@strapi/utils 5.0.0-rc.21 → 5.0.0-rc.23

package/dist/index.js

@@ -1335,6 +1335,32 @@ const visitor$7 = ({ schema, key, attribute }, { remove }) => {
     remove(key);
   }
 };
+const MANY_RELATIONS = ["oneToMany", "manyToMany"];
+const getRelationalFields = (contentType) => {
+  return Object.keys(contentType.attributes).filter((attributeName) => {
+    return contentType.attributes[attributeName].type === "relation";
+  });
+};
+const isOneToAny = (attribute) => isRelationalAttribute(attribute) && ["oneToOne", "oneToMany"].includes(attribute.relation);
+const isManyToAny = (attribute) => isRelationalAttribute(attribute) && ["manyToMany", "manyToOne"].includes(attribute.relation);
+const isAnyToOne = (attribute) => isRelationalAttribute(attribute) && ["oneToOne", "manyToOne"].includes(attribute.relation);
+const isAnyToMany = (attribute) => isRelationalAttribute(attribute) && ["oneToMany", "manyToMany"].includes(attribute.relation);
+const constants = {
+  MANY_RELATIONS
+};
+const VALID_RELATION_ORDERING_KEYS = {
+  strict: fp.isBoolean
+};
+const relations = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  VALID_RELATION_ORDERING_KEYS,
+  constants,
+  getRelationalFields,
+  isAnyToMany,
+  isAnyToOne,
+  isManyToAny,
+  isOneToAny
+}, Symbol.toStringTag, { value: "Module" }));
 const ACTIONS_TO_VERIFY$1 = ["find"];
 const { CREATED_BY_ATTRIBUTE: CREATED_BY_ATTRIBUTE$1, UPDATED_BY_ATTRIBUTE: UPDATED_BY_ATTRIBUTE$1 } = constants$1;
 const removeRestrictedRelations = (auth) => async ({ data, key, attribute, schema }, { remove, set }) => {
@@ -1346,19 +1372,57 @@ const removeRestrictedRelations = (auth) => async ({ data, key, attribute, schem
     return;
   }
   const handleMorphRelation = async () => {
-    const newMorphValue = [];
-    for (const element of data[key]) {
+    const elements = data[key];
+    if ("connect" in elements || "set" in elements || "disconnect" in elements) {
+      const newValue = {};
+      const connect = await handleMorphElements(elements.connect || []);
+      const relSet = await handleMorphElements(elements.set || []);
+      const disconnect = await handleMorphElements(elements.disconnect || []);
+      if (connect.length > 0) {
+        newValue.connect = connect;
+      }
+      if (relSet.length > 0) {
+        newValue.set = relSet;
+      }
+      if (disconnect.length > 0) {
+        newValue.disconnect = disconnect;
+      }
+      if ("options" in elements && typeof elements.options === "object" && elements.options !== null) {
+        const filteredOptions = {};
+        Object.keys(elements.options).forEach((key2) => {
+          const validator = VALID_RELATION_ORDERING_KEYS[key2];
+          if (validator && validator(elements.options[key2])) {
+            filteredOptions[key2] = elements.options[key2];
+          }
+        });
+        newValue.options = filteredOptions;
+      }
+      set(key, newValue);
+    } else {
+      const newMorphValue = await handleMorphElements(elements);
+      if (newMorphValue.length === 0) {
+        remove(key);
+      } else {
+        set(key, newMorphValue);
+      }
+    }
+  };
+  const handleMorphElements = async (elements) => {
+    const allowedElements = [];
+    if (!fp.isArray(elements)) {
+      return allowedElements;
+    }
+    for (const element of elements) {
+      if (!fp.isObject(element) || !("__type" in element)) {
+        continue;
+      }
       const scopes = ACTIONS_TO_VERIFY$1.map((action) => `${element.__type}.${action}`);
       const isAllowed = await hasAccessToSomeScopes$1(scopes, auth);
       if (isAllowed) {
-        newMorphValue.push(element);
+        allowedElements.push(element);
       }
     }
-    if (newMorphValue.length === 0) {
-      remove(key);
-    } else {
-      set(key, newMorphValue);
-    }
+    return allowedElements;
   };
   const handleRegularRelation = async () => {
     const scopes = ACTIONS_TO_VERIFY$1.map((action) => `${attribute.target}.${action}`);
@@ -2229,7 +2293,40 @@ const throwRestrictedRelations = (auth) => async ({ data, key, attribute, schema
     return;
   }
   const handleMorphRelation = async () => {
-    for (const element of data[key]) {
+    const elements = data[key];
+    if ("connect" in elements || "set" in elements || "disconnect" in elements || "options" in elements) {
+      await handleMorphElements(elements.connect || []);
+      await handleMorphElements(elements.set || []);
+      await handleMorphElements(elements.disconnect || []);
+      if ("options" in elements) {
+        if (elements.options === null || elements.options === void 0) {
+          return;
+        }
+        if (typeof elements.options !== "object") {
+          throwInvalidKey({ key, path: path.attribute });
+        }
+        const optionKeys = Object.keys(elements.options);
+        for (const key2 of optionKeys) {
+          if (!(key2 in VALID_RELATION_ORDERING_KEYS)) {
+            throwInvalidKey({ key: key2, path: path.attribute });
+          }
+          if (!VALID_RELATION_ORDERING_KEYS[key2](elements.options[key2])) {
+            throwInvalidKey({ key: key2, path: path.attribute });
+          }
+        }
+      }
+    } else {
+      await handleMorphElements(elements);
+    }
+  };
+  const handleMorphElements = async (elements) => {
+    if (!fp.isArray(elements)) {
+      throwInvalidKey({ key, path: path.attribute });
+    }
+    for (const element of elements) {
+      if (!fp.isObject(element) || !("__type" in element)) {
+        throwInvalidKey({ key, path: path.attribute });
+      }
       const scopes = ACTIONS_TO_VERIFY.map((action) => `${element.__type}.${action}`);
       const isAllowed = await hasAccessToSomeScopes(scopes, auth);
       if (!isAllowed) {
@@ -3274,28 +3371,6 @@ const yup = /* @__PURE__ */ _mergeNamespaces({
   StrapiIDSchema,
   strapiID
 }, [yup__namespace]);
-const MANY_RELATIONS = ["oneToMany", "manyToMany"];
-const getRelationalFields = (contentType) => {
-  return Object.keys(contentType.attributes).filter((attributeName) => {
-    return contentType.attributes[attributeName].type === "relation";
-  });
-};
-const isOneToAny = (attribute) => isRelationalAttribute(attribute) && ["oneToOne", "oneToMany"].includes(attribute.relation);
-const isManyToAny = (attribute) => isRelationalAttribute(attribute) && ["manyToMany", "manyToOne"].includes(attribute.relation);
-const isAnyToOne = (attribute) => isRelationalAttribute(attribute) && ["oneToOne", "manyToOne"].includes(attribute.relation);
-const isAnyToMany = (attribute) => isRelationalAttribute(attribute) && ["oneToMany", "manyToMany"].includes(attribute.relation);
-const constants = {
-  MANY_RELATIONS
-};
-const relations = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  constants,
-  getRelationalFields,
-  isAnyToMany,
-  isAnyToOne,
-  isManyToAny,
-  isOneToAny
-}, Symbol.toStringTag, { value: "Module" }));
 const validateZod = (schema) => (data) => {
   try {
     return schema.parse(data);