strapi-cms-audit-log 1.1.0

package/dist/server/index.js

@@ -0,0 +1,1856 @@
+"use strict";
+Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
+const node_async_hooks = require("node:async_hooks");
+const PLUGIN_ID = "audit-log";
+const AUDIT_LOG_UID = "plugin::audit-log.audit-log";
+const ALL_ACTIONS = ["create", "update", "delete", "publish", "unpublish"];
+const PERMISSIONS = {
+  read: `plugin::${PLUGIN_ID}.read`,
+  delete: `plugin::${PLUGIN_ID}.delete`,
+  settings: `plugin::${PLUGIN_ID}.settings`
+};
+const DEFAULT_IGNORED_FIELDS = [
+  "*password*",
+  "*passwd*",
+  "*token*",
+  "*secret*",
+  "*apikey*",
+  "*api_key*",
+  "*privatekey*",
+  "*private_key*",
+  "*credential*",
+  "*accesskey*",
+  "salt",
+  "otp",
+  "*totp*"
+];
+const DEFAULT_IGNORED_CHANGE_FIELDS = ["updatedAt", "updatedBy", "createdBy"];
+const SKIPPED_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "id",
+  "documentId",
+  "locale",
+  "publishedAt",
+  "createdBy",
+  "updatedBy"
+]);
+const REQUEST_ID_HEADERS = ["x-request-id", "request-id", "x-correlation-id", "x-amzn-trace-id"];
+const RETENTION_JOB_NAME = "auditLogRetention";
+const CONTENT_ACTIONS = ALL_ACTIONS;
+const ALL_SECURITY_ACTIONS = [
+  "login.success",
+  "login.failed",
+  "logout",
+  "access.denied",
+  "admin.user.create",
+  "admin.user.update",
+  "admin.user.delete",
+  "admin.role.create",
+  "admin.role.update",
+  "admin.role.delete",
+  "admin.permission.create",
+  "admin.permission.update",
+  "admin.permission.delete",
+  "media.create",
+  "media.update",
+  "media.delete",
+  "media-folder.create",
+  "media-folder.update",
+  "media-folder.delete"
+];
+const SUBJECTS = {
+  auth: "admin::auth",
+  access: "admin::access",
+  user: "admin::user",
+  role: "admin::role",
+  permission: "admin::permission",
+  file: "plugin::upload.file",
+  folder: "plugin::upload.folder"
+};
+const SUBJECT_DISPLAY_NAMES = {
+  [SUBJECTS.auth]: "Authentication",
+  [SUBJECTS.access]: "Access control",
+  [SUBJECTS.user]: "Admin user",
+  [SUBJECTS.role]: "Admin role",
+  [SUBJECTS.permission]: "Permission",
+  [SUBJECTS.file]: "Media file",
+  [SUBJECTS.folder]: "Media folder"
+};
+const SECURITY_EVENT_MAP = {
+  "admin.auth.success": { action: "login.success", subject: SUBJECTS.auth },
+  "admin.auth.error": { action: "login.failed", subject: SUBJECTS.auth },
+  "admin.logout": { action: "logout", subject: SUBJECTS.auth },
+  "user.create": { action: "admin.user.create", subject: SUBJECTS.user },
+  "user.update": { action: "admin.user.update", subject: SUBJECTS.user },
+  "user.delete": { action: "admin.user.delete", subject: SUBJECTS.user },
+  "role.create": { action: "admin.role.create", subject: SUBJECTS.role },
+  "role.update": { action: "admin.role.update", subject: SUBJECTS.role },
+  "role.delete": { action: "admin.role.delete", subject: SUBJECTS.role },
+  "permission.create": { action: "admin.permission.create", subject: SUBJECTS.permission },
+  "permission.update": { action: "admin.permission.update", subject: SUBJECTS.permission },
+  "permission.delete": { action: "admin.permission.delete", subject: SUBJECTS.permission },
+  "media.create": { action: "media.create", subject: SUBJECTS.file },
+  "media.update": { action: "media.update", subject: SUBJECTS.file },
+  "media.delete": { action: "media.delete", subject: SUBJECTS.file },
+  "media-folder.create": { action: "media-folder.create", subject: SUBJECTS.folder },
+  "media-folder.update": { action: "media-folder.update", subject: SUBJECTS.folder },
+  "media-folder.delete": { action: "media-folder.delete", subject: SUBJECTS.folder }
+};
+const ALL_SOURCES = ["admin", "api", "system", "cron", "migration", "unknown"];
+const DENIED_STATUSES = /* @__PURE__ */ new Set([401, 403]);
+const ACCESS_IGNORED_PATHS = [
+  /^\/admin\/login(\/|$)/,
+  /^\/admin\/renew-token(\/|$)/,
+  /^\/admin\/refresh-token(\/|$)/,
+  /^\/api\/auth\/local(\/|$)/
+];
+const bootstrap = ({ strapi }) => {
+  const plugin = strapi.plugin(PLUGIN_ID);
+  const config2 = plugin.service("config").resolve();
+  plugin.service("immutability").register();
+  plugin.service("tracker").register();
+  plugin.service("security").register();
+  plugin.service("retention").register();
+  const scope = config2.contentTypes === "*" ? "all content types" : `${config2.contentTypes.length} content type(s)`;
+  strapi.log.info(
+    `[audit-log] tracking ${config2.actions.join(", ")} on ${scope}` + (config2.ignoredContentTypes.length > 0 ? ` (${config2.ignoredContentTypes.length} ignored)` : "") + `; writes are ${config2.writeMode}.`
+  );
+  if (config2.forwardToLogger) {
+    strapi.log.info(
+      `[audit-log] mirroring every record to the logger at level "${config2.forwardLogLevel}" for downstream collection.`
+    );
+  }
+};
+const config = {
+  default: {
+    enabled: true,
+    actions: null,
+    contentTypes: null,
+    ignoredContentTypes: null,
+    ignoredFields: null,
+    additionalIgnoredFields: null,
+    ignoredChangeFields: null,
+    storeBefore: true,
+    storeAfter: true,
+    storeChanges: true,
+    retentionDays: 365,
+    retentionCron: "0 3 * * *",
+    failOnAuditError: false,
+    writeMode: "sync",
+    maxPopulateDepth: 2,
+    maxSnapshotBytes: 512 * 1024,
+    auditSystemOperations: true,
+    // `null` for the same reason every other collection-valued option is null —
+    // see the note above on `defaultsDeep` splicing arrays element-wise.
+    securityEvents: null,
+    forwardToLogger: false,
+    forwardLogLevel: "info"
+  },
+  /**
+   * Runs once at boot, before anything else touches the config. Throwing here
+   * fails startup with a clear message, which is far kinder than a plugin that
+   * silently audits nothing because of a typo.
+   */
+  validator(config2) {
+    const fail = (message) => {
+      throw new Error(message);
+    };
+    if (config2.actions != null) {
+      if (!Array.isArray(config2.actions)) {
+        fail(`"actions" must be an array, received ${typeof config2.actions}`);
+      }
+      for (const action of config2.actions) {
+        if (!ALL_ACTIONS.includes(action)) {
+          fail(`"actions" contains an unknown action "${action}". Allowed: ${ALL_ACTIONS.join(", ")}`);
+        }
+      }
+    }
+    if (config2.contentTypes != null && config2.contentTypes !== "*" && !Array.isArray(config2.contentTypes)) {
+      fail('"contentTypes" must be "*" or an array of content-type uids');
+    }
+    for (const key of [
+      "ignoredContentTypes",
+      "ignoredFields",
+      "additionalIgnoredFields",
+      "ignoredChangeFields"
+    ]) {
+      const value = config2[key];
+      if (value != null && !Array.isArray(value)) {
+        fail(`"${key}" must be an array of strings`);
+      }
+    }
+    for (const key of ["storeBefore", "storeAfter", "storeChanges", "failOnAuditError", "auditSystemOperations"]) {
+      const value = config2[key];
+      if (value != null && typeof value !== "boolean") {
+        fail(`"${key}" must be a boolean`);
+      }
+    }
+    if (config2.retentionDays != null) {
+      if (typeof config2.retentionDays !== "number" || !Number.isFinite(config2.retentionDays) || config2.retentionDays < 0) {
+        fail('"retentionDays" must be a number >= 0 (0 disables automatic deletion)');
+      }
+    }
+    if (config2.writeMode != null && config2.writeMode !== "sync" && config2.writeMode !== "async") {
+      fail('"writeMode" must be either "sync" or "async"');
+    }
+    if (config2.securityEvents != null && config2.securityEvents !== "*") {
+      if (!Array.isArray(config2.securityEvents)) {
+        fail('"securityEvents" must be "*" or an array of security event names');
+      }
+      for (const event of config2.securityEvents) {
+        if (!ALL_SECURITY_ACTIONS.includes(event)) {
+          fail(
+            `"securityEvents" contains an unknown event "${event}". Allowed: ${ALL_SECURITY_ACTIONS.join(", ")}`
+          );
+        }
+      }
+    }
+    if (config2.forwardToLogger != null && typeof config2.forwardToLogger !== "boolean") {
+      fail('"forwardToLogger" must be a boolean');
+    }
+    if (config2.forwardLogLevel != null && !["debug", "info", "warn", "error"].includes(config2.forwardLogLevel)) {
+      fail('"forwardLogLevel" must be one of: debug, info, warn, error');
+    }
+    if (config2.maxPopulateDepth != null) {
+      if (typeof config2.maxPopulateDepth !== "number" || config2.maxPopulateDepth < 0 || config2.maxPopulateDepth > 5) {
+        fail('"maxPopulateDepth" must be a number between 0 and 5');
+      }
+    }
+    if (config2.maxSnapshotBytes != null) {
+      if (typeof config2.maxSnapshotBytes !== "number" || config2.maxSnapshotBytes < 0) {
+        fail('"maxSnapshotBytes" must be a number >= 0 (0 disables the cap)');
+      }
+    }
+  }
+};
+const schema = {
+  kind: "collectionType",
+  collectionName: "audit_logs",
+  info: {
+    singularName: "audit-log",
+    pluralName: "audit-logs",
+    displayName: "Audit Log",
+    description: "Immutable record of a content operation or a security event."
+  },
+  options: {
+    draftAndPublish: false
+  },
+  pluginOptions: {
+    "content-manager": { visible: false },
+    "content-type-builder": { visible: false }
+  },
+  attributes: {
+    action: { type: "string", required: true },
+    /** UID of the audited content type, e.g. `api::page.page`. */
+    contentType: { type: "string", required: true },
+    /** Display name at write time, so the log stays readable if the type is renamed or removed. */
+    contentTypeDisplayName: { type: "string" },
+    /**
+     * The audited document's Strapi v5 document id.
+     *
+     * NOT named `documentId`. Strapi reserves that attribute name on every
+     * content type — `transformContentTypesToModels` throws
+     * "The attribute "documentId" is reserved" at boot — because it injects its
+     * own `documentId` column into every collection type. Each audit row
+     * therefore still *has* a framework `documentId` (its own identity); this
+     * column is the id of the document the row is *about*.
+     */
+    contentDocumentId: { type: "string" },
+    /** The audited entry's numeric database id, stored as a string. */
+    contentId: { type: "string" },
+    locale: { type: "string" },
+    /** Actor identity, snapshotted so the record survives the user being renamed or deleted. */
+    userId: { type: "string" },
+    userEmail: { type: "string" },
+    userName: { type: "string" },
+    /** Field-level diff, keyed by dotted path. */
+    changes: { type: "json" },
+    before: { type: "json" },
+    after: { type: "json" },
+    /**
+     * Whether the recorded attempt succeeded.
+     *
+     * Always `success` for a content write — the tracker runs after the
+     * operation resolved, so a save that threw produces no row at all. The
+     * column earns its place on the security side, where `login.failed` and
+     * `access.denied` are exactly the rows a reviewer opens the log to find, and
+     * where "show me every failure" has to be an indexed query rather than a
+     * scan against a hard-coded list of action names.
+     */
+    outcome: { type: "string" },
+    /**
+     * Action-specific detail: the reason a login was refused, the method and
+     * path of a denied request, the filename of an upload.
+     *
+     * A loose JSON bag rather than a column each, because the useful fields
+     * differ per action and none of them is ever filtered or sorted on. Anything
+     * that needs to be queryable gets a real column instead.
+     */
+    metadata: { type: "json" },
+    ipAddress: { type: "string" },
+    userAgent: { type: "text" },
+    source: { type: "string" },
+    requestId: { type: "string" }
+  },
+  /**
+   * Secondary indexes, declared here so Strapi's schema sync owns them and they
+   * are created on every supported database without hand-written DDL.
+   *
+   * Columns are DB column names (snake_cased attribute names), and names are
+   * kept short enough for PostgreSQL's 63-character identifier limit.
+   *
+   * `audit_logs_ct_created_idx` is composite and leading-column ordered for the
+   * admin list's default query — filter by content type, sort by date — which is
+   * the only query that runs on every page load.
+   */
+  indexes: [
+    { name: "audit_logs_created_idx", columns: ["created_at"] },
+    { name: "audit_logs_ct_created_idx", columns: ["content_type", "created_at"] },
+    { name: "audit_logs_doc_idx", columns: ["content_document_id"] },
+    { name: "audit_logs_action_idx", columns: ["action"] },
+    { name: "audit_logs_user_idx", columns: ["user_id"] },
+    { name: "audit_logs_locale_idx", columns: ["locale"] },
+    { name: "audit_logs_outcome_idx", columns: ["outcome"] }
+  ]
+};
+const auditLog = { schema };
+const contentTypes = {
+  "audit-log": auditLog
+};
+const ALLOWED_QUERY_KEYS = [
+  "page",
+  "pageSize",
+  "sort",
+  "action",
+  "contentType",
+  "userId",
+  "locale",
+  "source",
+  "outcome",
+  "contentDocumentId",
+  "dateFrom",
+  "dateTo",
+  "_q"
+];
+const MAX_STRING_FILTER_LENGTH = 256;
+const asFilterValue = (value) => {
+  if (value === void 0 || value === null) return void 0;
+  if (Array.isArray(value)) {
+    const items = value.filter((item) => typeof item === "string" || typeof item === "number").map((item) => String(item).slice(0, MAX_STRING_FILTER_LENGTH));
+    return items.length > 0 ? items : void 0;
+  }
+  if (typeof value === "object") return void 0;
+  const text = String(value).slice(0, MAX_STRING_FILTER_LENGTH);
+  return text.length > 0 ? text : void 0;
+};
+const parseId = (raw) => {
+  if (raw === void 0) return null;
+  const id = Number(raw);
+  if (!Number.isInteger(id) || id < 1 || id > Number.MAX_SAFE_INTEGER) return null;
+  return id;
+};
+const auditLogController = ({ strapi }) => {
+  const service = (name) => strapi.plugin("audit-log").service(name);
+  return {
+    async find(ctx) {
+      const query = {};
+      for (const key of ALLOWED_QUERY_KEYS) {
+        const value = asFilterValue(ctx.query[key]);
+        if (value === void 0) continue;
+        if (key === "page" || key === "pageSize") {
+          const parsed = Number(Array.isArray(value) ? value[0] : value);
+          if (Number.isFinite(parsed)) query[key] = parsed;
+          continue;
+        }
+        if (key === "sort" || key === "contentDocumentId" || key === "dateFrom" || key === "dateTo" || key === "_q") {
+          query[key] = Array.isArray(value) ? value[0] : value;
+          continue;
+        }
+        query[key] = value;
+      }
+      ctx.body = await service("audit").find(query);
+    },
+    async findOne(ctx) {
+      const id = parseId(ctx.params.id);
+      if (id === null) return ctx.badRequest("Invalid audit log id.");
+      const log = await service("audit").findOne(id);
+      if (!log) return ctx.notFound("Audit log not found.");
+      ctx.body = { data: log };
+    },
+    async delete(ctx) {
+      const id = parseId(ctx.params.id);
+      if (id === null) return ctx.badRequest("Invalid audit log id.");
+      const deleted = await service("audit").deleteOne(id);
+      if (!deleted) return ctx.notFound("Audit log not found.");
+      strapi.log.info(
+        `[audit-log] record #${id} deleted by ${service("context").resolve().userEmail ?? "an admin user"}.`
+      );
+      ctx.body = { data: deleted };
+    },
+    /** Filter dropdown options, derived from the rows that actually exist. */
+    async filters(ctx) {
+      ctx.body = { data: await service("audit").getFilterOptions() };
+    },
+    /** The effective configuration, so the UI can hide controls for disabled features. */
+    async config(ctx) {
+      ctx.body = { data: service("config").getPublicConfig() };
+    }
+  };
+};
+const controllers = {
+  "audit-log": auditLogController
+};
+const destroy = async ({ strapi }) => {
+  const plugin = strapi.plugin(PLUGIN_ID);
+  try {
+    plugin.service("security").unregister();
+  } catch (error) {
+    strapi.log.debug(`[audit-log] security listener teardown: ${error?.message ?? error}`);
+  }
+  try {
+    plugin.service("retention").unregister();
+  } catch (error) {
+    strapi.log.debug(`[audit-log] retention teardown: ${error?.message ?? error}`);
+  }
+  try {
+    await plugin.service("audit").flush();
+  } catch (error) {
+    strapi.log.error(`[audit-log] failed to flush pending writes: ${error?.message ?? error}`);
+  }
+};
+const ACTIONS = [
+  {
+    section: "plugins",
+    displayName: "Read audit logs",
+    uid: "read",
+    pluginName: PLUGIN_ID
+  },
+  {
+    section: "plugins",
+    displayName: "Delete audit logs",
+    uid: "delete",
+    pluginName: PLUGIN_ID
+  },
+  {
+    section: "plugins",
+    displayName: "Read audit log settings",
+    uid: "settings",
+    pluginName: PLUGIN_ID
+  }
+];
+const register = async ({ strapi }) => {
+  await strapi.service("admin::permission").actionProvider.registerMany(ACTIONS);
+  strapi.plugin(PLUGIN_ID).service("access").register();
+};
+const protectedBy = (action) => ({
+  policies: [
+    "admin::isAuthenticatedAdmin",
+    { name: "admin::hasPermissions", config: { actions: [action] } }
+  ]
+});
+const admin = {
+  type: "admin",
+  routes: [
+    {
+      method: "GET",
+      path: "/logs",
+      handler: "audit-log.find",
+      config: protectedBy(PERMISSIONS.read)
+    },
+    {
+      method: "GET",
+      path: "/filters",
+      handler: "audit-log.filters",
+      config: protectedBy(PERMISSIONS.read)
+    },
+    {
+      method: "GET",
+      path: "/config",
+      handler: "audit-log.config",
+      config: protectedBy(PERMISSIONS.read)
+    },
+    {
+      // Declared after the two static paths above so `/logs/filters` can never
+      // be swallowed by `:id`.
+      method: "GET",
+      path: "/logs/:id",
+      handler: "audit-log.findOne",
+      config: protectedBy(PERMISSIONS.read)
+    },
+    {
+      method: "DELETE",
+      path: "/logs/:id",
+      handler: "audit-log.delete",
+      // A separate permission from `read`: being allowed to investigate an
+      // incident must not imply being allowed to erase the evidence.
+      config: protectedBy(PERMISSIONS.delete)
+    }
+  ]
+};
+const routes = {
+  admin
+};
+const MAX_PATH_LENGTH = 512;
+const asString$2 = (value, maxLength = 256) => {
+  if (value === null || value === void 0) return null;
+  const text = String(value).trim();
+  return text.length === 0 ? null : text.slice(0, maxLength);
+};
+const accessService = ({ strapi }) => {
+  const plugin = () => strapi.plugin("audit-log");
+  let registered = false;
+  const isIgnoredPath = (path) => ACCESS_IGNORED_PATHS.some((pattern) => pattern.test(path));
+  const actorOf = (ctx) => {
+    const user = ctx.state?.user ?? null;
+    if (!user) return { userId: null, userEmail: null, userName: null };
+    const firstname = asString$2(user.firstname);
+    const lastname = asString$2(user.lastname);
+    return {
+      userId: asString$2(user.id),
+      userEmail: asString$2(user.email),
+      userName: firstname && lastname ? `${firstname} ${lastname}` : asString$2(user.username) ?? firstname ?? lastname ?? asString$2(user.email)
+    };
+  };
+  const sourceOf = (ctx) => {
+    const routeType = asString$2(ctx.state?.route?.info?.type);
+    if (routeType === "admin") return "admin";
+    if (routeType === "content-api") return "api";
+    const strategy = asString$2(ctx.state?.auth?.strategy?.name);
+    if (strategy === "admin") return "admin";
+    if (strategy === "api-token" || strategy === "users-permissions") return "api";
+    return "unknown";
+  };
+  const recordDenial = async (ctx) => {
+    const headers = ctx.request?.headers ?? {};
+    await plugin().service("audit").record({
+      action: "access.denied",
+      contentType: SUBJECTS.access,
+      contentTypeDisplayName: "Access control",
+      contentDocumentId: null,
+      contentId: null,
+      locale: null,
+      changes: null,
+      before: null,
+      after: null,
+      outcome: "failure",
+      metadata: {
+        method: asString$2(ctx.request?.method, 16),
+        path: asString$2(ctx.request?.path, MAX_PATH_LENGTH),
+        statusCode: ctx.status,
+        // Strapi's error handler puts a reason in the body. It is the difference
+        // between "no session" and "your role lacks this permission", which is
+        // the first thing anyone reading the row wants to know.
+        reason: asString$2(ctx.body?.error?.message) ?? null,
+        routeType: asString$2(ctx.state?.route?.info?.type)
+      },
+      source: sourceOf(ctx),
+      ...actorOf(ctx),
+      ipAddress: asString$2(ctx.request?.ip ?? ctx.ip, 64),
+      userAgent: asString$2(headers["user-agent"], 512),
+      requestId: asString$2(ctx.state?.requestId ?? headers["x-request-id"])
+    });
+  };
+  const createMiddleware = () => {
+    return async (ctx, next) => {
+      await next();
+      if (!DENIED_STATUSES.has(ctx.status)) return;
+      const path = String(ctx.request?.path ?? "");
+      if (isIgnoredPath(path)) return;
+      if (!plugin().service("config").isAuditedSecurityAction("access.denied")) return;
+      try {
+        await recordDenial(ctx);
+      } catch (error) {
+        strapi.log.error(
+          `[audit-log] failed to record a denied request: ${error?.message ?? error}`
+        );
+      }
+    };
+  };
+  const register2 = () => {
+    if (registered) return;
+    if (!plugin().service("config").isAuditedSecurityAction("access.denied")) return;
+    strapi.server.use(createMiddleware());
+    registered = true;
+  };
+  return { createMiddleware, register: register2, recordDenial, sourceOf, isIgnoredPath };
+};
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof Date);
+const isEqual = (a, b) => {
+  if (a === b) return true;
+  if (a instanceof Date || b instanceof Date) {
+    const left = a instanceof Date ? a.getTime() : Date.parse(String(a));
+    const right = b instanceof Date ? b.getTime() : Date.parse(String(b));
+    return Number.isFinite(left) && Number.isFinite(right) && left === right;
+  }
+  if (a == null && b == null) return true;
+  if (a == null || b == null) return false;
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+    return a.every((item, index2) => isEqual(item, b[index2]));
+  }
+  if (isPlainObject(a) && isPlainObject(b)) {
+    const aKeys = Object.keys(a);
+    const bKeys = Object.keys(b);
+    if (aKeys.length !== bKeys.length) return false;
+    return aKeys.every((key) => Object.prototype.hasOwnProperty.call(b, key) && isEqual(a[key], b[key]));
+  }
+  return false;
+};
+const approximateJsonBytes = (value) => {
+  try {
+    return Buffer.byteLength(JSON.stringify(value) ?? "", "utf8");
+  } catch {
+    return Number.POSITIVE_INFINITY;
+  }
+};
+const SORTABLE_FIELDS = /* @__PURE__ */ new Set([
+  "createdAt",
+  "action",
+  "contentType",
+  "userEmail",
+  "userName",
+  "locale",
+  "source",
+  "outcome",
+  "id"
+]);
+const SEARCHABLE_FIELDS = [
+  "contentDocumentId",
+  "contentId",
+  "contentType",
+  "contentTypeDisplayName",
+  "userEmail",
+  "userName",
+  "requestId",
+  "ipAddress"
+];
+const MAX_PAGE_SIZE = 100;
+const toArray = (value) => {
+  if (value === void 0 || value === null) return [];
+  const values = Array.isArray(value) ? value : [value];
+  return values.map((item) => String(item).trim()).filter((item) => item.length > 0);
+};
+const toPositiveInt = (value, fallback, max) => {
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 1) return fallback;
+  return max ? Math.min(parsed, max) : parsed;
+};
+const auditService = ({ strapi }) => {
+  const pending = /* @__PURE__ */ new Set();
+  const getConfig = () => strapi.plugin("audit-log").service("config").resolve();
+  const capSnapshot = (value, maxBytes, label) => {
+    if (!value || maxBytes <= 0) return value;
+    const bytes = approximateJsonBytes(value);
+    if (bytes <= maxBytes) return value;
+    strapi.log.warn(
+      `[audit-log] ${label} snapshot dropped: ~${bytes} bytes exceeds maxSnapshotBytes (${maxBytes}).`
+    );
+    return { __omitted__: `Snapshot omitted: ~${bytes} bytes exceeds maxSnapshotBytes (${maxBytes}).` };
+  };
+  const write = async (entry) => {
+    const config2 = getConfig();
+    await strapi.db.query(AUDIT_LOG_UID).create({
+      data: {
+        action: entry.action,
+        contentType: entry.contentType,
+        contentTypeDisplayName: entry.contentTypeDisplayName,
+        contentDocumentId: entry.contentDocumentId,
+        contentId: entry.contentId,
+        locale: entry.locale,
+        userId: entry.userId,
+        userEmail: entry.userEmail,
+        userName: entry.userName,
+        changes: config2.storeChanges ? entry.changes : null,
+        before: capSnapshot(config2.storeBefore ? entry.before : null, config2.maxSnapshotBytes, "before"),
+        after: capSnapshot(config2.storeAfter ? entry.after : null, config2.maxSnapshotBytes, "after"),
+        ipAddress: entry.ipAddress,
+        userAgent: entry.userAgent,
+        source: entry.source,
+        requestId: entry.requestId,
+        // A content write only ever reaches the tracker once it has succeeded,
+        // so the default is the honest value rather than a placeholder.
+        outcome: entry.outcome ?? "success",
+        metadata: entry.metadata ?? null
+      }
+    });
+    if (config2.forwardToLogger) forwardToLogger(entry, config2);
+  };
+  const forwardToLogger = (entry, config2) => {
+    try {
+      const line = JSON.stringify({
+        type: "audit-log",
+        action: entry.action,
+        outcome: entry.outcome ?? "success",
+        contentType: entry.contentType,
+        contentDocumentId: entry.contentDocumentId,
+        contentId: entry.contentId,
+        locale: entry.locale,
+        userId: entry.userId,
+        userEmail: entry.userEmail,
+        userName: entry.userName,
+        source: entry.source,
+        ipAddress: entry.ipAddress,
+        userAgent: entry.userAgent,
+        requestId: entry.requestId,
+        // Paths only. The values are in the database row; what a SIEM rule needs
+        // is "which fields moved", and that is what alerts can be written against.
+        changedPaths: entry.changes ? Object.keys(entry.changes) : [],
+        metadata: entry.metadata ?? null,
+        at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      strapi.log[config2.forwardLogLevel](
+        line
+      );
+    } catch (error) {
+      strapi.log.debug(`[audit-log] logger forwarding skipped: ${error?.message ?? error}`);
+    }
+  };
+  const record = async (entry) => {
+    const config2 = getConfig();
+    if (config2.writeMode === "async") {
+      const task = write(entry).catch((error) => {
+        strapi.log.error(
+          `[audit-log] failed to persist ${entry.action} on ${entry.contentType}: ${error?.message ?? error}`
+        );
+      }).finally(() => {
+        pending.delete(task);
+      });
+      pending.add(task);
+      return;
+    }
+    await write(entry);
+  };
+  const flush = async () => {
+    if (pending.size === 0) return;
+    await Promise.allSettled([...pending]);
+  };
+  const buildWhere = (query) => {
+    const where = {};
+    const inFilter = (values) => {
+      if (values.length === 0) return void 0;
+      return values.length === 1 ? values[0] : { $in: values };
+    };
+    const action = inFilter(toArray(query.action));
+    if (action !== void 0) where.action = action;
+    const contentType = inFilter(toArray(query.contentType));
+    if (contentType !== void 0) where.contentType = contentType;
+    const userId = inFilter(toArray(query.userId));
+    if (userId !== void 0) where.userId = userId;
+    const locale = inFilter(toArray(query.locale));
+    if (locale !== void 0) where.locale = locale;
+    const source = inFilter(toArray(query.source));
+    if (source !== void 0) where.source = source;
+    const outcome = inFilter(toArray(query.outcome));
+    if (outcome !== void 0) where.outcome = outcome;
+    if (query.contentDocumentId) {
+      where.contentDocumentId = String(query.contentDocumentId).trim();
+    }
+    const createdAt = {};
+    const from = query.dateFrom ? new Date(query.dateFrom) : null;
+    const to = query.dateTo ? new Date(query.dateTo) : null;
+    if (from && !Number.isNaN(from.getTime())) createdAt.$gte = from.toISOString();
+    if (to && !Number.isNaN(to.getTime())) createdAt.$lte = to.toISOString();
+    if (Object.keys(createdAt).length > 0) where.createdAt = createdAt;
+    const search = query._q ? String(query._q).trim() : "";
+    if (search.length > 0) {
+      where.$or = SEARCHABLE_FIELDS.map((field) => ({ [field]: { $containsi: search } }));
+    }
+    return where;
+  };
+  const parseSort = (sort) => {
+    const fallback = { createdAt: "desc" };
+    if (!sort) return fallback;
+    const [field, rawDirection] = String(sort).split(":");
+    if (!field || !SORTABLE_FIELDS.has(field)) return fallback;
+    return { [field]: rawDirection?.toLowerCase() === "asc" ? "asc" : "desc" };
+  };
+  const find = async (query = {}) => {
+    const page = toPositiveInt(query.page, 1);
+    const pageSize = toPositiveInt(query.pageSize, 20, MAX_PAGE_SIZE);
+    const { results, pagination } = await strapi.db.query(AUDIT_LOG_UID).findPage({
+      where: buildWhere(query),
+      orderBy: parseSort(query.sort),
+      page,
+      pageSize
+    });
+    return { results, pagination };
+  };
+  const findOne = async (id) => await strapi.db.query(AUDIT_LOG_UID).findOne({ where: { id } });
+  const deleteOne = async (id) => await strapi.db.query(AUDIT_LOG_UID).delete({ where: { id } });
+  const deleteOlderThan = async (date) => {
+    const { count } = await strapi.db.query(AUDIT_LOG_UID).deleteMany({
+      where: { createdAt: { $lt: date.toISOString() } }
+    });
+    return count;
+  };
+  const registryOptions = () => {
+    const configService2 = strapi.plugin(PLUGIN_ID).service("config");
+    const contentTypes2 = [];
+    try {
+      const registry = strapi.contentTypes ?? {};
+      for (const [uid, schema2] of Object.entries(registry)) {
+        if (!uid.startsWith("api::") && !uid.startsWith("plugin::")) continue;
+        if (!configService2.isAuditedContentType(uid)) continue;
+        contentTypes2.push({
+          uid,
+          displayName: schema2?.info?.displayName ?? schema2?.info?.singularName ?? uid
+        });
+      }
+    } catch (error) {
+      strapi.log.debug(
+        `[audit-log] could not read the content-type registry for filters: ${error?.message ?? error}`
+      );
+    }
+    if (configService2.hasSecurityEvents()) {
+      for (const uid of Object.values(SUBJECTS)) {
+        contentTypes2.push({ uid, displayName: SUBJECT_DISPLAY_NAMES[uid] ?? uid });
+      }
+    }
+    return { contentTypes: contentTypes2 };
+  };
+  const configuredLocales = async () => {
+    try {
+      if (!strapi.plugin("i18n")) return [];
+      const locales = await strapi.db.query("plugin::i18n.locale").findMany({
+        select: ["code"]
+      });
+      return locales.map((locale) => locale.code).filter((code) => Boolean(code));
+    } catch (error) {
+      strapi.log.debug(
+        `[audit-log] could not read locales for filters: ${error?.message ?? error}`
+      );
+      return [];
+    }
+  };
+  const adminUsers = async () => {
+    try {
+      const users = await strapi.db.query("admin::user").findMany({
+        select: ["id", "email", "firstname", "lastname", "username"]
+      });
+      return users.map((user) => {
+        const firstname = user.firstname ? String(user.firstname).trim() : "";
+        const lastname = user.lastname ? String(user.lastname).trim() : "";
+        const name = [firstname, lastname].filter(Boolean).join(" ");
+        return {
+          userId: String(user.id),
+          // Email first: it is the identifier an auditor is given in a ticket,
+          // and it is unique where a display name is not.
+          label: String(user.email ?? user.username ?? name ?? user.id)
+        };
+      });
+    } catch (error) {
+      strapi.log.debug(
+        `[audit-log] could not read admin users for filters: ${error?.message ?? error}`
+      );
+      return [];
+    }
+  };
+  const getFilterOptions = async () => {
+    const registry = registryOptions();
+    const fallback = {
+      contentTypes: registry.contentTypes,
+      users: await adminUsers(),
+      locales: await configuredLocales(),
+      actions: [...CONTENT_ACTIONS, ...ALL_SECURITY_ACTIONS],
+      sources: [...ALL_SOURCES],
+      outcomes: ["success", "failure"]
+    };
+    let stored = null;
+    try {
+      stored = await readStoredOptions();
+    } catch (error) {
+      strapi.log.error(
+        `[audit-log] could not read stored filter options: ${error?.message ?? error}`
+      );
+    }
+    if (!stored) return sortOptions(fallback);
+    return sortOptions({
+      contentTypes: dedupeBy([...fallback.contentTypes, ...stored.contentTypes], (item) => item.uid),
+      users: dedupeBy([...fallback.users, ...stored.users], (item) => item.userId),
+      locales: [.../* @__PURE__ */ new Set([...fallback.locales, ...stored.locales])],
+      actions: [.../* @__PURE__ */ new Set([...fallback.actions, ...stored.actions])],
+      sources: [.../* @__PURE__ */ new Set([...fallback.sources, ...stored.sources])],
+      outcomes: [.../* @__PURE__ */ new Set([...fallback.outcomes, ...stored.outcomes])]
+    });
+  };
+  const dedupeBy = (items, key) => {
+    const seen = /* @__PURE__ */ new Map();
+    for (const item of items) {
+      const id = key(item);
+      if (!seen.has(id)) seen.set(id, item);
+    }
+    return [...seen.values()];
+  };
+  const sortOptions = (options) => ({
+    ...options,
+    contentTypes: [...options.contentTypes].sort(
+      (a, b) => a.displayName.localeCompare(b.displayName)
+    ),
+    users: [...options.users].sort((a, b) => a.label.localeCompare(b.label)),
+    locales: [...options.locales].sort(),
+    actions: [...options.actions].sort(),
+    sources: [...options.sources].sort(),
+    outcomes: [...options.outcomes].sort()
+  });
+  const readStoredOptions = async () => {
+    const knex = strapi.db.connection;
+    const metadata = strapi.db.metadata.get(AUDIT_LOG_UID);
+    const table = metadata.tableName;
+    const column = (attribute) => {
+      const meta = metadata.attributes[attribute];
+      return meta?.columnName ?? attribute;
+    };
+    const cols = {
+      contentType: column("contentType"),
+      contentTypeDisplayName: column("contentTypeDisplayName"),
+      userId: column("userId"),
+      userEmail: column("userEmail"),
+      userName: column("userName"),
+      locale: column("locale"),
+      action: column("action"),
+      source: column("source"),
+      outcome: column("outcome")
+    };
+    const [contentTypeRows, userRows, localeRows, actionRows, sourceRows, outcomeRows] = await Promise.all([
+      knex(table).distinct(cols.contentType, cols.contentTypeDisplayName).orderBy(cols.contentType, "asc"),
+      knex(table).distinct(cols.userId, cols.userEmail, cols.userName).whereNotNull(cols.userId).orderBy(cols.userId, "asc"),
+      knex(table).distinct(cols.locale).whereNotNull(cols.locale).orderBy(cols.locale, "asc"),
+      knex(table).distinct(cols.action).orderBy(cols.action, "asc"),
+      knex(table).distinct(cols.source).whereNotNull(cols.source).orderBy(cols.source, "asc"),
+      knex(table).distinct(cols.outcome).whereNotNull(cols.outcome).orderBy(cols.outcome, "asc")
+    ]);
+    const rows = (input) => Array.isArray(input) ? input : [];
+    return {
+      contentTypes: rows(contentTypeRows).map((row) => ({
+        uid: row[cols.contentType],
+        displayName: row[cols.contentTypeDisplayName] || row[cols.contentType]
+      })),
+      users: rows(userRows).map((row) => ({
+        userId: row[cols.userId],
+        label: row[cols.userEmail] || row[cols.userName] || row[cols.userId]
+      })),
+      locales: rows(localeRows).map((row) => row[cols.locale]),
+      actions: rows(actionRows).map((row) => row[cols.action]),
+      sources: rows(sourceRows).map((row) => row[cols.source]),
+      outcomes: rows(outcomeRows).map((row) => row[cols.outcome])
+    };
+  };
+  return {
+    record,
+    write,
+    flush,
+    find,
+    findOne,
+    deleteOne,
+    deleteOlderThan,
+    getFilterOptions,
+    buildWhere,
+    parseSort
+  };
+};
+const toSegments = (path) => path.replace(/\[\d+\]/g, "").split(".").filter((segment) => segment.length > 0).map((segment) => segment.toLowerCase());
+const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const compileSegment = (segment) => {
+  if (segment === "*") return () => true;
+  if (!segment.includes("*")) {
+    return (value) => value === segment;
+  }
+  const source = `^${segment.split("*").map(escapeRegExp).join(".*")}$`;
+  const regex = new RegExp(source);
+  return (value) => regex.test(value);
+};
+const matchSegments = (pattern, segments) => {
+  if (pattern.length === 0) return segments.length === 0;
+  const [head, ...restPattern] = pattern;
+  if (head === "**") {
+    for (let skip = 0; skip <= segments.length; skip += 1) {
+      if (matchSegments(restPattern, segments.slice(skip))) return true;
+    }
+    return false;
+  }
+  if (segments.length === 0) return false;
+  if (!head(segments[0])) return false;
+  return matchSegments(restPattern, segments.slice(1));
+};
+const createPathMatcher = (patterns) => {
+  const exactLeaves = /* @__PURE__ */ new Set();
+  const leafMatchers = [];
+  const compiled = [];
+  for (const raw of patterns) {
+    const pattern = String(raw).trim().toLowerCase();
+    if (pattern.length === 0) continue;
+    if (!pattern.includes(".")) {
+      if (!pattern.includes("*")) exactLeaves.add(pattern);
+      else leafMatchers.push(compileSegment(pattern));
+      continue;
+    }
+    compiled.push(
+      toSegments(pattern).map((segment) => segment === "**" ? "**" : compileSegment(segment))
+    );
+  }
+  if (exactLeaves.size === 0 && leafMatchers.length === 0 && compiled.length === 0) {
+    return () => false;
+  }
+  return (path) => {
+    const segments = toSegments(path);
+    if (segments.length === 0) return false;
+    const leaf = segments[segments.length - 1];
+    if (exactLeaves.has(leaf)) return true;
+    if (leafMatchers.some((matches) => matches(leaf))) return true;
+    return compiled.some((pattern) => matchSegments(pattern, segments));
+  };
+};
+const joinPath = (base, key) => {
+  if (typeof key === "number") return `${base}[${key}]`;
+  return base.length === 0 ? key : `${base}.${key}`;
+};
+const sanitizeValue = (value, isIgnored, basePath = "") => {
+  if (Array.isArray(value)) {
+    return value.map((item, index2) => sanitizeValue(item, isIgnored, joinPath(basePath, index2)));
+  }
+  if (isPlainObject(value)) {
+    const result = {};
+    for (const [key, child] of Object.entries(value)) {
+      const path = joinPath(basePath, key);
+      if (isIgnored(path)) continue;
+      result[key] = sanitizeValue(child, isIgnored, path);
+    }
+    return result;
+  }
+  return value;
+};
+const asArray = (value, fallback) => Array.isArray(value) ? value.map(String) : fallback;
+const configService = ({ strapi }) => {
+  let cached = null;
+  const resolve = () => {
+    if (cached) return cached;
+    const raw = strapi.config.get(`plugin::${PLUGIN_ID}`, {}) ?? {};
+    const ignoredFields = asArray(raw.ignoredFields, DEFAULT_IGNORED_FIELDS);
+    const additionalIgnoredFields = asArray(raw.additionalIgnoredFields, []);
+    const ignoredChangeFields = asArray(raw.ignoredChangeFields, DEFAULT_IGNORED_CHANGE_FIELDS);
+    const snapshotPatterns = [...ignoredFields, ...additionalIgnoredFields];
+    const contentTypes2 = raw.contentTypes == null ? "*" : raw.contentTypes;
+    const config2 = {
+      actions: Array.isArray(raw.actions) ? raw.actions : ALL_ACTIONS,
+      contentTypes: Array.isArray(contentTypes2) ? contentTypes2.map(String) : "*",
+      ignoredContentTypes: asArray(raw.ignoredContentTypes, []),
+      ignoredFields,
+      additionalIgnoredFields,
+      ignoredChangeFields,
+      storeBefore: raw.storeBefore !== false,
+      storeAfter: raw.storeAfter !== false,
+      storeChanges: raw.storeChanges !== false,
+      retentionDays: typeof raw.retentionDays === "number" ? raw.retentionDays : 365,
+      retentionCron: typeof raw.retentionCron === "string" ? raw.retentionCron : "0 3 * * *",
+      failOnAuditError: raw.failOnAuditError === true,
+      writeMode: raw.writeMode === "async" ? "async" : "sync",
+      maxPopulateDepth: typeof raw.maxPopulateDepth === "number" ? raw.maxPopulateDepth : 2,
+      maxSnapshotBytes: typeof raw.maxSnapshotBytes === "number" ? raw.maxSnapshotBytes : 512 * 1024,
+      auditSystemOperations: raw.auditSystemOperations !== false,
+      securityEvents: Array.isArray(raw.securityEvents) ? raw.securityEvents.map(String) : "*",
+      forwardToLogger: raw.forwardToLogger === true,
+      forwardLogLevel: ["debug", "info", "warn", "error"].includes(
+        raw.forwardLogLevel
+      ) ? raw.forwardLogLevel : "info",
+      isIgnoredForSnapshot: createPathMatcher(snapshotPatterns),
+      isIgnoredForChanges: createPathMatcher([...snapshotPatterns, ...ignoredChangeFields])
+    };
+    cached = config2;
+    return config2;
+  };
+  const isAuditedContentType = (uid) => {
+    const { contentTypes: contentTypes2, ignoredContentTypes } = resolve();
+    if (uid === `plugin::${PLUGIN_ID}.audit-log`) return false;
+    if (ignoredContentTypes.includes(uid)) return false;
+    if (contentTypes2 === "*") return true;
+    return contentTypes2.includes(uid);
+  };
+  const isAuditedAction = (action) => resolve().actions.includes(action);
+  const isAuditedSecurityAction = (action) => {
+    const { securityEvents } = resolve();
+    if (securityEvents === "*") return true;
+    return securityEvents.includes(action);
+  };
+  const hasSecurityEvents = () => {
+    const { securityEvents } = resolve();
+    return securityEvents === "*" || securityEvents.length > 0;
+  };
+  const enabledSecurityActions = () => {
+    const { securityEvents } = resolve();
+    return securityEvents === "*" ? [...ALL_SECURITY_ACTIONS] : securityEvents;
+  };
+  const getPublicConfig = () => {
+    const { isIgnoredForChanges: _c, isIgnoredForSnapshot: _s, ...rest } = resolve();
+    return rest;
+  };
+  const clearCache = () => {
+    cached = null;
+  };
+  return {
+    resolve,
+    isAuditedContentType,
+    isAuditedAction,
+    isAuditedSecurityAction,
+    hasSecurityEvents,
+    enabledSecurityActions,
+    getPublicConfig,
+    clearCache
+  };
+};
+const overrideStorage = new node_async_hooks.AsyncLocalStorage();
+const EMPTY_CONTEXT = {
+  source: "system",
+  userId: null,
+  userEmail: null,
+  userName: null,
+  ipAddress: null,
+  userAgent: null,
+  requestId: null
+};
+const asString$1 = (value) => {
+  if (value === null || value === void 0) return null;
+  const text = String(value).trim();
+  return text.length === 0 ? null : text;
+};
+const resolveUserName = (user) => {
+  const firstname = asString$1(user.firstname);
+  const lastname = asString$1(user.lastname);
+  if (firstname && lastname) return `${firstname} ${lastname}`;
+  return asString$1(user.username) ?? firstname ?? lastname ?? asString$1(user.email);
+};
+const contextService = ({ strapi }) => {
+  const runAs = (override, callback) => overrideStorage.run(override, callback);
+  const getRequestContext = () => {
+    try {
+      return strapi.requestContext?.get?.();
+    } catch {
+      return void 0;
+    }
+  };
+  const resolveSource = (ctx) => {
+    const declared = asString$1(ctx?.state?.auditSource);
+    if (declared) return declared;
+    const routeType = asString$1(ctx?.state?.route?.info?.type);
+    if (routeType === "admin") return "admin";
+    if (routeType === "content-api") return "api";
+    const strategyName = asString$1(ctx?.state?.auth?.strategy?.name);
+    if (strategyName === "admin") return "admin";
+    if (strategyName === "api-token" || strategyName === "users-permissions") return "api";
+    return ctx ? "unknown" : "system";
+  };
+  const resolve = () => {
+    const override = overrideStorage.getStore();
+    const ctx = getRequestContext();
+    if (!ctx) {
+      if (!override) return EMPTY_CONTEXT;
+      return {
+        ...EMPTY_CONTEXT,
+        source: override.source,
+        userId: asString$1(override.userId),
+        userEmail: asString$1(override.userEmail),
+        userName: asString$1(override.userName)
+      };
+    }
+    const user = ctx.state?.user ?? null;
+    const headers = ctx.request?.headers ?? ctx.req?.headers ?? {};
+    const requestId = asString$1(ctx.state?.requestId) ?? REQUEST_ID_HEADERS.map((header) => asString$1(headers[header])).find(Boolean) ?? null;
+    return {
+      // An explicit override wins even inside a request: a controller that
+      // deliberately labels its work knows more than the route type does.
+      source: override?.source ?? resolveSource(ctx),
+      userId: asString$1(override?.userId ?? user?.id),
+      userEmail: asString$1(override?.userEmail ?? user?.email),
+      userName: override?.userName !== void 0 ? asString$1(override.userName) : user ? resolveUserName(user) : null,
+      // `ctx.request.ip` honours Koa's `proxy` setting, so behind a correctly
+      // configured load balancer this is the client address rather than the
+      // proxy's. With `proxy` off it ignores `X-Forwarded-For` entirely, which
+      // is the safe default — a spoofable header is worse than no address.
+      ipAddress: asString$1(ctx.request?.ip ?? ctx.ip),
+      userAgent: asString$1(headers["user-agent"]),
+      requestId
+    };
+  };
+  return { resolve, runAs };
+};
+const DEFAULT_MAX_DEPTH = 6;
+const DEFAULT_MAX_CHANGES = 500;
+const diffService = ({ strapi }) => {
+  const buildDiff = (before, after, options = {}) => {
+    const {
+      isIgnored = () => false,
+      keys = null,
+      maxDepth = DEFAULT_MAX_DEPTH,
+      maxChanges = DEFAULT_MAX_CHANGES
+    } = options;
+    const changes = {};
+    let count = 0;
+    let truncated = false;
+    const record = (path, from, to) => {
+      if (count >= maxChanges) {
+        truncated = true;
+        return;
+      }
+      changes[path] = { from: normalise(from), to: normalise(to) };
+      count += 1;
+    };
+    const walk = (from, to, path, depth) => {
+      if (count >= maxChanges) {
+        truncated = true;
+        return;
+      }
+      if (path.length > 0 && isIgnored(path)) return;
+      if (isEqual(from, to)) return;
+      const bothObjects = isPlainObject(from) && isPlainObject(to);
+      const bothArrays = Array.isArray(from) && Array.isArray(to);
+      if (depth >= maxDepth || !bothObjects && !bothArrays) {
+        record(path, from, to);
+        return;
+      }
+      if (bothArrays) {
+        const length = Math.max(from.length, to.length);
+        for (let index2 = 0; index2 < length; index2 += 1) {
+          walk(from[index2], to[index2], joinPath(path, index2), depth + 1);
+        }
+        return;
+      }
+      const objectKeys = /* @__PURE__ */ new Set([...Object.keys(from), ...Object.keys(to)]);
+      for (const key of objectKeys) {
+        walk(
+          from[key],
+          to[key],
+          joinPath(path, key),
+          depth + 1
+        );
+      }
+    };
+    const beforeObject = isPlainObject(before) ? before : {};
+    const afterObject = isPlainObject(after) ? after : {};
+    const topLevelKeys = keys && keys.length > 0 ? keys : [.../* @__PURE__ */ new Set([...Object.keys(beforeObject), ...Object.keys(afterObject)])];
+    for (const key of topLevelKeys) {
+      walk(beforeObject[key], afterObject[key], key, 1);
+    }
+    if (truncated) {
+      changes.__truncated__ = {
+        from: null,
+        to: `Diff truncated at ${maxChanges} changes. See the before/after snapshots for the full state.`
+      };
+    }
+    return changes;
+  };
+  const normalise = (value) => {
+    if (value instanceof Date) return value.toISOString();
+    if (value === void 0) return null;
+    return value;
+  };
+  return { buildDiff };
+};
+const FORBIDDEN_ACTIONS = /* @__PURE__ */ new Set(["update", "publish", "unpublish", "discardDraft", "clone"]);
+const immutabilityService = ({ strapi }) => {
+  const createMiddleware = () => {
+    return async (ctx, next) => {
+      if (ctx.uid === AUDIT_LOG_UID && FORBIDDEN_ACTIONS.has(ctx.action)) {
+        throw new Error(
+          `[audit-log] Audit records are immutable: "${ctx.action}" is not permitted on ${AUDIT_LOG_UID}. Audit logs may only be created by the plugin and deleted through the retention job or the DELETE /audit-log/logs/:id route, which requires the plugin::audit-log.delete permission.`
+        );
+      }
+      return next();
+    };
+  };
+  const register2 = () => {
+    strapi.documents.use(createMiddleware());
+  };
+  return { createMiddleware, register: register2 };
+};
+const MS_PER_DAY = 24 * 60 * 60 * 1e3;
+const retentionService = ({ strapi }) => {
+  const getConfig = () => strapi.plugin("audit-log").service("config").resolve();
+  const cutoffDate = (retentionDays, now = /* @__PURE__ */ new Date()) => new Date(now.getTime() - retentionDays * MS_PER_DAY);
+  const cleanup = async () => {
+    const { retentionDays } = getConfig();
+    if (retentionDays <= 0) return 0;
+    const cutoff = cutoffDate(retentionDays);
+    const deleted = await strapi.plugin("audit-log").service("audit").deleteOlderThan(cutoff);
+    if (deleted > 0) {
+      strapi.log.info(
+        `[audit-log] retention removed ${deleted} record(s) created before ${cutoff.toISOString()}.`
+      );
+    }
+    return deleted;
+  };
+  const register2 = () => {
+    const { retentionDays, retentionCron } = getConfig();
+    if (retentionDays <= 0) {
+      strapi.log.debug("[audit-log] retentionDays is 0 — automatic cleanup is disabled.");
+      return;
+    }
+    strapi.cron.add({
+      [RETENTION_JOB_NAME]: {
+        async task() {
+          try {
+            await cleanup();
+          } catch (error) {
+            strapi.log.error(
+              `[audit-log] retention job failed: ${error?.message ?? error}`
+            );
+          }
+        },
+        options: retentionCron
+      }
+    });
+    strapi.log.info(
+      `[audit-log] retention enabled: records older than ${retentionDays} day(s) are removed on "${retentionCron}".`
+    );
+  };
+  const unregister = () => {
+    try {
+      strapi.cron.remove(RETENTION_JOB_NAME);
+    } catch {
+    }
+  };
+  return { cleanup, cutoffDate, register: register2, unregister };
+};
+const FAILURE_ACTIONS = /* @__PURE__ */ new Set(["login.failed", "access.denied"]);
+const IDENTIFYING_FIELDS = [
+  "id",
+  "documentId",
+  "name",
+  "email",
+  "username",
+  "firstname",
+  "lastname",
+  "code",
+  "action",
+  "subject",
+  "isActive",
+  "blocked",
+  "mime",
+  "url",
+  "ext",
+  "size",
+  "path"
+];
+const asString = (value) => {
+  if (value === null || value === void 0) return null;
+  const text = String(value).trim();
+  return text.length === 0 ? null : text;
+};
+const nameOf = (user) => {
+  if (!user) return null;
+  const firstname = asString(user.firstname);
+  const lastname = asString(user.lastname);
+  if (firstname && lastname) return `${firstname} ${lastname}`;
+  return asString(user.username) ?? firstname ?? lastname ?? asString(user.email);
+};
+const securityService = ({ strapi }) => {
+  const plugin = () => strapi.plugin("audit-log");
+  let unsubscribers = [];
+  const requestContext = () => {
+    try {
+      return strapi.requestContext?.get?.();
+    } catch {
+      return void 0;
+    }
+  };
+  const actor = (explicit) => {
+    const ctx = requestContext();
+    const user = explicit ?? ctx?.state?.user ?? null;
+    return {
+      userId: asString(user?.id),
+      userEmail: asString(user?.email),
+      userName: nameOf(user)
+    };
+  };
+  const requestMeta = () => {
+    const ctx = requestContext();
+    const headers = ctx?.request?.headers ?? {};
+    return {
+      ipAddress: asString(ctx?.request?.ip ?? ctx?.ip),
+      userAgent: asString(headers["user-agent"]),
+      requestId: asString(ctx?.state?.requestId ?? headers["x-request-id"])
+    };
+  };
+  const sourceOf = () => requestContext() ? "admin" : "system";
+  const record = async (action, subject, fields = {}) => {
+    const config2 = plugin().service("config");
+    if (!config2.isAuditedSecurityAction(action)) return;
+    const source = sourceOf();
+    if (source === "system" && !config2.resolve().auditSystemOperations) return;
+    const entry = {
+      action,
+      contentType: subject,
+      contentTypeDisplayName: SUBJECT_DISPLAY_NAMES[subject] ?? subject,
+      contentDocumentId: fields.contentDocumentId ?? null,
+      contentId: fields.contentId ?? null,
+      locale: null,
+      changes: null,
+      before: fields.before ?? null,
+      after: fields.after ?? null,
+      outcome: fields.outcome ?? (FAILURE_ACTIONS.has(action) ? "failure" : "success"),
+      metadata: fields.metadata ?? null,
+      source,
+      ...actor(fields.user),
+      ...requestMeta()
+    };
+    await plugin().service("audit").record(entry);
+  };
+  const identify = (entity) => {
+    if (!entity || typeof entity !== "object") return null;
+    const summary = {};
+    for (const key of IDENTIFYING_FIELDS) {
+      if (entity[key] !== void 0 && entity[key] !== null) summary[key] = entity[key];
+    }
+    if (Array.isArray(entity.roles)) {
+      summary.roles = entity.roles.map((role) => asString(role?.name) ?? asString(role?.code) ?? asString(role?.id)).filter(Boolean);
+    }
+    return Object.keys(summary).length > 0 ? summary : null;
+  };
+  const subjectOf = (payload) => payload?.user ?? payload?.role ?? payload?.permission ?? payload?.media ?? payload?.folder ?? null;
+  const attemptedEmail = () => {
+    const body = requestContext()?.request?.body;
+    return asString(body?.email);
+  };
+  const handlers = {
+    "admin.auth.success": async (payload) => {
+      const user = payload?.user;
+      await record("login.success", SECURITY_EVENT_MAP["admin.auth.success"].subject, {
+        user,
+        contentId: asString(user?.id),
+        metadata: { provider: asString(payload?.provider) ?? "local" }
+      });
+    },
+    "admin.auth.error": async (payload) => {
+      const email = attemptedEmail();
+      await record("login.failed", SECURITY_EVENT_MAP["admin.auth.error"].subject, {
+        // No session exists, so `actor()` would find nobody. The attempted
+        // identity is the whole value of the record: it is what turns twenty
+        // rows into "twenty attempts against one account".
+        user: email ? { email } : null,
+        metadata: {
+          provider: asString(payload?.provider) ?? "local",
+          reason: asString(payload?.error?.message) ?? "Authentication failed",
+          attemptedEmail: email
+        }
+      });
+    },
+    "admin.logout": async (payload) => {
+      const user = payload?.user;
+      await record("logout", SECURITY_EVENT_MAP["admin.logout"].subject, {
+        user,
+        contentId: asString(user?.id)
+      });
+    }
+  };
+  const entityHandler = (action, subject) => async (payload) => {
+    const entity = subjectOf(payload);
+    const summary = identify(entity);
+    const isDelete = action.endsWith(".delete");
+    await record(action, subject, {
+      contentId: asString(entity?.id),
+      contentDocumentId: asString(entity?.documentId),
+      before: isDelete ? summary : null,
+      after: isDelete ? null : summary
+    });
+  };
+  const register2 = () => {
+    const config2 = plugin().service("config");
+    if (!config2.hasSecurityEvents()) {
+      strapi.log.debug("[audit-log] securityEvents is empty — no security listeners registered.");
+      return;
+    }
+    unregister();
+    const enabled = new Set(config2.enabledSecurityActions());
+    for (const [event, { action, subject }] of Object.entries(SECURITY_EVENT_MAP)) {
+      if (!enabled.has(action)) continue;
+      const handler = handlers[event] ?? entityHandler(action, subject);
+      const listener = async (payload = {}) => {
+        try {
+          await handler(payload);
+        } catch (error) {
+          strapi.log.error(
+            `[audit-log] failed to record "${event}": ${error?.message ?? error}`
+          );
+        }
+      };
+      unsubscribers.push(strapi.eventHub.on(event, listener));
+    }
+    strapi.log.info(
+      `[audit-log] security events: listening on ${unsubscribers.length} of ${Object.keys(SECURITY_EVENT_MAP).length} Strapi events.`
+    );
+  };
+  const unregister = () => {
+    for (const off of unsubscribers) {
+      try {
+        off();
+      } catch {
+      }
+    }
+    unsubscribers = [];
+  };
+  return { register: register2, unregister, record, identify, subjectOf, sourceOf, entityHandler, handlers };
+};
+const RELATION_FIELDS = ["id", "documentId"];
+const MEDIA_FIELDS = ["id", "documentId", "name", "url", "mime", "size", "alternativeText"];
+const META_FIELDS = ["id", "documentId", "locale", "publishedAt"];
+const isRelational = (attribute) => attribute?.type === "relation" || attribute?.type === "component" || attribute?.type === "dynamiczone" || attribute?.type === "media";
+const snapshotService = ({ strapi }) => {
+  const getSchema = (uid) => {
+    try {
+      return strapi.getModel(uid) ?? null;
+    } catch {
+      return null;
+    }
+  };
+  const hasDraftAndPublish = (uid) => getSchema(uid)?.options?.draftAndPublish === true;
+  const isLocalized = (uid) => getSchema(uid)?.pluginOptions?.i18n?.localized === true;
+  const buildComponentPopulate = (componentUid, depth) => {
+    if (depth <= 0) return true;
+    const schema2 = getSchema(componentUid);
+    const attributes = schema2?.attributes ?? {};
+    const populate = {};
+    for (const [name, attribute] of Object.entries(attributes)) {
+      if (!isRelational(attribute)) continue;
+      switch (attribute.type) {
+        case "media":
+          populate[name] = { select: MEDIA_FIELDS };
+          break;
+        case "relation":
+          populate[name] = { select: RELATION_FIELDS };
+          break;
+        case "component":
+          populate[name] = buildComponentPopulate(attribute.component, depth - 1);
+          break;
+        case "dynamiczone":
+          populate[name] = true;
+          break;
+      }
+    }
+    return Object.keys(populate).length > 0 ? { populate } : true;
+  };
+  const buildSnapshotQuery = (uid, keys, options) => {
+    const { depth, isIgnored = () => false } = options;
+    const schema2 = getSchema(uid);
+    const attributes = schema2?.attributes ?? {};
+    const select = /* @__PURE__ */ new Set();
+    const populate = {};
+    const dynamicZones = [];
+    for (const field of META_FIELDS) {
+      if (field === "publishedAt" && !hasDraftAndPublish(uid)) continue;
+      if (field === "locale" && !isLocalized(uid)) continue;
+      select.add(field);
+    }
+    const candidates = keys ?? Object.keys(attributes);
+    for (const name of candidates) {
+      const attribute = attributes[name];
+      if (!attribute) continue;
+      if (SKIPPED_ATTRIBUTES.has(name)) continue;
+      if (isIgnored(name)) continue;
+      if (!isRelational(attribute)) {
+        select.add(name);
+        continue;
+      }
+      switch (attribute.type) {
+        case "media":
+          populate[name] = { select: MEDIA_FIELDS };
+          break;
+        case "relation":
+          populate[name] = { select: RELATION_FIELDS };
+          break;
+        case "component":
+          populate[name] = buildComponentPopulate(attribute.component, depth);
+          break;
+        case "dynamiczone":
+          populate[name] = true;
+          dynamicZones.push(name);
+          break;
+      }
+    }
+    return {
+      select: [...select],
+      populate: Object.keys(populate).length > 0 ? populate : void 0,
+      dynamicZones
+    };
+  };
+  const buildWhere = (uid, lookup) => {
+    const where = { documentId: lookup.documentId };
+    if (hasDraftAndPublish(uid) && lookup.status && lookup.status !== "any") {
+      where.publishedAt = lookup.status === "draft" ? null : { $ne: null };
+    }
+    const locales = (lookup.locales ?? []).filter(
+      (locale) => Boolean(locale) && locale !== "*"
+    );
+    if (isLocalized(uid) && locales.length > 0) {
+      where.locale = locales.length === 1 ? locales[0] : { $in: locales };
+    }
+    return where;
+  };
+  const refineDynamicZones = async (uid, rows, query, depth) => {
+    if (query.dynamicZones.length === 0 || depth < 2 || rows.length === 0) return rows;
+    const populate = {};
+    for (const zone of query.dynamicZones) {
+      const usedComponents = /* @__PURE__ */ new Set();
+      for (const row of rows) {
+        const items = Array.isArray(row[zone]) ? row[zone] : [];
+        for (const item of items) {
+          const componentUid = item?.__component ?? item?.__type;
+          if (typeof componentUid === "string") usedComponents.add(componentUid);
+        }
+      }
+      if (usedComponents.size === 0) continue;
+      const on = {};
+      for (const componentUid of usedComponents) {
+        const spec = buildComponentPopulate(componentUid, depth - 1);
+        on[componentUid] = spec === true ? {} : spec;
+      }
+      populate[zone] = { on };
+    }
+    if (Object.keys(populate).length === 0) return rows;
+    const ids = rows.map((row) => row.id).filter((id) => id != null);
+    if (ids.length === 0) return rows;
+    const refined = await strapi.db.query(uid).findMany({
+      where: { id: { $in: ids } },
+      select: ["id"],
+      populate
+    });
+    const byId = new Map(refined.map((row) => [row.id, row]));
+    return rows.map((row) => {
+      const extra = byId.get(row.id);
+      if (!extra) return row;
+      const merged = { ...row };
+      for (const zone of Object.keys(populate)) merged[zone] = extra[zone];
+      return merged;
+    });
+  };
+  const fetchRows = async (uid, lookup, query, depth) => {
+    const rows = await strapi.db.query(uid).findMany({
+      where: buildWhere(uid, lookup),
+      select: query.select,
+      ...query.populate ? { populate: query.populate } : {}
+    });
+    return refineDynamicZones(uid, rows, query, depth);
+  };
+  const toSnapshot = (row) => {
+    if (!row) return null;
+    const snapshot = {};
+    for (const [key, value] of Object.entries(row)) {
+      if (SKIPPED_ATTRIBUTES.has(key)) continue;
+      snapshot[key] = value;
+    }
+    return snapshot;
+  };
+  return {
+    buildSnapshotQuery,
+    buildComponentPopulate,
+    buildWhere,
+    fetchRows,
+    refineDynamicZones,
+    toSnapshot,
+    hasDraftAndPublish,
+    isLocalized
+  };
+};
+const TRACKED_ACTIONS = {
+  create: "create",
+  update: "update",
+  delete: "delete",
+  publish: "publish",
+  unpublish: "unpublish"
+};
+const asId = (value) => value === null || value === void 0 ? null : String(value);
+const paramLocales = (params) => {
+  const { locale } = params;
+  if (locale === void 0 || locale === null || locale === "*") return null;
+  if (Array.isArray(locale)) return locale.map(String);
+  return [String(locale)];
+};
+const trackerService = ({ strapi }) => {
+  const plugin = () => strapi.plugin("audit-log");
+  const getConfig = () => plugin().service("config").resolve();
+  const displayNameOf = (uid) => {
+    try {
+      const schema2 = strapi.getModel(uid);
+      return schema2?.info?.displayName ?? schema2?.info?.singularName ?? null;
+    } catch {
+      return null;
+    }
+  };
+  const changedKeys = (uid, params) => {
+    const data = params?.data;
+    if (!data || typeof data !== "object" || Array.isArray(data)) return null;
+    let attributes = {};
+    try {
+      attributes = strapi.getModel(uid)?.attributes ?? {};
+    } catch {
+      return null;
+    }
+    const keys = Object.keys(data).filter(
+      (key) => key in attributes && !SKIPPED_ATTRIBUTES.has(key)
+    );
+    return keys.length > 0 ? keys : [];
+  };
+  const snapshotByLocale = async (uid, documentId, locales, status, query, depth) => {
+    const snapshot = plugin().service("snapshot");
+    const rows = await snapshot.fetchRows(uid, { documentId, locales, status }, query, depth);
+    const byLocale = /* @__PURE__ */ new Map();
+    for (const row of rows) byLocale.set(row.locale ?? "__default__", row);
+    return byLocale;
+  };
+  const localeKey = (row) => row?.locale ?? "__default__";
+  const resultRows = (result) => {
+    if (!result) return [];
+    const asRecord = result;
+    if (Array.isArray(asRecord.entries)) return asRecord.entries;
+    return [asRecord];
+  };
+  const dedupeByLocale = (rows) => {
+    const byLocale = /* @__PURE__ */ new Map();
+    for (const row of rows) {
+      const key = localeKey(row);
+      const existing = byLocale.get(key);
+      if (!existing || existing.publishedAt != null && row.publishedAt == null) {
+        byLocale.set(key, row);
+      }
+    }
+    return [...byLocale.values()];
+  };
+  const buildEntries = async (ctx, action, result, before, query, keys) => {
+    const config2 = getConfig();
+    const snapshot = plugin().service("snapshot");
+    const diff = plugin().service("diff");
+    const auditContext = plugin().service("context").resolve();
+    const { uid } = ctx;
+    const rows = dedupeByLocale(resultRows(result));
+    const documentId = asId(ctx.params?.documentId) ?? asId(result?.documentId) ?? asId(rows[0]?.documentId);
+    let after = /* @__PURE__ */ new Map();
+    const needsAfter = (config2.storeAfter || config2.storeChanges) && action !== "delete" && action !== "unpublish";
+    if (needsAfter && documentId) {
+      const locales = rows.length > 0 ? rows.map((row) => row.locale).filter(Boolean) : paramLocales(ctx.params);
+      after = await snapshotByLocale(
+        uid,
+        documentId,
+        locales,
+        action === "publish" ? "published" : "draft",
+        query,
+        config2.maxPopulateDepth
+      );
+    }
+    const displayName = displayNameOf(uid);
+    const targets = rows.length > 0 ? rows.map((row) => ({ locale: row.locale ?? null, row })) : [...before.size > 0 ? before.values() : []].map((row) => ({ locale: row.locale ?? null, row }));
+    if (targets.length === 0) return [];
+    return targets.map(({ locale, row }) => {
+      const key = localeKey(row);
+      const beforeRow = before.get(key) ?? null;
+      const afterRow = after.get(key) ?? (action === "delete" || action === "unpublish" ? null : row);
+      const beforeSnapshot = sanitizeValue(snapshot.toSnapshot(beforeRow), config2.isIgnoredForSnapshot);
+      const afterSnapshot = sanitizeValue(snapshot.toSnapshot(afterRow), config2.isIgnoredForSnapshot);
+      const changes = config2.storeChanges ? diff.buildDiff(beforeSnapshot, afterSnapshot, {
+        isIgnored: config2.isIgnoredForChanges,
+        keys: action === "update" ? keys : null,
+        maxDepth: Math.max(2, config2.maxPopulateDepth + 3)
+      }) : null;
+      return {
+        action,
+        contentType: uid,
+        contentTypeDisplayName: displayName,
+        contentDocumentId: documentId,
+        contentId: asId(row?.id ?? beforeRow?.id),
+        locale: locale ?? beforeRow?.locale ?? null,
+        changes,
+        before: config2.storeBefore ? beforeSnapshot : null,
+        after: config2.storeAfter ? afterSnapshot : null,
+        ...auditContext
+      };
+    });
+  };
+  const createMiddleware = () => {
+    return async (ctx, next) => {
+      const action = TRACKED_ACTIONS[ctx.action];
+      if (!action) return next();
+      const configService2 = plugin().service("config");
+      if (!configService2.isAuditedContentType(ctx.uid) || !configService2.isAuditedAction(action)) {
+        return next();
+      }
+      const config2 = getConfig();
+      let before = /* @__PURE__ */ new Map();
+      let query = { select: [], populate: void 0, dynamicZones: [] };
+      let keys = null;
+      const onError = (stage, error) => {
+        const message = error?.message ?? String(error);
+        strapi.log.error(`[audit-log] ${stage} failed for ${action} on ${ctx.uid}: ${message}`);
+        if (config2.failOnAuditError) throw error;
+      };
+      try {
+        keys = action === "update" ? changedKeys(ctx.uid, ctx.params) : null;
+        query = plugin().service("snapshot").buildSnapshotQuery(ctx.uid, keys, {
+          depth: config2.maxPopulateDepth,
+          isIgnored: config2.isIgnoredForSnapshot
+        });
+        const documentId = asId(ctx.params?.documentId);
+        const needsBefore = (config2.storeBefore || config2.storeChanges) && action !== "create";
+        if (needsBefore && documentId) {
+          before = await snapshotByLocale(
+            ctx.uid,
+            documentId,
+            paramLocales(ctx.params),
+            // A publish diffs the version being replaced; everything else works
+            // against the draft the editor was editing.
+            action === "publish" || action === "unpublish" ? "published" : "draft",
+            query,
+            config2.maxPopulateDepth
+          );
+        }
+      } catch (error) {
+        onError("pre-write snapshot", error);
+      }
+      const result = await next();
+      try {
+        const alsoPublished = (action === "create" || action === "update") && ctx.params?.status === "published" && plugin().service("config").isAuditedAction("publish");
+        const entries = await buildEntries(ctx, action, result, before, query, keys);
+        for (const entry of entries) {
+          await plugin().service("audit").record(entry);
+        }
+        if (alsoPublished) {
+          for (const entry of entries) {
+            await plugin().service("audit").record({ ...entry, action: "publish" });
+          }
+        }
+      } catch (error) {
+        onError("audit write", error);
+      }
+      return result;
+    };
+  };
+  const register2 = () => {
+    strapi.documents.use(createMiddleware());
+  };
+  return { createMiddleware, register: register2, changedKeys, resultRows };
+};
+const services = {
+  access: accessService,
+  audit: auditService,
+  config: configService,
+  context: contextService,
+  diff: diffService,
+  immutability: immutabilityService,
+  retention: retentionService,
+  security: securityService,
+  snapshot: snapshotService,
+  tracker: trackerService
+};
+const index = {
+  register,
+  bootstrap,
+  destroy,
+  config,
+  contentTypes,
+  controllers,
+  routes,
+  services
+};
+exports.ALL_SECURITY_ACTIONS = ALL_SECURITY_ACTIONS;
+exports.AUDIT_LOG_UID = AUDIT_LOG_UID;
+exports.CONTENT_ACTIONS = CONTENT_ACTIONS;
+exports.DEFAULT_IGNORED_FIELDS = DEFAULT_IGNORED_FIELDS;
+exports.PERMISSIONS = PERMISSIONS;
+exports.PLUGIN_ID = PLUGIN_ID;
+exports.SECURITY_EVENT_MAP = SECURITY_EVENT_MAP;
+exports.SUBJECTS = SUBJECTS;
+exports.default = index;