From 1d54d287e1fd7b2f7e5c39badb04eaf7a868edb9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20FAMIBELLE-PRONZOLA?= <c.pronzola@tuta.io>
Date: Sat, 4 Jul 2026 15:04:18 +0400
Subject: [PATCH] fix: retirer createdBy/updatedBy du payload dans beforeUpdate

---
 .../parole/__tests__/lifecycles.test.js       | 25 +++++++++++++++++++
 .../parole/content-types/parole/lifecycles.js |  4 +++
 types/generated/contentTypes.d.ts             |  7 +++---
 3 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/src/api/parole/content-types/parole/__tests__/lifecycles.test.js b/src/api/parole/content-types/parole/__tests__/lifecycles.test.js
index a93d267..5460350 100644
--- a/src/api/parole/content-types/parole/__tests__/lifecycles.test.js
+++ b/src/api/parole/content-types/parole/__tests__/lifecycles.test.js
@@ -118,6 +118,31 @@ describe('beforeUpdate — notifications Telegram/Revolt', () => {
   })
 })
 
+describe('beforeUpdate — createdBy/updatedBy', () => {
+  afterEach(() => {
+    delete global.strapi
+  })
+
+  it('retire createdBy/updatedBy du payload avant la mise à jour', async () => {
+    const dbQuery = {findOne: vi.fn(async () => ({publishedAt: null, artistes: []}))}
+    const strapiMock = {db: {query: vi.fn(() => dbQuery)}}
+
+    const {beforeUpdate} = await loadLifecycles(strapiMock)
+
+    const event = {
+      state: {},
+      params: {
+        data: {documentId: 'doc-1', createdBy: 999, updatedBy: 999}
+      }
+    }
+
+    await beforeUpdate(event)
+
+    expect(event.params.data.createdBy).toBeUndefined()
+    expect(event.params.data.updatedBy).toBeUndefined()
+  })
+})
+
 describe('afterUpdate — historique de différence', () => {
   afterEach(() => {
     delete global.strapi
diff --git a/src/api/parole/content-types/parole/lifecycles.js b/src/api/parole/content-types/parole/lifecycles.js
index fbc8c15..e1b7494 100644
--- a/src/api/parole/content-types/parole/lifecycles.js
+++ b/src/api/parole/content-types/parole/lifecycles.js
@@ -142,6 +142,10 @@ module.exports = {
   beforeUpdate: async event => {
     const {state} = event
     let {data} = event.params
+
+    delete data.createdBy
+    delete data.updatedBy
+
     const {documentId} = data
 
     if (data.isNewRelease === true) {
diff --git a/types/generated/contentTypes.d.ts b/types/generated/contentTypes.d.ts
index 89f6933..527838e 100644
--- a/types/generated/contentTypes.d.ts
+++ b/types/generated/contentTypes.d.ts
@@ -521,6 +521,7 @@ export interface ApiParoleParole extends Struct.CollectionTypeSchema {
   };
   options: {
     draftAndPublish: true;
+    populateCreatorFields: true;
   };
   attributes: {
     annee: Schema.Attribute.Integer;
@@ -531,8 +532,7 @@ export interface ApiParoleParole extends Struct.CollectionTypeSchema {
     >;
     couverture: Schema.Attribute.Media<'images'>;
     createdAt: Schema.Attribute.DateTime;
-    createdBy: Schema.Attribute.Relation<'oneToOne', 'admin::user'> &
-      Schema.Attribute.Private;
+    createdBy: Schema.Attribute.Relation<'oneToOne', 'admin::user'>;
     creativeCommons: Schema.Attribute.Enumeration<
       ['BY', 'BY-SA', 'BY-ND', 'BY-NC', 'BY-NC-SA', 'BY-NC-ND']
     >;
@@ -576,8 +576,7 @@ export interface ApiParoleParole extends Struct.CollectionTypeSchema {
     traductions: Schema.Attribute.Component<'trad.traductions', false>;
     transcription: Schema.Attribute.RichText & Schema.Attribute.Required;
     updatedAt: Schema.Attribute.DateTime;
-    updatedBy: Schema.Attribute.Relation<'oneToOne', 'admin::user'> &
-      Schema.Attribute.Private;
+    updatedBy: Schema.Attribute.Relation<'oneToOne', 'admin::user'>;
     user: Schema.Attribute.Relation<
       'oneToOne',
       'plugin::users-permissions.user'