strapi-plugin-magic-link-v5 5.3.19 → 5.5.0

package/CHANGELOG.md

@@ -0,0 +1,215 @@
+# [5.5.0](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.4.0...v5.5.0) (2026-04-21)
+
+
+### Bug Fixes
+
+* **deps:** move baileys to optionalDependencies + bump runtime deps ([b1716b2](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/b1716b22cb905aaa52fa5c7bfea5092ef722fc91)), closes [package.json#exports](https://github.com/package.json/issues/exports)
+* **deps:** pin styled-components to ^6.3.9 to avoid npm ci ERESOLVE ([351cf6f](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/351cf6fd325bce0f7bc8df1bfa35895c81c326b9))
+* **deps:** revert baileys back to dependencies, document protobufjs override for consumers ([260e144](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/260e1441959dfaa1bdc31550b76f4849854cc6c6))
+* **enduser:** harden magic-link login/OTP flow (no enumeration, deterministic email lookup, clean delivery errors) ([707c45c](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/707c45cb4a007aa9c25b705c2b9e2f977749f126))
+* **license:** wrap every license-server call in a 12s timeout with 1 retry ([6ab88ba](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/6ab88ba47e15c1d0feab53ff71866f7e5958d24a))
+* **security:** gate every admin route with hasPermissions (plugin::magic-link.access) ([db821ef](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/db821ef24a46d5f5ccbebb452803dcab057123ff))
+
+
+### Features
+
+* **security,settings:** otp binding, crypto hardening, wire-up dead settings ([90dc76d](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/90dc76d3cb77fe6bc2272155b43272e6541ab91f))
+
+# [5.4.0](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.20...v5.4.0) (2026-04-15)
+
+
+### Bug Fixes
+
+* **rbac:** keep routes functional, only hide UI for unpermitted roles ([5f230cb](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/5f230cbc4432477bea6c9c3886205d058fa90f10))
+* **routes:** restore original open policies for end-user facing routes ([30d7fb5](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/30d7fb5ec77c1576068052ca92e4fe9fb4771fbc))
+
+
+### Features
+
+* **rbac:** add access permission and secure all admin routes ([7e68283](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/7e6828333a26f64612f0cf1831bdc2f535fb308f))
+
+## [5.3.20](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.19...v5.3.20) (2026-02-27)
+
+
+### Bug Fixes
+
+* loosen peerDependencies to avoid conflicts with Strapi 5.37+ ([4ac6f96](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/4ac6f96493a408e8302655b94b0e93a8f4019ff4))
+* security hardening - hash-based JWT storage, prefix token lookup, rate limiter rewrite ([7010255](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/701025549ef8f2af9d99d791c2eb143afab1a1c0))
+
+## [5.3.19](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.18...v5.3.19) (2026-02-14)
+
+
+### Bug Fixes
+
+* resolve libsignal git+ssh dependency issue for CI/CD compatibility ([9c0d840](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/9c0d8403630806c10f6ea8e45de84d843d5bc206))
+
+## [5.3.18](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.17...v5.3.18) (2026-02-08)
+
+
+### Bug Fixes
+
+* dark mode compatibility for LicensePage and LicenseGuard ([e3292b2](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/e3292b267ca1c1260c809ca6f7eed80be117b70a)), closes [#4945ff](https://github.com/Schero94/strapi-plugin-magic-link-v5/issues/4945ff)
+
+## [5.3.17](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.16...v5.3.17) (2026-02-07)
+
+
+### Bug Fixes
+
+* replace all hardcoded theme colors with DS props and rgba for dark/light mode ([28b4f8e](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/28b4f8ee66e83012bb8037a4439dd393afe022e6)), closes [#BAE6FD](https://github.com/Schero94/strapi-plugin-magic-link-v5/issues/BAE6FD) [#BBF7D0](https://github.com/Schero94/strapi-plugin-magic-link-v5/issues/BBF7D0)
+
+## [5.3.16](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.15...v5.3.16) (2026-02-07)
+
+
+### Bug Fixes
+
+* use Strapi DS tokens for light+dark mode compatibility ([6a603f9](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/6a603f9da6ec07a962e785cd3410f088b8f83a9d))
+
+## [5.3.15](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.14...v5.3.15) (2026-02-07)
+
+
+### Bug Fixes
+
+* settings page fully dark mode compatible ([4b8e402](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/4b8e4026ae9d654fe655c1a812601517e82de4cd)), closes [#E5E7EB](https://github.com/Schero94/strapi-plugin-magic-link-v5/issues/E5E7EB) [#D1D5DB](https://github.com/Schero94/strapi-plugin-magic-link-v5/issues/D1D5DB) [#E9D5FF](https://github.com/Schero94/strapi-plugin-magic-link-v5/issues/E9D5FF) [#d1d5db](https://github.com/Schero94/strapi-plugin-magic-link-v5/issues/d1d5db)
+
+## [5.3.14](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.13...v5.3.14) (2026-02-07)
+
+
+### Bug Fixes
+
+* extend token modal dark mode compatible ([cb10fc6](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/cb10fc64806d1a4e3055120740413a18dd5aa9b4))
+
+## [5.3.13](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.12...v5.3.13) (2026-02-07)
+
+
+### Bug Fixes
+
+* token details modal fully dark mode compatible ([15da652](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/15da652fb8505017edc6b164d58dccb0325214dc))
+
+## [5.3.12](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.11...v5.3.12) (2026-02-07)
+
+
+### Bug Fixes
+
+* white text color for reference badge in dark mode ([cac77ee](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/cac77ee2be56d9f7fd82bd62b8a38f632891ea07))
+
+## [5.3.11](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.10...v5.3.11) (2026-02-07)
+
+
+### Bug Fixes
+
+* reference badge readable in dark mode ([7bb8ab6](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/7bb8ab6ed6329c2e9c6dc8f67da4b851bff92667))
+
+## [5.3.10](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.9...v5.3.10) (2026-02-07)
+
+
+### Bug Fixes
+
+* use expire_period from settings as default TTL in token creation ([f8cb324](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/f8cb324882807bba5fc84a2b6ab853022f988601))
+
+## [5.3.9](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.8...v5.3.9) (2026-02-07)
+
+
+### Bug Fixes
+
+* replace Toggle with Switch component (Strapi DS v2) ([a0af2f0](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/a0af2f02ac745fb6cb001008eb4af6c91257848f))
+
+## [5.3.8](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.7...v5.3.8) (2026-02-07)
+
+
+### Bug Fixes
+
+* update admin UI to Strapi Design System v2 patterns ([057f5a3](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/057f5a3d4f137bb4e91b48c6a8cca103afaf067e))
+
+## [5.3.7](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.6...v5.3.7) (2026-02-07)
+
+
+### Bug Fixes
+
+* context whitelist/blacklist input fields not typeable ([5e87a8c](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/5e87a8c1a78347a68d2089a0440a3c5e30f5187b))
+
+## [5.3.6](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.5...v5.3.6) (2026-02-07)
+
+
+### Bug Fixes
+
+* pass all context fields through on login instead of hard whitelist ([116a032](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/116a032ecfe567dea51ec35688a030ebdef8e113))
+
+## [5.3.5](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.4...v5.3.5) (2026-01-30)
+
+
+### Bug Fixes
+
+* restore package-lock.json for CI/CD npm ci ([422f849](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/422f8492e4cc677381d9c2ad8f15a63bdfbb545b))
+* update NumberInput onChange to onValueChange for Strapi Design System v2 ([2b2c91f](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/2b2c91fb3b51383cc540ee06b00325831855007e))
+* use expire_period from settings instead of hardcoded 1 hour ([cc48094](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/cc4809471ad7f1d890881534a223eab330475629))
+
+## [5.3.4](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.3...v5.3.4) (2026-01-27)
+
+
+### Bug Fixes
+
+* use onValueChange for NumberInput components ([cbdfd3e](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/cbdfd3e61efabdb3867fdfce8a4e58c2959ddbe8))
+
+## [5.3.3](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.2...v5.3.3) (2025-12-28)
+
+
+### Bug Fixes
+
+* remove begservice references and support email ([f8a5581](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/f8a558181b62388c3019e654ad55edb118561a4e))
+
+## [5.3.2](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.1...v5.3.2) (2025-12-28)
+
+
+### Bug Fixes
+
+* update repository URLs from begservice to Schero94 ([0a5169c](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/0a5169cefba54f1582026c2027aa905c3e6b13f9))
+
+## [5.3.1](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.3.0...v5.3.1) (2025-12-16)
+
+
+### Bug Fixes
+
+* improve WhatsApp integration stability and documentation ([5730c07](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/5730c07710cd59d007341608e10758cf7a23f2aa))
+
+# [5.3.0](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.2.0...v5.3.0) (2025-12-16)
+
+
+### Features
+
+* add WhatsApp integration for magic links v5.2.7 ([bc2ba06](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/bc2ba068d5375002a068f49f3566fee3b3e5fbca))
+
+# [5.2.0](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.1.4...v5.2.0) (2025-12-08)
+
+
+### Features
+
+* enhance GitHub issue templates with plugin-specific fields and feature request template ([78f9829](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/78f982927fb970d6062a584b4b81294795330d0e))
+* enhance pull request template with comprehensive sections and plugin-specific checklist ([e64eec1](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/e64eec1c2986776a9f7f00f14fec37b29acd9fb5))
+
+## [5.1.4](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.1.3...v5.1.4) (2025-12-08)
+
+
+### Bug Fixes
+
+* move semantic-release to devDependencies and add GitHub templates ([a942b79](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/a942b791a401c48f9c7450183c9ba57b4938a777))
+
+## [5.1.3](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.1.2...v5.1.3) (2025-12-05)
+
+
+### Bug Fixes
+
+* resolve strapi reference loss in setInterval cleanup functions ([1caae3f](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/1caae3f81c274d64ee4e15457d8989e4873e9875))
+
+## [5.1.2](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.1.1...v5.1.2) (2025-12-04)
+
+
+### Bug Fixes
+
+* hide internal content-types from Content Manager (Strapi v5) ([6cc1309](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/6cc13095229800ad00c71964738215453e102f27))
+
+## [5.1.1](https://github.com/Schero94/strapi-plugin-magic-link-v5/compare/v5.1.0...v5.1.1) (2025-12-04)
+
+
+### Bug Fixes
+
+* trigger release for code quality improvements ([ed51892](https://github.com/Schero94/strapi-plugin-magic-link-v5/commit/ed51892f120278841b2798adb371fa8c56f88c7a))

package/LICENSE

@@ -12,12 +12,6 @@ furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 
-**ADDITIONAL CONDITION:**
-The license validation system (including but not limited to license-guard.js, 
-license controller, and related API endpoints) must remain intact and functional. 
-Removing, bypassing, or disabling the license validation system is strictly 
-prohibited.
-
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

package/README.md

@@ -783,6 +783,71 @@ npm install strapi-plugin-email-designer-5
 
 ---
 
+## 🔑 Required Environment Variables
+
+The plugin stores secrets that must be protected across restarts and should
+not be rotated with the rest of your Strapi key material. Two env vars are
+**mandatory in production** (the plugin refuses to boot without them):
+
+```bash
+# 32+ random bytes — used as AES-256 key for TOTP secrets.
+# DO NOT ROTATE: existing TOTP secrets would become undecryptable.
+MAGIC_LINK_ENCRYPTION_KEY=<hex from: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))">
+
+# 16+ random bytes — pepper mixed into OTP code hashes to defeat
+# rainbow-table attacks on stored 6-digit codes if the DB is ever leaked.
+MAGIC_LINK_OTP_PEPPER=<hex from: node -e "console.log(require('crypto').randomBytes(24).toString('hex'))">
+```
+
+In non-production environments (`NODE_ENV !== 'production'`) the plugin
+falls back to derived values so local dev setups keep working — but a WARN
+is logged once per process.
+
+---
+
+## 🌐 Reverse Proxy / Rate-Limit Trust
+
+Rate limits and all audit logs identify the caller by `ctx.request.ip`,
+which Koa derives from the TCP connection by default. If your Strapi is
+behind a reverse proxy (nginx, Caddy, Cloudflare, ALB, …) you MUST:
+
+1. Enable proxy trust in `config/server.{js,ts}`:
+
+   ```js
+   module.exports = ({ env }) => ({
+     proxy: true,   // Trust X-Forwarded-For from the proxy
+     // ... rest of config
+   });
+   ```
+
+2. Configure the proxy to **strip any incoming `X-Forwarded-For`** and
+   emit only its own value. Without this, an attacker can spoof the
+   header, defeating per-IP rate limits.
+
+3. If you have multiple proxy hops, pin trust to the outermost ones via
+   Koa's `app.proxyIpHeader` / `app.maxIpsCount` (see Koa docs).
+
+A misconfigured deployment will either:
+- **Count all requests as the proxy's single IP** (everyone rate-limited together), or
+- **Trust spoofed client IPs** (per-IP rate limit effectively disabled).
+
+---
+
+## 🔐 OTP Strict Binding
+
+Starting with this release, `/otp/send`, `/otp/verify` and `/otp/resend`
+require the client to present the `magicLinkToken` they received from
+`/magic-link/login` when it returned `{ requiresOTP: true }`. This prevents
+`/otp/send` from being abused as a standalone email-bombing vector against
+arbitrary addresses and prevents `/otp/verify` from being a first-factor
+login on its own.
+
+If you have legacy integrations that must keep the old behaviour, disable
+it via settings: `otp_strict_binding: false`. Doing so emits a WARN on
+every request and is **not recommended**.
+
+---
+
 ## 🎨 Email Templates
 
 Customize your magic link emails using template variables:
@@ -1008,6 +1073,49 @@ If this plugin saves you time and you'd like to support development:
 
 ---
 
+## Security Advisories & Dependency Overrides
+
+This plugin ships with a first-party dependency tree audited on every
+release, but two transitive paths are governed by upstream packages we
+do not control. If your own `npm audit` flags any of the following,
+add the matching entry to your **Strapi project's** `package.json`
+(not this plugin's — npm `overrides` only take effect on the
+root project):
+
+```jsonc
+{
+  "overrides": {
+    // GHSA-xq3m-2v4x-88gg — protobufjs <7.5.5 arbitrary code execution.
+    // Reaches us via @whiskeysockets/baileys → libsignal → protobufjs.
+    // We already ship this override for local development; apply it in
+    // your Strapi project so the fix propagates to the installed tree.
+    "protobufjs": "^7.5.5",
+
+    // Optional: if you do not use the WhatsApp delivery feature, you
+    // can also skip installing @whiskeysockets/baileys altogether:
+    //   npm install --omit=optional
+    // (The Magic-Link code path detects the missing module and
+    // disables the WhatsApp controller at runtime — the rest of the
+    // plugin keeps working.)
+  }
+}
+```
+
+After editing `package.json`, run:
+
+```bash
+rm -rf node_modules package-lock.json
+npm install
+npm audit
+```
+
+The critical `protobufjs` advisory disappears once the override is in
+place. The remaining `@strapi/design-system → lodash` advisory is a
+Strapi-core issue and will clear up automatically when you upgrade
+`@strapi/strapi` to the latest patch release.
+
+---
+
 <div align="center">
 
 **Made with ❤️ by [Schero94](https://github.com/Schero94)**

package/dist/{_chunks/index-BLVWydMU.mjs → admin/index-2avmGJ5M.mjs}

@@ -5,7 +5,7 @@ import { useIntl } from "react-intl";
 import { Flex, Loader, Box, Typography, Button, TextInput, Badge } from "@strapi/design-system";
 import { Phone, Check, Message, ArrowClockwise } from "@strapi/icons";
 import { useNotification, useFetchClient } from "@strapi/strapi/admin";
-import { g as getTrad } from "./index-XzZ9gY5b.mjs";
+import { g as getTrad } from "./index-BCopEXYL.mjs";
 const theme = {
   colors: {
     primary: { 700: "#075985", 100: "#E0F2FE", 50: "#F0F9FF" },

package/dist/{_chunks/index-XzZ9gY5b.mjs → admin/index-BCopEXYL.mjs}

@@ -17,9 +17,7 @@ const __variableDynamicImportRuntimeHelper = (glob, path, segs) => {
     );
   });
 };
-const strapi = {
-  name: "magic-link"
-};
+const strapi = { "name": "magic-link" };
 const pluginPkg = {
   strapi
 };
@@ -33,6 +31,7 @@ const Initializer = ({ setPlugin }) => {
 };
 const PluginIcon = () => /* @__PURE__ */ jsx(Key, {});
 const pluginPermissions = {
+  access: [{ action: "plugin::magic-link.access", subject: null }],
   readSettings: [{ action: "plugin::magic-link.settings.read", subject: null }]
 };
 const getTrad = (id) => {
@@ -59,10 +58,9 @@ const index = {
       },
       Component: () => import(
         /* webpackChunkName: "magic-link-tokens" */
-        "./index-FtAOFA-A.mjs"
+        "./index-BdhtSEYZ.mjs"
       ),
-      permissions: []
-      // Leeres Array = keine Permission-Prüfung nötig
+      permissions: pluginPermissions.access
     });
     app.createSettingSection(
       {
@@ -82,7 +80,7 @@ const index = {
           to: `${PLUGIN_ID}/config`,
           Component: () => import(
             /* webpackChunkName: "magic-link-settings" */
-            "./index-D4iiJVPc.mjs"
+            "./index-mocjHxcq.mjs"
           ),
           permissions: pluginPermissions.readSettings
         },
@@ -97,7 +95,7 @@ const index = {
             /* webpackChunkName: "magic-link-license" */
             "./index-B8urUtiz.mjs"
           ),
-          permissions: []
+          permissions: pluginPermissions.access
         },
         {
           intlLabel: {
@@ -110,7 +108,7 @@ const index = {
             /* webpackChunkName: "magic-link-upgrade" */
             "./LicensePage-CCNW2hT6.mjs"
           ),
-          permissions: []
+          permissions: pluginPermissions.access
         },
         {
           intlLabel: {
@@ -121,9 +119,9 @@ const index = {
           to: `${PLUGIN_ID}/whatsapp`,
           Component: () => import(
             /* webpackChunkName: "magic-link-whatsapp" */
-            "./index-BLVWydMU.mjs"
+            "./index-2avmGJ5M.mjs"
           ),
-          permissions: []
+          permissions: pluginPermissions.access
         }
       ]
     );

package/dist/{_chunks/index-DsBgtATx.js → admin/index-BDG7geOg.js}

@@ -7,7 +7,7 @@ const styled = require("styled-components");
 const reactIntl = require("react-intl");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
-const index = require("./index-DJQQdmfZ.js");
+const index = require("./index-DYLdjufr.js");
 const admin = require("@strapi/strapi/admin");
 const LicenseGuard = require("./LicenseGuard-DqyOwTlf.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };

package/dist/{_chunks/index-FtAOFA-A.mjs → admin/index-BdhtSEYZ.mjs}

@@ -5,7 +5,7 @@ import styled, { keyframes, css } from "styled-components";
 import { useIntl } from "react-intl";
 import { Box, Flex, Typography, Button, TextInput, Textarea, Checkbox, IconButton, Loader, Searchbar, SingleSelect, SingleSelectOption, Thead, Tr, Th, Tbody, Td, Pagination, PreviousLink, PageLink, NextLink, Table, Badge, VisuallyHidden, Main } from "@strapi/design-system";
 import { Cross, Sparkle, Check, Shield, Clock, Lock, Trash, ArrowClockwise, CaretDown, User, Monitor, Calendar, Plus, Earth, WarningCircle, Server, Eye, Mail, Cog, Key, Link } from "@strapi/icons";
-import { g as getTrad, P as PLUGIN_ID } from "./index-XzZ9gY5b.mjs";
+import { g as getTrad, P as PLUGIN_ID } from "./index-BCopEXYL.mjs";
 import { useFetchClient, useNotification } from "@strapi/strapi/admin";
 import { L as LicenseGuard, a as LanguageProvider } from "./LicenseGuard-5sMwgS6j.mjs";
 const CreateTokenModal = ({ isOpen, onClose, onSubmit, formData, setFormData }) => {

package/dist/{_chunks/index-DLQHbyQZ.js → admin/index-DGUMEnkD.js}

@@ -7,7 +7,7 @@ const reactIntl = require("react-intl");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
 const admin = require("@strapi/strapi/admin");
-const index = require("./index-DJQQdmfZ.js");
+const index = require("./index-DYLdjufr.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);
 const theme = {

package/dist/{_chunks/index-DJQQdmfZ.js → admin/index-DYLdjufr.js}

@@ -18,9 +18,7 @@ const __variableDynamicImportRuntimeHelper = (glob, path, segs) => {
     );
   });
 };
-const strapi = {
-  name: "magic-link"
-};
+const strapi = { "name": "magic-link" };
 const pluginPkg = {
   strapi
 };
@@ -34,6 +32,7 @@ const Initializer = ({ setPlugin }) => {
 };
 const PluginIcon = () => /* @__PURE__ */ jsxRuntime.jsx(icons.Key, {});
 const pluginPermissions = {
+  access: [{ action: "plugin::magic-link.access", subject: null }],
   readSettings: [{ action: "plugin::magic-link.settings.read", subject: null }]
 };
 const getTrad = (id) => {
@@ -60,10 +59,9 @@ const index = {
       },
       Component: () => Promise.resolve().then(() => require(
         /* webpackChunkName: "magic-link-tokens" */
-        "./index-DsBgtATx.js"
+        "./index-BDG7geOg.js"
       )),
-      permissions: []
-      // Leeres Array = keine Permission-Prüfung nötig
+      permissions: pluginPermissions.access
     });
     app.createSettingSection(
       {
@@ -83,7 +81,7 @@ const index = {
           to: `${PLUGIN_ID}/config`,
           Component: () => Promise.resolve().then(() => require(
             /* webpackChunkName: "magic-link-settings" */
-            "./index-B2-UNgqO.js"
+            "./index-KsidtTDP.js"
           )),
           permissions: pluginPermissions.readSettings
         },
@@ -98,7 +96,7 @@ const index = {
             /* webpackChunkName: "magic-link-license" */
             "./index-PgHpSdc8.js"
           )),
-          permissions: []
+          permissions: pluginPermissions.access
         },
         {
           intlLabel: {
@@ -111,7 +109,7 @@ const index = {
             /* webpackChunkName: "magic-link-upgrade" */
             "./LicensePage-2M-vOJX8.js"
           )),
-          permissions: []
+          permissions: pluginPermissions.access
         },
         {
           intlLabel: {
@@ -122,9 +120,9 @@ const index = {
           to: `${PLUGIN_ID}/whatsapp`,
           Component: () => Promise.resolve().then(() => require(
             /* webpackChunkName: "magic-link-whatsapp" */
-            "./index-DLQHbyQZ.js"
+            "./index-DGUMEnkD.js"
           )),
-          permissions: []
+          permissions: pluginPermissions.access
         }
       ]
     );

package/dist/{_chunks/index-B2-UNgqO.js → admin/index-KsidtTDP.js}

@@ -7,7 +7,7 @@ const reactIntl = require("react-intl");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
 const admin = require("@strapi/strapi/admin");
-const index = require("./index-DJQQdmfZ.js");
+const index = require("./index-DYLdjufr.js");
 const LicenseGuard = require("./LicenseGuard-DqyOwTlf.js");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const styled__default = /* @__PURE__ */ _interopDefault(styled);

package/dist/{_chunks/index-D4iiJVPc.mjs → admin/index-mocjHxcq.mjs}

@@ -5,7 +5,7 @@ import { useIntl } from "react-intl";
 import { Box, Typography, Flex, Button, Accordion, SingleSelect, SingleSelectOption, Grid, Switch, NumberInput, TextInput, Divider, Textarea, Badge } from "@strapi/design-system";
 import { Check, Cog, Lightning, Shield, Mail, CheckCircle, Code, Link, Lock, Key } from "@strapi/icons";
 import { useNotification, useFetchClient } from "@strapi/strapi/admin";
-import { g as getTrad } from "./index-XzZ9gY5b.mjs";
+import { g as getTrad } from "./index-BCopEXYL.mjs";
 import { u as usePluginLanguage, L as LicenseGuard, a as LanguageProvider } from "./LicenseGuard-5sMwgS6j.mjs";
 const EMAIL_TEMPLATES = {
   modern: {

package/dist/admin/index.js

@@ -1,4 +1,5 @@
 "use strict";
-const index = require("../_chunks/index-DJQQdmfZ.js");
+Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
+const index = require("./index-DYLdjufr.js");
 require("@strapi/icons");
-module.exports = index.index;
+exports.default = index.index;

package/dist/admin/index.mjs

@@ -1,4 +1,4 @@
-import { i } from "../_chunks/index-XzZ9gY5b.mjs";
+import { i } from "./index-BCopEXYL.mjs";
 import "@strapi/icons";
 export {
   i as default