eAAeT,IAAS,EAAA;IAC5C,IAAIE,MAAAA;;IAGJ,MAAMJ,QAAAA,GAAWE,IAAAA,CAAKU,QAAQ,IAAIV,IAAAA,CAAKW,IAAI,IAAIX,IAAAA,CAAKY,YAAY,IAAIZ,IAAAA,CAAKF,QAAQ;AAEjF,IAAA,IAAIA,QAAAA,EAAU;QACZ,IAAI;YACFI,MAAAA,GAAS,MAAML,cAAcC,QAAAA,EAAU,IAAA,CAAA;AACzC,QAAA,CAAA,CAAE,OAAOe,KAAAA,EAAO;YACd,MAAM,IAAIC,KAAAA,CACR,CAAC,qBAAqB,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAEpF,QAAA;IACF,CAAA,MAAO,IAAIb,IAAAA,CAAKE,MAAM,EAAE;AACtBA,QAAAA,MAAAA,GAASF,IAAAA,CAAKE,MAAM,CAACe,MAAM,GAAG,IAAA,GAAOjB,IAAAA,CAAKE,MAAM,CAACK,QAAQ,CAAC,CAAA,EAAG,IAAA,CAAA,GAAQP,KAAKE,MAAM;IAClF,CAAA,MAAO;;QAEL,OAAOgB,SAAAA;AACT,IAAA;IAEA,IAAI;AACF;;;;AAIC,QACD,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAM,OAAO,WAAA,CAAA;AAE5C,QAAA,MAAMC,MAAAA,GAAS,MAAMD,kBAAAA,CAAmB,IAAIE,UAAAA,CAAWnB,MAAAA,CAAAA,CAAAA;AACvD,QAAA,OAAOkB,MAAAA,EAAQE,IAAAA;AACjB,IAAA,CAAA,CAAE,OAAOT,KAAAA,EAAO;QACd,MAAM,IAAIC,KAAAA,CACR,CAAC,4BAA4B,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAE3F,IAAA;AACF;AAEA,SAASU,kBAAAA,CAAmBC,QAAgB,EAAEC,QAAkB,EAAA;IAC9D,IAAI,CAACA,QAAAA,EAAUR,MAAAA,EAAQ,OAAO,KAAA;IAE9B,OAAOQ,QAAAA,CAASC,IAAI,CAAC,CAACC,OAAAA,GAAAA;QACpB,MAAMC,iBAAAA,GAAoBD,QAAQE,WAAW,EAAA;QAC7C,MAAMC,kBAAAA,GAAqBN,SAASK,WAAW,EAAA;QAE/C,IAAID,iBAAAA,CAAkBG,QAAQ,CAAC,GAAA,CAAA,EAAM;AACnC,YAAA,MAAMC,YAAAA,GAAeJ,iBAAAA,CAAkBK,OAAO,CAAC,KAAA,EAAO,IAAA,CAAA;YAEtD,MAAMC,KAAAA,GAAQ,IAAIC,MAAAA,CAAO,CAAC,CAAC,EAAEH,YAAAA,CAAa,CAAC,CAAC,CAAA;YAC5C,MAAMI,OAAAA,GAAUF,KAAAA,CAAMG,IAAI,CAACP,kBAAAA,CAAAA;YAC3B,OAAOM,OAAAA;AACT,QAAA;AAEA,QAAA,MAAME,aAAaV,iBAAAA,KAAsBE,kBAAAA;QACzC,OAAOQ,UAAAA;AACT,IAAA,CAAA,CAAA;AACF;AAkBA;;;IAIA,SAASC,qBAAAA,CACPC,QAAgB,EAChBC,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCC,MAAsB,EAAA;AAEtB,IAAA,IAAI,CAACJ,QAAAA,EAAU;QACb,OAAO;YACLK,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,0BAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;IACA,IAAIN,MAAAA,CAAOM,WAAW,EAAEjC,MAAAA,IAAUM,mBAAmBiB,QAAAA,EAAUI,MAAAA,CAAOM,WAAW,CAAA,EAAG;AAClF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUC,YAAAA,EAAcC,YAAAA,EAAcH,QAAAA,EAAUI,MAAAA,CAAAA;AAC9E,IAAA;AACA,IAAA,IAAI,CAACQ,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACvC,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;AACA,IAAA,IAAII,MAAAA,CAAOK,YAAY,CAAChC,MAAM,KAAK,CAAA,EAAG;QACpC,OAAO;YACL4B,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,qBAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;AACA,IAAA,IAAI3B,kBAAAA,CAAmBiB,QAAAA,EAAUI,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACrD,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;IACA,OAAO;QACLK,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEyB,QAAAA,CAAS,gBAAgB,CAAC;YACjDO,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAWf,QAAAA;AACXS,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,KAAA;AACF;AAEA,SAASM,kBAAkBC,gBAAwB,EAAA;IACjD,OAAO,CAACA,oBAAoBA,gBAAAA,KAAqB,0BAAA;AACnD;AAEO,SAASC,gBAAgB1D,IAAS,EAAA;AACvC,IAAA,MAAMyC,QAAAA,GACJzC,IAAAA,CAAK2D,gBAAgB,IACrB3D,KAAK4D,IAAI,IACT5D,IAAAA,CAAK6D,QAAQ,IACb7D,IAAAA,CAAK8D,WAAW,IAChB9D,IAAAA,CAAK+D,YAAY,IACjB,SAAA;AACF,IAAA,MAAMN,gBAAAA,GAAmBzD,IAAAA,CAAKwC,QAAQ,IAAIxC,IAAAA,CAAKgE,IAAI,IAAIhE,IAAAA,CAAKwB,QAAQ,IAAIxB,IAAAA,CAAKsB,IAAI,IAAI,EAAA;IAErF,OAAO;AAAEmB,QAAAA,QAAAA;AAAUgB,QAAAA;AAAiB,KAAA;AACtC;AAEO,eAAeQ,YAAAA,CACpBjE,IAAS,EACT4C,MAAsB,EACtBsB,MAAmB,EAAA;AAEnB,IAAA,MAAM,EAAEjB,YAAY,EAAEC,WAAW,EAAE,GAAGN,MAAAA;AAEtC,IAAA,MAAM,EAAEH,QAAQ,EAAEgB,gBAAgB,EAAE,GAAGC,eAAAA,CAAgB1D,IAAAA,CAAAA;IAEvD,MAAMmE,OAAAA,GAAUC,OAAAA,CAAQ3B,QAAAA,CAAAA,CAAUZ,WAAW,EAAA;AAC7C,IAAA,MAAMwC,mBAAAA,GAAsBF,OAAAA,GAAUG,MAAAA,CAAOH,OAAAA,CAAAA,IAAY,IAAA,GAAO,IAAA;;AAGhE,IAAA,IACE,CAACX,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBP,aAAajC,MAAAA,IACbM,kBAAAA,CAAmBkC,kBAAkBP,WAAAA,CAAAA,EACrC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWuC,gBAAAA,EAAkBb,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IACEyB,mBAAAA,IACAnB,WAAAA,EAAajC,MAAAA,IACbM,kBAAAA,CAAmB8C,qBAAqBnB,WAAAA,CAAAA,EACxC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWmD,mBAAAA,EAAqBzB,MAAAA,CAAAA;AAC1F,IAAA;;IAGA,IAAIU,YAAAA;IACJ,IAAI;AACFA,QAAAA,YAAAA,GAAe,MAAM7C,cAAAA,CAAeT,IAAAA,CAAAA;AACtC,IAAA,CAAA,CAAE,OAAOa,KAAAA,EAAO;AACd,QAAA,MAAM0D,SAAS1D,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA;QAC/DqD,MAAAA,CAAOM,GAAG,CAACC,IAAI,CAAC,CAAC,sCAAsC,EAAEF,QAAQ,EAAE;AACjE9B,YAAAA,QAAAA;YACA5B,KAAAA,EAAO0D;AACT,SAAA,CAAA;AACF,IAAA;IAEA,MAAMG,wBAAAA,GACJ,CAAClB,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBY,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,KACvBK,kBAAAA,CAAmBkC,gBAAAA,EAAkB;AAACY,QAAAA;AAAoB,KAAA,CAAA,IACzD9C,mBAAmB8C,mBAAAA,EAAqB;AAACZ,QAAAA;KAAiB,CAAA,CAAA;AAC9D,IAAA,MAAMkB,uBAAAA,GACJrB,YAAAA,IAAgBG,gBAAAA,IAAoBlC,kBAAAA,CAAmB+B,YAAAA,EAAc;AAACG,QAAAA;AAAiB,KAAA,CAAA;;AAGzF,IAAA,IAAIiB,4BAA4BC,uBAAAA,EAAyB;AACvD,QAAA,OAAOpC,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIU,YAAAA,IAAgBJ,WAAAA,EAAajC,MAAAA,IAAUM,kBAAAA,CAAmB+B,cAAcJ,WAAAA,CAAAA,EAAc;AACxF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcA,YAAAA,EAAcV,MAAAA,CAAAA;AACtF,IAAA;;;AAIA,IAAA,MAAMgC,mBAAAA,GACJtB,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,wBAAwB,iBAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;;AAE1C,IAAA,MAAM4B,yBACJvB,YAAAA,KAAiB,iBAAA,IACjBa,OAAAA,KAAY,MAAA,IACZE,wBAAwB,eAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;AAC1C,IAAA,IACEK,gBACAF,KAAAA,CAAMC,OAAO,CAACJ,YAAAA,CAAAA,IACdA,aAAahC,MAAM,GAAG,CAAA,IACtB,CAACM,mBAAmB+B,YAAAA,EAAcL,YAAAA,CAAAA,IAClC,CAAC2B,mBAAAA,IACD,CAACC,sBAAAA,EACD;QACA,OAAO;YACLhC,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EACE,uGAAA;oBACFN,YAAAA,EAAce,gBAAAA;oBACdd,YAAAA,EAAcW,YAAAA;oBACdwB,yBAAAA,EAA2BT,mBAAAA;AAC3BpB,oBAAAA,YAAAA;AACAC,oBAAAA;AACF;AACF;AACF,SAAA;AACF,IAAA;;AAGA,IAAA,MAAM6B,2BACJzB,YAAAA,IACAe,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,IACxBK,mBAAmB+B,YAAAA,EAAc;AAACe,QAAAA;AAAoB,KAAA,CAAA;AACxD,IAAA,IACEf,iBACC,CAACe,uBAAuBU,wBAAAA,IAA4BvB,iBAAAA,CAAkBC,iBAAgB,CAAA,EACvF;;AAEA,QAAA,IACEH,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,mBAAAA,KAAwB,iBAAA,EACxB;AACA,YAAA,MAAMW,SAAAA,GAAYzC,qBAAAA,CAChB8B,mBAAAA,EACA5B,QAAAA,EACAgB,kBACAH,YAAAA,EACAV,MAAAA,CAAAA;YAEF,IAAIoC,SAAAA,CAAUnC,OAAO,EAAE;AACrBqB,gBAAAA,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,iFAAA,EACA;AAAEhC,oBAAAA,QAAAA;oBAAUwC,aAAAA,EAAed,OAAAA;oBAASW,yBAAAA,EAA2BT;AAAoB,iBAAA,CAAA;gBAErF,OAAOW,SAAAA;AACT,YAAA;AACF,QAAA;AACA,QAAA,OAAOzC,qBAAAA,CAAsBe,YAAAA,EAAcb,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcV,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IAAIyB,mBAAAA,EAAqB;AACvB,QAAA,OAAO9B,qBAAAA,CACL8B,mBAAAA,EACA5B,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIa,gBAAAA,EAAkB;AACpB,QAAA,OAAOlB,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;IAGA,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;YACN/B,OAAAA,EAAS,8CAAA;YACTgC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;gBACAO,MAAAA,EAAQ,yEAAA;gBACRN,YAAAA,EAAce,gBAAAA;gBACdd,YAAAA,EAAcW,YAAAA;AACdL,gBAAAA,YAAAA;AACAC,gBAAAA;AACF;AACF;AACF,KAAA;AACF;AAEA,SAASC,oBAAAA,CACPV,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCuC,YAAoB,EACpBtC,MAAsB,EAAA;IAEtB,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEmE,YAAAA,CAAa,gBAAgB,CAAC;YACrDnC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAW2B,YAAAA;AACXjC,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM,WAAW;gBAC/BF,MAAAA,EAAQ;AACV;AACF;AACF,KAAA;AACF;AAEO,eAAemC,aAAAA,CAAcC,KAAU,EAAElB,MAAmB,EAAA;AACjE,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;IAEzD,IAAI,CAACC,UAAAA,CAAWpE,MAAM,EAAE;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;;AAGA,IAAA,IAAI2B,MAAAA,GAAyBsB,MAAAA,CAAOtB,MAAM,CAAC0C,GAAG,CAC5C;AAAC,QAAA,gBAAA;AAAkB,QAAA;AAAW,KAAA,EAC9B,EAAC,CAAA;AAEH,IAAA,IAAI,CAAC1C,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAA,EAAU;AACzCA,QAAAA,MAAAA,GAAS,EAAC;AACZ,IAAA;IACA,IACEA,MAAAA,CAAOK,YAAY,KAClB,CAACG,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,IACjC,CAACL,MAAAA,CAAOK,YAAY,CAACsC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC/D;QACA,MAAM,IAAIC,MAAAA,CAAOC,gBAAgB,CAC/B,kEAAA,CAAA;AAEJ,IAAA;IAEA,IACE9C,MAAAA,CAAOM,WAAW,KACjB,CAACE,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOM,WAAW,CAAA,IAChC,CAACN,MAAAA,CAAOM,WAAW,CAACqC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC9D;QACA,MAAM,IAAIC,MAAAA,CAAOC,gBAAgB,CAC/B,iEAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAI,CAAC9C,MAAAA,CAAOK,YAAY,IAAI,CAACL,MAAAA,CAAOM,WAAW,EAAE;QAC/CgB,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,mHAAA,CAAA;;AAGJ,IAAA;AAEA,IAAA,MAAMkB,kBAAAA,GAAqBN,UAAAA,CAAWO,GAAG,CAAC,OAAO5F,IAAAA,EAAM6F,KAAAA,GAAAA;QACrD,IAAI;YACF,OAAO,MAAM5B,YAAAA,CAAajE,IAAAA,EAAM4C,MAAAA,EAAQsB,MAAAA,CAAAA;AAC1C,QAAA,CAAA,CAAE,OAAOrD,KAAAA,EAAO;AACdqD,YAAAA,MAAAA,CAAOM,GAAG,CAAC3D,KAAK,CAAC,yCAAA,EAA2C;gBAC1DiF,SAAAA,EAAWD,KAAAA;gBACXpD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BlD,gBAAAA,KAAAA,EAAOA,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACzD,aAAA,CAAA;YAEA,OAAO;gBACLgC,OAAAA,EAAS,KAAA;gBACThC,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,kBAAA;oBACN/B,OAAAA,EAAS,CAAC,oCAAoC,EAAE8E,KAAAA,CAAAA,CAAO;oBACvD9C,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BgC,wBAAAA,aAAAA,EAAelF,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACjE;AACF;AACF,aAAA;AACF,QAAA;AACF,IAAA,CAAA,CAAA;IAEA,OAAOmF,OAAAA,CAAQC,GAAG,CAACN,kBAAAA,CAAAA;AACrB;AAEO,eAAeO,qBAAAA,CACpBd,KAAU,EACVlB,MAAmB,EAAA;IAMnB,MAAMiC,iBAAAA,GAAoB,MAAMhB,aAAAA,CAAcC,KAAAA,EAAOlB,MAAAA,CAAAA;AACrD,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;AAEzD,IAAA,MAAMgB,aAAoB,EAAE;AAC5B,IAAA,MAAMC,iBAA2B,EAAE;AACnC,IAAA,MAAMZ,SAA6B,EAAE;AAErC,IAAA,KAAK,MAAM,CAACI,KAAAA,EAAOzE,OAAO,IAAI+E,iBAAAA,CAAkBG,OAAO,EAAA,CAAI;QACzD,IAAIlF,MAAAA,CAAOyB,OAAO,EAAE;YAClB,MAAM7C,IAAAA,GAAOqF,UAAU,CAACQ,KAAAA,CAAM;;YAE9B,IAAIzE,MAAAA,CAAOkC,YAAY,EAAE;gBACvBtD,IAAAA,CAAKuG,gBAAgB,GAAGnF,MAAAA,CAAOkC,YAAY;AAC7C,YAAA;AACA8C,YAAAA,UAAAA,CAAWI,IAAI,CAACxG,IAAAA,CAAAA;AAChBqG,YAAAA,cAAAA,CAAeG,IAAI,CAACxG,IAAAA,CAAK2D,gBAAgB,IAAI3D,KAAK4D,IAAI,CAAA;QACxD,CAAA,MAAO,IAAIxC,MAAAA,CAAOP,KAAK,EAAE;AACvB4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;AACfhF,gBAAAA,KAAAA,EAAOO,OAAOP;AAChB,aAAA,CAAA;QACF,CAAA,MAAO;;AAEL4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;gBACfhF,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,eAAA;oBACN/B,OAAAA,EAAS,2CAAA;oBACTgC,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAU4C,UAAU,CAACQ,KAAAA,CAAM,EAAEjC,QAAQyB,UAAU,CAACQ,MAAM,EAAE9B;AAC1D;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;IAEA,OAAO;AAAEqC,QAAAA,UAAAA;AAAYC,QAAAA,cAAAA;AAAgBZ,QAAAA;AAAO,KAAA;AAC9C;AAaA;;AAEC,IACM,eAAeiB,oBAAAA,CACpBC,UAAe,EACfC,IAAS,EACT1C,MAAmB,EAAA;IAEnB,MAAM2C,eAAAA,GAAkB,MAAMX,qBAAAA,CAAsBS,UAAAA,EAAYzC,MAAAA,CAAAA;AAEhE,IAAA,IAAI4C,YAAAA,GAAeF,IAAAA;AACnB,IAAA,IAAIA,MAAMG,QAAAA,EAAU;;QAElB,IAAIC,cAAAA,GAAiBJ,KAAKG,QAAQ;AAClC,QAAA,IAAI3D,KAAAA,CAAMC,OAAO,CAACuD,IAAAA,CAAKG,QAAQ,CAAA,EAAG;AAChCC,YAAAA,cAAAA,GAAiBJ,IAAAA,CAAKG,QAAQ,CAACnB,GAAG,CAAC,CAACqB,EAAAA,GAClC,OAAOA,EAAAA,KAAO,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,EAAAA,CAAAA,GAAMA,EAAAA,CAAAA;AAE9C,QAAA,CAAA,MAAO,IAAI,OAAOL,IAAAA,CAAKG,QAAQ,KAAK,QAAA,EAAU;AAC5CC,YAAAA,cAAAA,GAAiBE,IAAAA,CAAKC,KAAK,CAACP,IAAAA,CAAKG,QAAQ,CAAA;AAC3C,QAAA;;QAGA,IAAI3D,KAAAA,CAAMC,OAAO,CAAC2D,cAAAA,CAAAA,EAAiB;YACjC,MAAMI,cAAAA,GAAiB,IAAIC,GAAAA,CAAIR,eAAAA,CAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,CAAAA,GAAMA,CAAAA,CAAEb,aAAa,CAAA,CAAA;YAChF,MAAMc,gBAAAA,GAAmBP,cAAAA,CAAeQ,MAAM,CAC5C,CAACC,GAAQ5B,KAAAA,GAAkB,CAACuB,cAAAA,CAAeM,GAAG,CAAC7B,KAAAA,CAAAA,CAAAA;YAGjD,IAAI0B,gBAAAA,CAAiBtG,MAAM,KAAK,CAAA,EAAG;gBACjC6F,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ,gBAAgB,CAAC,CAAA;AAC7B,iBAAA;YACF,CAAA,MAAO;gBACLT,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ;AACZ,iBAAA;AACF,YAAA;QACF,CAAA,MAAO;YACLT,YAAAA,GAAe;AACb,gBAAA,GAAGF,IAAI;gBACPG,QAAAA,EAAUC;AACZ,aAAA;AACF,QAAA;AACF,IAAA;;IAGA,MAAMW,YAAAA,GAAkCd,gBAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,KAAO;AACzE1D,YAAAA,IAAAA,EAAM0D,EAAEtH,IAAI,EAAE2D,oBAAoB2D,CAAAA,CAAEtH,IAAI,EAAE4D,IAAAA,IAAQ,SAAA;YAClD7C,OAAAA,EAASuG,CAAAA,CAAEzG,KAAK,CAACE;SACnB,CAAA,CAAA;IAEA,OAAO;AACLqF,QAAAA,UAAAA,EAAYS,gBAAgBT,UAAU;AACtCU,QAAAA,YAAAA;QACArB,MAAAA,EAAQkC;AACV,KAAA;AACF;;;;"}
+{"version":3,"file":"mime-validation.mjs","sources":["../../../server/src/utils/mime-validation.ts"],"sourcesContent":["import { open } from 'node:fs/promises';\nimport { extname } from 'node:path';\nimport { lookup } from 'mime-types';\nimport type { Core } from '@strapi/types';\nimport { errors } from '@strapi/utils';\n\nexport type SecurityConfig = {\n  allowedTypes?: string[];\n  deniedTypes?: string[];\n};\ntype UploadValidationError = {\n  code: 'MIME_TYPE_NOT_ALLOWED' | 'VALIDATION_ERROR' | 'UNKNOWN_ERROR';\n  message: string;\n  details: Record<string, any>;\n};\n\ntype ValidationResult = {\n  isValid: boolean;\n  error?: UploadValidationError;\n  detectedMime?: string;\n};\n\ntype ErrorDetail = {\n  file: any;\n  originalIndex: number;\n  error: UploadValidationError;\n};\n\nasync function readFileChunk(filePath: string, chunkSize: number = 4100): Promise<Buffer> {\n  const file = await open(filePath, 'r');\n\n  try {\n    const buffer = Buffer.alloc(chunkSize);\n    const { bytesRead } = await file.read(buffer, 0, chunkSize, 0);\n\n    return buffer.subarray(0, bytesRead);\n  } finally {\n    await file.close();\n  }\n}\n\nexport async function detectMimeType(file: any): Promise<string | undefined> {\n  let buffer: Buffer;\n\n  // Support multiple property names used by different multipart parsers (formidable uses filepath)\n  const filePath = file.filepath ?? file.path ?? file.tempFilePath ?? file.filePath;\n\n  if (filePath) {\n    try {\n      buffer = await readFileChunk(filePath, 4100);\n    } catch (error) {\n      throw new Error(\n        `Failed to read file: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  } else if (file.buffer) {\n    buffer = file.buffer.length > 4100 ? file.buffer.subarray(0, 4100) : file.buffer;\n  } else {\n    // No file path or buffer; cannot detect MIME. Validation will use declared/extension or reject.\n    return undefined;\n  }\n\n  try {\n    /**\n     * Use dynamic import to support file-type which is ESM-only\n     * Static imports fail during CommonJS build since bundler can't transform ESM-only packages\n     * @see https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c\n     */\n    const { fileTypeFromBuffer } = await import('file-type');\n\n    const result = await fileTypeFromBuffer(new Uint8Array(buffer));\n    return result?.mime;\n  } catch (error) {\n    throw new Error(\n      `Failed to detect MIME type: ${error instanceof Error ? error.message : String(error)}`\n    );\n  }\n}\n\nfunction matchesMimePattern(mimeType: string, patterns: string[]): boolean {\n  if (!patterns?.length) return false;\n\n  return patterns.some((pattern) => {\n    const normalizedPattern = pattern.toLowerCase();\n    const normalizedMimeType = mimeType.toLowerCase();\n\n    if (normalizedPattern.includes('*')) {\n      const regexPattern = normalizedPattern.replace(/\\*/g, '.*');\n\n      const regex = new RegExp(`^${regexPattern}$`);\n      const matches = regex.test(normalizedMimeType);\n      return matches;\n    }\n\n    const exactMatch = normalizedPattern === normalizedMimeType;\n    return exactMatch;\n  });\n}\n\nexport function isMimeTypeAllowed(mimeType: string, config: SecurityConfig): boolean {\n  const { allowedTypes, deniedTypes } = config;\n\n  if (!mimeType) return false;\n\n  if (deniedTypes?.length && matchesMimePattern(mimeType, deniedTypes)) {\n    return false;\n  }\n\n  if (Array.isArray(allowedTypes)) {\n    return allowedTypes.length > 0 && matchesMimePattern(mimeType, allowedTypes);\n  }\n\n  return true;\n}\n\n/**\n * Single gate for allow/deny. Returns ValidationResult.\n * Doc: docs/docs/packages/core/upload/01-backend/01-mime-validation.md\n */\nfunction validateAllowBanLists(\n  mimetype: string,\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  config: SecurityConfig\n): ValidationResult {\n  if (!mimetype) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'No MIME type to validate',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (config.deniedTypes?.length && matchesMimePattern(mimetype, config.deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredType, detectedType, mimetype, config);\n  }\n  if (!Array.isArray(config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  if (config.allowedTypes.length === 0) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'Allow list is empty',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (matchesMimePattern(mimetype, config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${mimetype}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: mimetype,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n      },\n    },\n  };\n}\n\nfunction isDeclaredGeneric(declaredMimeType: string): boolean {\n  return !declaredMimeType || declaredMimeType === 'application/octet-stream';\n}\n\nexport function extractFileInfo(file: any) {\n  const fileName =\n    file.originalFilename ||\n    file.name ||\n    file.filename ||\n    file.newFilename ||\n    file.originalname ||\n    'unknown';\n  const declaredMimeType = file.mimetype || file.type || file.mimeType || file.mime || '';\n\n  return { fileName, declaredMimeType };\n}\n\nexport async function validateFile(\n  file: any,\n  config: SecurityConfig,\n  strapi: Core.Strapi\n): Promise<ValidationResult> {\n  const { allowedTypes, deniedTypes } = config;\n\n  const { fileName, declaredMimeType } = extractFileInfo(file);\n\n  const fileExt = extname(fileName).toLowerCase();\n  const expectedMimeFromExt = fileExt ? lookup(fileExt) || null : null;\n\n  // Reject if declared type is denied.\n  if (\n    !isDeclaredGeneric(declaredMimeType) &&\n    deniedTypes?.length &&\n    matchesMimePattern(declaredMimeType, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, declaredMimeType, config);\n  }\n\n  // Reject if extension's type is denied.\n  if (\n    expectedMimeFromExt &&\n    deniedTypes?.length &&\n    matchesMimePattern(expectedMimeFromExt, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, expectedMimeFromExt, config);\n  }\n\n  // Run content detection.\n  let detectedMime: string | undefined;\n  try {\n    detectedMime = await detectMimeType(file);\n  } catch (error) {\n    const errMsg = error instanceof Error ? error.message : String(error);\n    strapi.log.warn(`Failed to detect MIME type from file: ${errMsg}`, {\n      fileName,\n      error: errMsg,\n    });\n  }\n\n  const declaredMatchesExtension =\n    !isDeclaredGeneric(declaredMimeType) &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    (matchesMimePattern(declaredMimeType, [expectedMimeFromExt]) ||\n      matchesMimePattern(expectedMimeFromExt, [declaredMimeType]));\n  const detectedMatchesDeclared =\n    detectedMime && declaredMimeType && matchesMimePattern(detectedMime, [declaredMimeType]);\n\n  // Trusted declaration: declared matches extension and detection confirms.\n  if (declaredMatchesExtension && detectedMatchesDeclared) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject if detected type is denied.\n  if (detectedMime && deniedTypes?.length && matchesMimePattern(detectedMime, deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredMimeType, detectedMime, detectedMime, config);\n  }\n\n  // Reject if detected is not in allow list (extension/declared cannot override).\n  // Exception: file-type often returns application/zip for Office formats (docx, xlsx); skip so the next block can allow via extension type.\n  const isZipWithAllowedExt =\n    detectedMime === 'application/zip' &&\n    expectedMimeFromExt &&\n    expectedMimeFromExt !== 'application/zip' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  // Exception: file-type often returns application/xml for SVG; trust .svg extension when image/svg+xml is allowed.\n  const isSvgXmlWithAllowedExt =\n    detectedMime === 'application/xml' &&\n    fileExt === '.svg' &&\n    expectedMimeFromExt === 'image/svg+xml' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  if (\n    detectedMime &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    !matchesMimePattern(detectedMime, allowedTypes) &&\n    !isZipWithAllowedExt &&\n    !isSvgXmlWithAllowedExt\n  ) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason:\n            'File content was detected as a type not in the allow list; extension or declared type cannot override',\n          declaredType: declaredMimeType,\n          detectedType: detectedMime,\n          expectedMimeFromExtension: expectedMimeFromExt,\n          allowedTypes,\n          deniedTypes,\n        },\n      },\n    };\n  }\n\n  // Use detected type when defined and (no extension, or detected matches extension, or declared is generic).\n  const detectedMatchesExtension =\n    detectedMime &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    matchesMimePattern(detectedMime, [expectedMimeFromExt]);\n  if (\n    detectedMime &&\n    (!expectedMimeFromExt || detectedMatchesExtension || isDeclaredGeneric(declaredMimeType))\n  ) {\n    // Office/zip exception: use extension type when detection returned application/zip and extension is in allow list.\n    if (\n      detectedMime === 'application/zip' &&\n      expectedMimeFromExt &&\n      expectedMimeFromExt !== 'application/zip'\n    ) {\n      const extResult = validateAllowBanLists(\n        expectedMimeFromExt,\n        fileName,\n        declaredMimeType,\n        detectedMime,\n        config\n      );\n      if (extResult.isValid) {\n        strapi.log.warn(\n          'MIME type detection returned application/zip; trusting extension for allow list',\n          { fileName, fileExtension: fileExt, expectedMimeFromExtension: expectedMimeFromExt }\n        );\n        return extResult;\n      }\n    }\n    return validateAllowBanLists(detectedMime, fileName, declaredMimeType, detectedMime, config);\n  }\n\n  // Use extension's type when present.\n  if (expectedMimeFromExt) {\n    return validateAllowBanLists(\n      expectedMimeFromExt,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Use declared type as last resort.\n  if (declaredMimeType) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject when no type can be chosen.\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: 'Cannot verify file type for security reasons',\n      details: {\n        fileName,\n        reason: 'No MIME type to validate (no declared type, no extension, no detection)',\n        declaredType: declaredMimeType,\n        detectedType: detectedMime,\n        allowedTypes,\n        deniedTypes,\n      },\n    },\n  };\n}\n\nfunction buildNotAllowedError(\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  rejectedType: string,\n  config: SecurityConfig\n): ValidationResult {\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${rejectedType}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: rejectedType,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n        reason: 'MIME type is in the denied list',\n      },\n    },\n  };\n}\n\nexport async function validateFiles(files: any, strapi: Core.Strapi): Promise<ValidationResult[]> {\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  if (!filesArray.length) {\n    return [];\n  }\n\n  // Use array path so 'plugin::upload' is a single key (lodash string path splits on '.')\n  let config: SecurityConfig = strapi.config.get(\n    ['plugin::upload', 'security'],\n    {}\n  ) as SecurityConfig;\n  if (!config || typeof config !== 'object') {\n    config = {};\n  }\n  if (\n    config.allowedTypes &&\n    (!Array.isArray(config.allowedTypes) ||\n      !config.allowedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: allowedTypes must be an array of strings.'\n    );\n  }\n\n  if (\n    config.deniedTypes &&\n    (!Array.isArray(config.deniedTypes) ||\n      !config.deniedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: deniedTypes must be an array of strings.'\n    );\n  }\n\n  if (!config.allowedTypes && !config.deniedTypes) {\n    strapi.log.warn(\n      'No upload security configuration found. Consider configuring plugin.upload.security for enhanced file validation.'\n    );\n    // Do not return; we still run validation so MIME detection runs and stored file gets detected type when possible\n  }\n\n  const validationPromises = filesArray.map(async (file, index) => {\n    try {\n      return await validateFile(file, config, strapi);\n    } catch (error) {\n      strapi.log.error('Unexpected error during file validation', {\n        fileIndex: index,\n        fileName: file?.name || file?.originalname,\n        error: error instanceof Error ? error.message : String(error),\n      });\n\n      return {\n        isValid: false,\n        error: {\n          code: 'VALIDATION_ERROR' as const,\n          message: `Validation failed for file at index ${index}`,\n          details: {\n            index,\n            fileName: file?.name || file?.originalname,\n            originalError: error instanceof Error ? error.message : String(error),\n          },\n        },\n      };\n    }\n  });\n\n  return Promise.all(validationPromises);\n}\n\nexport async function enforceUploadSecurity(\n  files: any,\n  strapi: Core.Strapi\n): Promise<{\n  validFiles: any[];\n  validFileNames: string[];\n  errors: Array<ErrorDetail>;\n}> {\n  const validationResults = await validateFiles(files, strapi);\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  const validFiles: any[] = [];\n  const validFileNames: string[] = [];\n  const errors: Array<ErrorDetail> = [];\n\n  for (const [index, result] of validationResults.entries()) {\n    if (result.isValid) {\n      const file = filesArray[index];\n      // Enrich file with detected MIME type for use in storage\n      if (result.detectedMime) {\n        file.detectedMimeType = result.detectedMime;\n      }\n      validFiles.push(file);\n      validFileNames.push(file.originalFilename || file.name);\n    } else if (result.error) {\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: result.error,\n      });\n    } else {\n      // Handle case where validation failed but no error details are provided\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: {\n          code: 'UNKNOWN_ERROR' as const,\n          message: 'File validation failed for unknown reason',\n          details: {\n            index,\n            fileName: filesArray[index]?.name || filesArray[index]?.originalname,\n          },\n        },\n      });\n    }\n  }\n\n  return { validFiles, validFileNames, errors };\n}\n\nexport type FileUploadError = {\n  name: string;\n  message: string;\n};\n\nexport type PrepareUploadResult = {\n  validFiles: any[];\n  filteredBody: any;\n  errors: FileUploadError[];\n};\n\n/**\n * Prepare files and body for upload by enforcing security and parsing fileInfo\n */\nexport async function prepareUploadRequest(\n  filesInput: any,\n  body: any,\n  strapi: Core.Strapi\n): Promise<PrepareUploadResult> {\n  const securityResults = await enforceUploadSecurity(filesInput, strapi);\n\n  let filteredBody = body;\n  if (body?.fileInfo) {\n    // Parse JSON strings in fileInfo\n    let parsedFileInfo = body.fileInfo;\n    if (Array.isArray(body.fileInfo)) {\n      parsedFileInfo = body.fileInfo.map((fi: any) =>\n        typeof fi === 'string' ? JSON.parse(fi) : fi\n      );\n    } else if (typeof body.fileInfo === 'string') {\n      parsedFileInfo = JSON.parse(body.fileInfo);\n    }\n\n    // Filter fileInfo by index - only keep entries for files that passed validation\n    if (Array.isArray(parsedFileInfo)) {\n      const invalidIndices = new Set(securityResults.errors.map((e) => e.originalIndex));\n      const filteredFileInfo = parsedFileInfo.filter(\n        (_: any, index: number) => !invalidIndices.has(index)\n      );\n\n      if (filteredFileInfo.length === 1) {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo[0],\n        };\n      } else {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo,\n        };\n      }\n    } else {\n      filteredBody = {\n        ...body,\n        fileInfo: parsedFileInfo,\n      };\n    }\n  }\n\n  // Map errors to simplified format\n  const uploadErrors: FileUploadError[] = securityResults.errors.map((e) => ({\n    name: e.file?.originalFilename || e.file?.name || 'unknown',\n    message: e.error.message,\n  }));\n\n  return {\n    validFiles: securityResults.validFiles,\n    filteredBody,\n    errors: uploadErrors,\n  };\n}\n"],"names":["readFileChunk","filePath","chunkSize","file","open","buffer","Buffer","alloc","bytesRead","read","subarray","close","detectMimeType","filepath","path","tempFilePath","error","Error","message","String","length","undefined","fileTypeFromBuffer","result","Uint8Array","mime","matchesMimePattern","mimeType","patterns","some","pattern","normalizedPattern","toLowerCase","normalizedMimeType","includes","regexPattern","replace","regex","RegExp","matches","test","exactMatch","validateAllowBanLists","mimetype","fileName","declaredType","detectedType","config","isValid","code","details","reason","allowedTypes","deniedTypes","buildNotAllowedError","Array","isArray","detectedMime","finalType","isDeclaredGeneric","declaredMimeType","extractFileInfo","originalFilename","name","filename","newFilename","originalname","type","validateFile","strapi","fileExt","extname","expectedMimeFromExt","lookup","errMsg","log","warn","declaredMatchesExtension","detectedMatchesDeclared","isZipWithAllowedExt","isSvgXmlWithAllowedExt","expectedMimeFromExtension","detectedMatchesExtension","extResult","fileExtension","rejectedType","validateFiles","files","filesArray","get","every","item","errors","ApplicationError","validationPromises","map","index","fileIndex","originalError","Promise","all","enforceUploadSecurity","validationResults","validFiles","validFileNames","entries","detectedMimeType","push","originalIndex","prepareUploadRequest","filesInput","body","securityResults","filteredBody","fileInfo","parsedFileInfo","fi","JSON","parse","invalidIndices","Set","e","filteredFileInfo","filter","_","has","uploadErrors"],"mappings":";;;;;AA4BA,eAAeA,aAAAA,CAAcC,QAAgB,EAAEC,SAAAA,GAAoB,IAAI,EAAA;IACrE,MAAMC,IAAAA,GAAO,MAAMC,IAAAA,CAAKH,QAAAA,EAAU,GAAA,CAAA;IAElC,IAAI;QACF,MAAMI,MAAAA,GAASC,MAAAA,CAAOC,KAAK,CAACL,SAAAA,CAAAA;QAC5B,MAAM,EAAEM,SAAS,EAAE,GAAG,MAAML,KAAKM,IAAI,CAACJ,MAAAA,EAAQ,CAAA,EAAGH,SAAAA,EAAW,CAAA,CAAA;QAE5D,OAAOG,MAAAA,CAAOK,QAAQ,CAAC,CAAA,EAAGF,SAAAA,CAAAA;IAC5B,CAAA,QAAU;AACR,QAAA,MAAML,KAAKQ,KAAK,EAAA;AAClB,IAAA;AACF;AAEO,eAAeC,eAAeT,IAAS,EAAA;IAC5C,IAAIE,MAAAA;;IAGJ,MAAMJ,QAAAA,GAAWE,IAAAA,CAAKU,QAAQ,IAAIV,IAAAA,CAAKW,IAAI,IAAIX,IAAAA,CAAKY,YAAY,IAAIZ,IAAAA,CAAKF,QAAQ;AAEjF,IAAA,IAAIA,QAAAA,EAAU;QACZ,IAAI;YACFI,MAAAA,GAAS,MAAML,cAAcC,QAAAA,EAAU,IAAA,CAAA;AACzC,QAAA,CAAA,CAAE,OAAOe,KAAAA,EAAO;YACd,MAAM,IAAIC,KAAAA,CACR,CAAC,qBAAqB,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAEpF,QAAA;IACF,CAAA,MAAO,IAAIb,IAAAA,CAAKE,MAAM,EAAE;AACtBA,QAAAA,MAAAA,GAASF,IAAAA,CAAKE,MAAM,CAACe,MAAM,GAAG,IAAA,GAAOjB,IAAAA,CAAKE,MAAM,CAACK,QAAQ,CAAC,CAAA,EAAG,IAAA,CAAA,GAAQP,KAAKE,MAAM;IAClF,CAAA,MAAO;;QAEL,OAAOgB,SAAAA;AACT,IAAA;IAEA,IAAI;AACF;;;;AAIC,QACD,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAM,OAAO,WAAA,CAAA;AAE5C,QAAA,MAAMC,MAAAA,GAAS,MAAMD,kBAAAA,CAAmB,IAAIE,UAAAA,CAAWnB,MAAAA,CAAAA,CAAAA;AACvD,QAAA,OAAOkB,MAAAA,EAAQE,IAAAA;AACjB,IAAA,CAAA,CAAE,OAAOT,KAAAA,EAAO;QACd,MAAM,IAAIC,KAAAA,CACR,CAAC,4BAA4B,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAE3F,IAAA;AACF;AAEA,SAASU,kBAAAA,CAAmBC,QAAgB,EAAEC,QAAkB,EAAA;IAC9D,IAAI,CAACA,QAAAA,EAAUR,MAAAA,EAAQ,OAAO,KAAA;IAE9B,OAAOQ,QAAAA,CAASC,IAAI,CAAC,CAACC,OAAAA,GAAAA;QACpB,MAAMC,iBAAAA,GAAoBD,QAAQE,WAAW,EAAA;QAC7C,MAAMC,kBAAAA,GAAqBN,SAASK,WAAW,EAAA;QAE/C,IAAID,iBAAAA,CAAkBG,QAAQ,CAAC,GAAA,CAAA,EAAM;AACnC,YAAA,MAAMC,YAAAA,GAAeJ,iBAAAA,CAAkBK,OAAO,CAAC,KAAA,EAAO,IAAA,CAAA;YAEtD,MAAMC,KAAAA,GAAQ,IAAIC,MAAAA,CAAO,CAAC,CAAC,EAAEH,YAAAA,CAAa,CAAC,CAAC,CAAA;YAC5C,MAAMI,OAAAA,GAAUF,KAAAA,CAAMG,IAAI,CAACP,kBAAAA,CAAAA;YAC3B,OAAOM,OAAAA;AACT,QAAA;AAEA,QAAA,MAAME,aAAaV,iBAAAA,KAAsBE,kBAAAA;QACzC,OAAOQ,UAAAA;AACT,IAAA,CAAA,CAAA;AACF;AAkBA;;;IAIA,SAASC,qBAAAA,CACPC,QAAgB,EAChBC,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCC,MAAsB,EAAA;AAEtB,IAAA,IAAI,CAACJ,QAAAA,EAAU;QACb,OAAO;YACLK,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,0BAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;IACA,IAAIN,MAAAA,CAAOM,WAAW,EAAEjC,MAAAA,IAAUM,mBAAmBiB,QAAAA,EAAUI,MAAAA,CAAOM,WAAW,CAAA,EAAG;AAClF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUC,YAAAA,EAAcC,YAAAA,EAAcH,QAAAA,EAAUI,MAAAA,CAAAA;AAC9E,IAAA;AACA,IAAA,IAAI,CAACQ,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACvC,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;AACA,IAAA,IAAII,MAAAA,CAAOK,YAAY,CAAChC,MAAM,KAAK,CAAA,EAAG;QACpC,OAAO;YACL4B,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,qBAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;AACA,IAAA,IAAI3B,kBAAAA,CAAmBiB,QAAAA,EAAUI,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACrD,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;IACA,OAAO;QACLK,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEyB,QAAAA,CAAS,gBAAgB,CAAC;YACjDO,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAWf,QAAAA;AACXS,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,KAAA;AACF;AAEA,SAASM,kBAAkBC,gBAAwB,EAAA;IACjD,OAAO,CAACA,oBAAoBA,gBAAAA,KAAqB,0BAAA;AACnD;AAEO,SAASC,gBAAgB1D,IAAS,EAAA;AACvC,IAAA,MAAMyC,QAAAA,GACJzC,IAAAA,CAAK2D,gBAAgB,IACrB3D,KAAK4D,IAAI,IACT5D,IAAAA,CAAK6D,QAAQ,IACb7D,IAAAA,CAAK8D,WAAW,IAChB9D,IAAAA,CAAK+D,YAAY,IACjB,SAAA;AACF,IAAA,MAAMN,gBAAAA,GAAmBzD,IAAAA,CAAKwC,QAAQ,IAAIxC,IAAAA,CAAKgE,IAAI,IAAIhE,IAAAA,CAAKwB,QAAQ,IAAIxB,IAAAA,CAAKsB,IAAI,IAAI,EAAA;IAErF,OAAO;AAAEmB,QAAAA,QAAAA;AAAUgB,QAAAA;AAAiB,KAAA;AACtC;AAEO,eAAeQ,YAAAA,CACpBjE,IAAS,EACT4C,MAAsB,EACtBsB,MAAmB,EAAA;AAEnB,IAAA,MAAM,EAAEjB,YAAY,EAAEC,WAAW,EAAE,GAAGN,MAAAA;AAEtC,IAAA,MAAM,EAAEH,QAAQ,EAAEgB,gBAAgB,EAAE,GAAGC,eAAAA,CAAgB1D,IAAAA,CAAAA;IAEvD,MAAMmE,OAAAA,GAAUC,OAAAA,CAAQ3B,QAAAA,CAAAA,CAAUZ,WAAW,EAAA;AAC7C,IAAA,MAAMwC,mBAAAA,GAAsBF,OAAAA,GAAUG,MAAAA,CAAOH,OAAAA,CAAAA,IAAY,IAAA,GAAO,IAAA;;AAGhE,IAAA,IACE,CAACX,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBP,aAAajC,MAAAA,IACbM,kBAAAA,CAAmBkC,kBAAkBP,WAAAA,CAAAA,EACrC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWuC,gBAAAA,EAAkBb,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IACEyB,mBAAAA,IACAnB,WAAAA,EAAajC,MAAAA,IACbM,kBAAAA,CAAmB8C,qBAAqBnB,WAAAA,CAAAA,EACxC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWmD,mBAAAA,EAAqBzB,MAAAA,CAAAA;AAC1F,IAAA;;IAGA,IAAIU,YAAAA;IACJ,IAAI;AACFA,QAAAA,YAAAA,GAAe,MAAM7C,cAAAA,CAAeT,IAAAA,CAAAA;AACtC,IAAA,CAAA,CAAE,OAAOa,KAAAA,EAAO;AACd,QAAA,MAAM0D,SAAS1D,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA;QAC/DqD,MAAAA,CAAOM,GAAG,CAACC,IAAI,CAAC,CAAC,sCAAsC,EAAEF,QAAQ,EAAE;AACjE9B,YAAAA,QAAAA;YACA5B,KAAAA,EAAO0D;AACT,SAAA,CAAA;AACF,IAAA;IAEA,MAAMG,wBAAAA,GACJ,CAAClB,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBY,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,KACvBK,kBAAAA,CAAmBkC,gBAAAA,EAAkB;AAACY,QAAAA;AAAoB,KAAA,CAAA,IACzD9C,mBAAmB8C,mBAAAA,EAAqB;AAACZ,QAAAA;KAAiB,CAAA,CAAA;AAC9D,IAAA,MAAMkB,uBAAAA,GACJrB,YAAAA,IAAgBG,gBAAAA,IAAoBlC,kBAAAA,CAAmB+B,YAAAA,EAAc;AAACG,QAAAA;AAAiB,KAAA,CAAA;;AAGzF,IAAA,IAAIiB,4BAA4BC,uBAAAA,EAAyB;AACvD,QAAA,OAAOpC,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIU,YAAAA,IAAgBJ,WAAAA,EAAajC,MAAAA,IAAUM,kBAAAA,CAAmB+B,cAAcJ,WAAAA,CAAAA,EAAc;AACxF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcA,YAAAA,EAAcV,MAAAA,CAAAA;AACtF,IAAA;;;AAIA,IAAA,MAAMgC,mBAAAA,GACJtB,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,wBAAwB,iBAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;;AAE1C,IAAA,MAAM4B,yBACJvB,YAAAA,KAAiB,iBAAA,IACjBa,OAAAA,KAAY,MAAA,IACZE,wBAAwB,eAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;AAC1C,IAAA,IACEK,gBACAF,KAAAA,CAAMC,OAAO,CAACJ,YAAAA,CAAAA,IACdA,aAAahC,MAAM,GAAG,CAAA,IACtB,CAACM,mBAAmB+B,YAAAA,EAAcL,YAAAA,CAAAA,IAClC,CAAC2B,mBAAAA,IACD,CAACC,sBAAAA,EACD;QACA,OAAO;YACLhC,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EACE,uGAAA;oBACFN,YAAAA,EAAce,gBAAAA;oBACdd,YAAAA,EAAcW,YAAAA;oBACdwB,yBAAAA,EAA2BT,mBAAAA;AAC3BpB,oBAAAA,YAAAA;AACAC,oBAAAA;AACF;AACF;AACF,SAAA;AACF,IAAA;;AAGA,IAAA,MAAM6B,2BACJzB,YAAAA,IACAe,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,IACxBK,mBAAmB+B,YAAAA,EAAc;AAACe,QAAAA;AAAoB,KAAA,CAAA;AACxD,IAAA,IACEf,iBACC,CAACe,uBAAuBU,wBAAAA,IAA4BvB,iBAAAA,CAAkBC,iBAAgB,CAAA,EACvF;;AAEA,QAAA,IACEH,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,mBAAAA,KAAwB,iBAAA,EACxB;AACA,YAAA,MAAMW,SAAAA,GAAYzC,qBAAAA,CAChB8B,mBAAAA,EACA5B,QAAAA,EACAgB,kBACAH,YAAAA,EACAV,MAAAA,CAAAA;YAEF,IAAIoC,SAAAA,CAAUnC,OAAO,EAAE;AACrBqB,gBAAAA,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,iFAAA,EACA;AAAEhC,oBAAAA,QAAAA;oBAAUwC,aAAAA,EAAed,OAAAA;oBAASW,yBAAAA,EAA2BT;AAAoB,iBAAA,CAAA;gBAErF,OAAOW,SAAAA;AACT,YAAA;AACF,QAAA;AACA,QAAA,OAAOzC,qBAAAA,CAAsBe,YAAAA,EAAcb,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcV,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IAAIyB,mBAAAA,EAAqB;AACvB,QAAA,OAAO9B,qBAAAA,CACL8B,mBAAAA,EACA5B,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIa,gBAAAA,EAAkB;AACpB,QAAA,OAAOlB,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;IAGA,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;YACN/B,OAAAA,EAAS,8CAAA;YACTgC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;gBACAO,MAAAA,EAAQ,yEAAA;gBACRN,YAAAA,EAAce,gBAAAA;gBACdd,YAAAA,EAAcW,YAAAA;AACdL,gBAAAA,YAAAA;AACAC,gBAAAA;AACF;AACF;AACF,KAAA;AACF;AAEA,SAASC,oBAAAA,CACPV,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCuC,YAAoB,EACpBtC,MAAsB,EAAA;IAEtB,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEmE,YAAAA,CAAa,gBAAgB,CAAC;YACrDnC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAW2B,YAAAA;AACXjC,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM,WAAW;gBAC/BF,MAAAA,EAAQ;AACV;AACF;AACF,KAAA;AACF;AAEO,eAAemC,aAAAA,CAAcC,KAAU,EAAElB,MAAmB,EAAA;AACjE,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;IAEzD,IAAI,CAACC,UAAAA,CAAWpE,MAAM,EAAE;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;;AAGA,IAAA,IAAI2B,MAAAA,GAAyBsB,MAAAA,CAAOtB,MAAM,CAAC0C,GAAG,CAC5C;AAAC,QAAA,gBAAA;AAAkB,QAAA;AAAW,KAAA,EAC9B,EAAC,CAAA;AAEH,IAAA,IAAI,CAAC1C,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAA,EAAU;AACzCA,QAAAA,MAAAA,GAAS,EAAC;AACZ,IAAA;IACA,IACEA,MAAAA,CAAOK,YAAY,KAClB,CAACG,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,IACjC,CAACL,MAAAA,CAAOK,YAAY,CAACsC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC/D;QACA,MAAM,IAAIC,MAAAA,CAAOC,gBAAgB,CAC/B,kEAAA,CAAA;AAEJ,IAAA;IAEA,IACE9C,MAAAA,CAAOM,WAAW,KACjB,CAACE,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOM,WAAW,CAAA,IAChC,CAACN,MAAAA,CAAOM,WAAW,CAACqC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC9D;QACA,MAAM,IAAIC,MAAAA,CAAOC,gBAAgB,CAC/B,iEAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAI,CAAC9C,MAAAA,CAAOK,YAAY,IAAI,CAACL,MAAAA,CAAOM,WAAW,EAAE;QAC/CgB,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,mHAAA,CAAA;;AAGJ,IAAA;AAEA,IAAA,MAAMkB,kBAAAA,GAAqBN,UAAAA,CAAWO,GAAG,CAAC,OAAO5F,IAAAA,EAAM6F,KAAAA,GAAAA;QACrD,IAAI;YACF,OAAO,MAAM5B,YAAAA,CAAajE,IAAAA,EAAM4C,MAAAA,EAAQsB,MAAAA,CAAAA;AAC1C,QAAA,CAAA,CAAE,OAAOrD,KAAAA,EAAO;AACdqD,YAAAA,MAAAA,CAAOM,GAAG,CAAC3D,KAAK,CAAC,yCAAA,EAA2C;gBAC1DiF,SAAAA,EAAWD,KAAAA;gBACXpD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BlD,gBAAAA,KAAAA,EAAOA,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACzD,aAAA,CAAA;YAEA,OAAO;gBACLgC,OAAAA,EAAS,KAAA;gBACThC,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,kBAAA;oBACN/B,OAAAA,EAAS,CAAC,oCAAoC,EAAE8E,KAAAA,CAAAA,CAAO;oBACvD9C,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BgC,wBAAAA,aAAAA,EAAelF,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACjE;AACF;AACF,aAAA;AACF,QAAA;AACF,IAAA,CAAA,CAAA;IAEA,OAAOmF,OAAAA,CAAQC,GAAG,CAACN,kBAAAA,CAAAA;AACrB;AAEO,eAAeO,qBAAAA,CACpBd,KAAU,EACVlB,MAAmB,EAAA;IAMnB,MAAMiC,iBAAAA,GAAoB,MAAMhB,aAAAA,CAAcC,KAAAA,EAAOlB,MAAAA,CAAAA;AACrD,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;AAEzD,IAAA,MAAMgB,aAAoB,EAAE;AAC5B,IAAA,MAAMC,iBAA2B,EAAE;AACnC,IAAA,MAAMZ,SAA6B,EAAE;AAErC,IAAA,KAAK,MAAM,CAACI,KAAAA,EAAOzE,OAAO,IAAI+E,iBAAAA,CAAkBG,OAAO,EAAA,CAAI;QACzD,IAAIlF,MAAAA,CAAOyB,OAAO,EAAE;YAClB,MAAM7C,IAAAA,GAAOqF,UAAU,CAACQ,KAAAA,CAAM;;YAE9B,IAAIzE,MAAAA,CAAOkC,YAAY,EAAE;gBACvBtD,IAAAA,CAAKuG,gBAAgB,GAAGnF,MAAAA,CAAOkC,YAAY;AAC7C,YAAA;AACA8C,YAAAA,UAAAA,CAAWI,IAAI,CAACxG,IAAAA,CAAAA;AAChBqG,YAAAA,cAAAA,CAAeG,IAAI,CAACxG,IAAAA,CAAK2D,gBAAgB,IAAI3D,KAAK4D,IAAI,CAAA;QACxD,CAAA,MAAO,IAAIxC,MAAAA,CAAOP,KAAK,EAAE;AACvB4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;AACfhF,gBAAAA,KAAAA,EAAOO,OAAOP;AAChB,aAAA,CAAA;QACF,CAAA,MAAO;;AAEL4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;gBACfhF,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,eAAA;oBACN/B,OAAAA,EAAS,2CAAA;oBACTgC,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAU4C,UAAU,CAACQ,KAAAA,CAAM,EAAEjC,QAAQyB,UAAU,CAACQ,MAAM,EAAE9B;AAC1D;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;IAEA,OAAO;AAAEqC,QAAAA,UAAAA;AAAYC,QAAAA,cAAAA;AAAgBZ,QAAAA;AAAO,KAAA;AAC9C;AAaA;;AAEC,IACM,eAAeiB,oBAAAA,CACpBC,UAAe,EACfC,IAAS,EACT1C,MAAmB,EAAA;IAEnB,MAAM2C,eAAAA,GAAkB,MAAMX,qBAAAA,CAAsBS,UAAAA,EAAYzC,MAAAA,CAAAA;AAEhE,IAAA,IAAI4C,YAAAA,GAAeF,IAAAA;AACnB,IAAA,IAAIA,MAAMG,QAAAA,EAAU;;QAElB,IAAIC,cAAAA,GAAiBJ,KAAKG,QAAQ;AAClC,QAAA,IAAI3D,KAAAA,CAAMC,OAAO,CAACuD,IAAAA,CAAKG,QAAQ,CAAA,EAAG;AAChCC,YAAAA,cAAAA,GAAiBJ,IAAAA,CAAKG,QAAQ,CAACnB,GAAG,CAAC,CAACqB,EAAAA,GAClC,OAAOA,EAAAA,KAAO,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,EAAAA,CAAAA,GAAMA,EAAAA,CAAAA;AAE9C,QAAA,CAAA,MAAO,IAAI,OAAOL,IAAAA,CAAKG,QAAQ,KAAK,QAAA,EAAU;AAC5CC,YAAAA,cAAAA,GAAiBE,IAAAA,CAAKC,KAAK,CAACP,IAAAA,CAAKG,QAAQ,CAAA;AAC3C,QAAA;;QAGA,IAAI3D,KAAAA,CAAMC,OAAO,CAAC2D,cAAAA,CAAAA,EAAiB;YACjC,MAAMI,cAAAA,GAAiB,IAAIC,GAAAA,CAAIR,eAAAA,CAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,CAAAA,GAAMA,CAAAA,CAAEb,aAAa,CAAA,CAAA;YAChF,MAAMc,gBAAAA,GAAmBP,cAAAA,CAAeQ,MAAM,CAC5C,CAACC,GAAQ5B,KAAAA,GAAkB,CAACuB,cAAAA,CAAeM,GAAG,CAAC7B,KAAAA,CAAAA,CAAAA;YAGjD,IAAI0B,gBAAAA,CAAiBtG,MAAM,KAAK,CAAA,EAAG;gBACjC6F,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ,gBAAgB,CAAC,CAAA;AAC7B,iBAAA;YACF,CAAA,MAAO;gBACLT,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ;AACZ,iBAAA;AACF,YAAA;QACF,CAAA,MAAO;YACLT,YAAAA,GAAe;AACb,gBAAA,GAAGF,IAAI;gBACPG,QAAAA,EAAUC;AACZ,aAAA;AACF,QAAA;AACF,IAAA;;IAGA,MAAMW,YAAAA,GAAkCd,gBAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,KAAO;AACzE1D,YAAAA,IAAAA,EAAM0D,EAAEtH,IAAI,EAAE2D,oBAAoB2D,CAAAA,CAAEtH,IAAI,EAAE4D,IAAAA,IAAQ,SAAA;YAClD7C,OAAAA,EAASuG,CAAAA,CAAEzG,KAAK,CAACE;SACnB,CAAA,CAAA;IAEA,OAAO;AACLqF,QAAAA,UAAAA,EAAYS,gBAAgBT,UAAU;AACtCU,QAAAA,YAAAA;QACArB,MAAAA,EAAQkC;AACV,KAAA;AACF;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/upload",
-  "version": "5.57.0",
+  "version": "5.58.0",
   "description": "Makes it easy to upload images and files to your Strapi Application.",
   "homepage": "https://strapi.io",
   "bugs": {
@@ -75,11 +75,11 @@
     "@radix-ui/react-dialog": "1.0.5",
     "@radix-ui/react-toggle-group": "1.1.11",
     "@reduxjs/toolkit": "1.9.7",
-    "@strapi/database": "5.57.0",
+    "@strapi/database": "5.58.0",
     "@strapi/design-system": "2.2.4",
     "@strapi/icons": "2.2.4",
-    "@strapi/provider-upload-local": "5.57.0",
-    "@strapi/utils": "5.57.0",
+    "@strapi/provider-upload-local": "5.58.0",
+    "@strapi/utils": "5.58.0",
     "byte-size": "8.1.1",
     "cropperjs": "1.6.2",
     "date-fns": "2.30.0",
@@ -98,13 +98,13 @@
     "react-query": "3.39.3",
     "react-redux": "8.1.3",
     "react-select": "5.8.0",
-    "sharp": "0.35.4",
+    "sharp": "0.35.5",
     "yup": "0.32.9",
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@strapi/admin": "5.57.0",
-    "@strapi/types": "5.57.0",
+    "@strapi/admin": "5.58.0",
+    "@strapi/types": "5.58.0",
     "@testing-library/dom": "10.4.1",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.2",