{"version":3,"file":"shape-relations.mjs","sources":["../../../../server/src/mcp/sanitizers/shape-relations.ts"],"sourcesContent":["import { traverseEntity } from '@strapi/utils';\nimport type { UID } from '@strapi/types';\n\n// Relations whose cardinality is \"many\" — maps to Array output.\n// Includes non-owning variants and morph-many.\nconst MANY_RELATION_TYPES = new Set([\n  'oneToMany',\n  'manyToMany',\n  'manyWay',\n  'morphToMany',\n  'morphMany',\n]);\n\n/**\n * Canonical \"is this relation a list\" predicate for the MCP output boundary.\n * Both the runtime shaping (reduceToIdentity) and the registered output schemas\n * (output-schemas.ts) MUST use this single definition — the MCP SDK validates\n * structuredContent against the schema, so any divergence fails the tool call.\n * Intentionally broader than `relations.isAnyToMany` from @strapi/utils, which\n * ignores `manyWay` and the morph variants.\n */\nexport const isManyRelationForMcp = (attribute: { relation?: string }): boolean =>\n  MANY_RELATION_TYPES.has(attribute.relation ?? '');\n\ntype RelationIdentity = {\n  documentId: string;\n  locale?: string;\n  __type?: string;\n  status?: string;\n};\n\n/**\n * Extracts identity fields from a single relation entry.\n * Returns undefined when the entry has no documentId (e.g. a bare {count} object).\n */\nconst pickIdentity = (entry: unknown): RelationIdentity | undefined => {\n  if (entry === null || typeof entry !== 'object') {\n    return undefined;\n  }\n\n  const obj = entry as Record<string, unknown>;\n\n  if (typeof obj.documentId !== 'string') {\n    return undefined;\n  }\n\n  const identity: RelationIdentity = { documentId: obj.documentId };\n\n  if (typeof obj.locale === 'string') {\n    identity.locale = obj.locale;\n  }\n\n  if (typeof obj.__type === 'string') {\n    identity.__type = obj.__type;\n  }\n\n  // Preserve the computed publish status on `localizations` entries — it is\n  // calculated by formatDocumentWithMetadata BEFORE shaping (calculate, then strip).\n  // Non-localization relation entries never carry a string `status`, so this is a no-op for them.\n  if (typeof obj.status === 'string') {\n    identity.status = obj.status;\n  }\n\n  return identity;\n};\n\n/**\n * Reduces a populated relation value to identity-only shape.\n *\n * to-one → { documentId, locale?, __type? } | null\n * to-many → Array<{ documentId, locale?, __type? }>  ([] when empty)\n */\nconst reduceToIdentity = (\n  attribute: { relation?: string },\n  value: unknown\n): RelationIdentity | RelationIdentity[] | null => {\n  const isMany = isManyRelationForMcp(attribute);\n\n  if (isMany) {\n    if (Array.isArray(value)) {\n      return value.map(pickIdentity).filter((v): v is RelationIdentity => v !== undefined);\n    }\n    // defensive: { count: N } or null/undefined → empty array\n    return [];\n  }\n\n  // to-one\n  if (value === null || value === undefined) {\n    return null;\n  }\n\n  if (Array.isArray(value)) {\n    // should not happen, but guard: treat first element\n    return pickIdentity(value[0]) ?? null;\n  }\n\n  return pickIdentity(value) ?? null;\n};\n\n/**\n * Post-sanitize shaping visitor.\n * Reduces every relation attribute to identity-only (documentId + locale? + __type?).\n * Skips admin::user relations — those are out of scope and preserved as-is.\n */\nconst shapeRelationToIdentity: Parameters<typeof traverseEntity>[0] = (\n  { key, value, attribute },\n  { set }\n) => {\n  if (attribute?.type !== 'relation') {\n    return;\n  }\n\n  const target = (attribute as { target?: string }).target;\n\n  // Out of scope — admin user records are preserved untouched (tracked separately).\n  if (target === 'admin::user') {\n    return;\n  }\n\n  // @ts-expect-error — reduceToIdentity returns a narrower type; traverseEntity Data allows unknown\n  set(key, reduceToIdentity(attribute as { relation?: string }, value));\n};\n\n/**\n * Applies identity shaping to all relation fields in a document, including\n * nested fields inside components, dynamic zones, and `localizations`.\n *\n * This covers leak family #1 (relation targets) and #2 (localizations full draft rows)\n * with the same single mechanism.\n */\nexport const shapeRelationsForMcp = async (\n  uid: UID.Schema,\n  data: Record<string, unknown>\n): Promise<Record<string, unknown>> => {\n  return traverseEntity(\n    shapeRelationToIdentity,\n    {\n      schema: strapi.getModel(uid),\n      getModel: strapi.getModel.bind(strapi),\n    },\n    // @ts-expect-error — traverseEntity expects Data; post-sanitize documents are compatible at runtime\n    data\n  );\n};\n\n// Export for unit-testing without a full strapi instance\nexport { reduceToIdentity, MANY_RELATION_TYPES };\n"],"names":["MANY_RELATION_TYPES","Set","isManyRelationForMcp","attribute","has","relation","pickIdentity","entry","undefined","obj","documentId","identity","locale","__type","status","reduceToIdentity","value","isMany","Array","isArray","map","filter","v","shapeRelationToIdentity","key","set","type","target","shapeRelationsForMcp","uid","data","traverseEntity","schema","strapi","getModel","bind"],"mappings":";;AAGA;AACA;AACA,MAAMA,mBAAAA,GAAsB,IAAIC,GAAAA,CAAI;AAClC,IAAA,WAAA;AACA,IAAA,YAAA;AACA,IAAA,SAAA;AACA,IAAA,aAAA;AACA,IAAA;AACD,CAAA;AAED;;;;;;;IAQO,MAAMC,oBAAAA,GAAuB,CAACC,SAAAA,GACnCH,mBAAAA,CAAoBI,GAAG,CAACD,SAAAA,CAAUE,QAAQ,IAAI,EAAA;AAShD;;;IAIA,MAAMC,eAAe,CAACC,KAAAA,GAAAA;AACpB,IAAA,IAAIA,KAAAA,KAAU,IAAA,IAAQ,OAAOA,KAAAA,KAAU,QAAA,EAAU;QAC/C,OAAOC,SAAAA;AACT,IAAA;AAEA,IAAA,MAAMC,GAAAA,GAAMF,KAAAA;AAEZ,IAAA,IAAI,OAAOE,GAAAA,CAAIC,UAAU,KAAK,QAAA,EAAU;QACtC,OAAOF,SAAAA;AACT,IAAA;AAEA,IAAA,MAAMG,QAAAA,GAA6B;AAAED,QAAAA,UAAAA,EAAYD,IAAIC;AAAW,KAAA;AAEhE,IAAA,IAAI,OAAOD,GAAAA,CAAIG,MAAM,KAAK,QAAA,EAAU;QAClCD,QAAAA,CAASC,MAAM,GAAGH,GAAAA,CAAIG,MAAM;AAC9B,IAAA;AAEA,IAAA,IAAI,OAAOH,GAAAA,CAAII,MAAM,KAAK,QAAA,EAAU;QAClCF,QAAAA,CAASE,MAAM,GAAGJ,GAAAA,CAAII,MAAM;AAC9B,IAAA;;;;AAKA,IAAA,IAAI,OAAOJ,GAAAA,CAAIK,MAAM,KAAK,QAAA,EAAU;QAClCH,QAAAA,CAASG,MAAM,GAAGL,GAAAA,CAAIK,MAAM;AAC9B,IAAA;IAEA,OAAOH,QAAAA;AACT,CAAA;AAEA;;;;;IAMA,MAAMI,gBAAAA,GAAmB,CACvBZ,SAAAA,EACAa,KAAAA,GAAAA;AAEA,IAAA,MAAMC,SAASf,oBAAAA,CAAqBC,SAAAA,CAAAA;AAEpC,IAAA,IAAIc,MAAAA,EAAQ;QACV,IAAIC,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;YACxB,OAAOA,KAAAA,CAAMI,GAAG,CAACd,YAAAA,CAAAA,CAAce,MAAM,CAAC,CAACC,IAA6BA,CAAAA,KAAMd,SAAAA,CAAAA;AAC5E,QAAA;;AAEA,QAAA,OAAO,EAAE;AACX,IAAA;;IAGA,IAAIQ,KAAAA,KAAU,IAAA,IAAQA,KAAAA,KAAUR,SAAAA,EAAW;QACzC,OAAO,IAAA;AACT,IAAA;IAEA,IAAIU,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;;AAExB,QAAA,OAAOV,YAAAA,CAAaU,KAAK,CAAC,CAAA,CAAE,CAAA,IAAK,IAAA;AACnC,IAAA;AAEA,IAAA,OAAOV,aAAaU,KAAAA,CAAAA,IAAU,IAAA;AAChC;AAEA;;;;AAIC,IACD,MAAMO,uBAAAA,GAAgE,CACpE,EAAEC,GAAG,EAAER,KAAK,EAAEb,SAAS,EAAE,EACzB,EAAEsB,GAAG,EAAE,GAAA;IAEP,IAAItB,SAAAA,EAAWuB,SAAS,UAAA,EAAY;AAClC,QAAA;AACF,IAAA;IAEA,MAAMC,MAAAA,GAAS,SAACxB,CAAkCwB,MAAM;;AAGxD,IAAA,IAAIA,WAAW,aAAA,EAAe;AAC5B,QAAA;AACF,IAAA;;IAGAF,GAAAA,CAAID,GAAAA,EAAKT,iBAAiBZ,SAAAA,EAAoCa,KAAAA,CAAAA,CAAAA;AAChE,CAAA;AAEA;;;;;;AAMC,IACM,MAAMY,oBAAAA,GAAuB,OAClCC,GAAAA,EACAC,IAAAA,GAAAA;AAEA,IAAA,OAAOC,eACLR,uBAAAA,EACA;QACES,MAAAA,EAAQC,MAAAA,CAAOC,QAAQ,CAACL,GAAAA,CAAAA;AACxBK,QAAAA,QAAAA,EAAUD,MAAAA,CAAOC,QAAQ,CAACC,IAAI,CAACF,MAAAA;AACjC,KAAA;AAEAH,IAAAA,IAAAA,CAAAA;AAEJ;;;;"}