@akemona-org/strapi-admin 3.7.0

package/controllers/authentication.js

@@ -0,0 +1,181 @@
+'use strict';
+
+const passport = require('koa-passport');
+const compose = require('koa-compose');
+
+const {
+  validateRegistrationInput,
+  validateAdminRegistrationInput,
+  validateRegistrationInfoQuery,
+  validateForgotPasswordInput,
+  validateResetPasswordInput,
+} = require('../validation/authentication');
+
+module.exports = {
+  login: compose([
+    (ctx, next) => {
+      return passport.authenticate('local', { session: false }, (err, user, info) => {
+        if (err) {
+          strapi.eventHub.emit('admin.auth.error', { error: err, provider: 'local' });
+          return ctx.badImplementation();
+        }
+
+        if (!user) {
+          strapi.eventHub.emit('admin.auth.error', {
+            error: new Error(info.message),
+            provider: 'local',
+          });
+          return ctx.badRequest(info.message);
+        }
+
+        ctx.state.user = user;
+
+        strapi.eventHub.emit('admin.auth.success', { user, provider: 'local' });
+
+        return next();
+      })(ctx, next);
+    },
+    (ctx) => {
+      const { user } = ctx.state;
+
+      ctx.body = {
+        data: {
+          token: strapi.admin.services.token.createJwtToken(user),
+          user: strapi.admin.services.user.sanitizeUser(ctx.state.user), // TODO: fetch more detailed info
+        },
+      };
+    },
+  ]),
+
+  renewToken(ctx) {
+    const { token } = ctx.request.body;
+
+    if (token === undefined) {
+      return ctx.badRequest('Missing token');
+    }
+
+    const { isValid, payload } = strapi.admin.services.token.decodeJwtToken(token);
+
+    if (!isValid) {
+      return ctx.badRequest('Invalid token');
+    }
+
+    ctx.body = {
+      data: {
+        token: strapi.admin.services.token.createJwtToken({ id: payload.id }),
+      },
+    };
+  },
+
+  async registrationInfo(ctx) {
+    try {
+      await validateRegistrationInfoQuery(ctx.request.query);
+    } catch (err) {
+      return ctx.badRequest('QueryError', err);
+    }
+
+    const { registrationToken } = ctx.request.query;
+
+    const registrationInfo = await strapi.admin.services.user.findRegistrationInfo(
+      registrationToken
+    );
+
+    if (!registrationInfo) {
+      return ctx.badRequest('Invalid registrationToken');
+    }
+
+    ctx.body = { data: registrationInfo };
+  },
+
+  async register(ctx) {
+    const input = ctx.request.body;
+
+    try {
+      await validateRegistrationInput(input);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const user = await strapi.admin.services.user.register(input);
+
+    ctx.body = {
+      data: {
+        token: strapi.admin.services.token.createJwtToken(user),
+        user: strapi.admin.services.user.sanitizeUser(user),
+      },
+    };
+  },
+
+  async registerAdmin(ctx) {
+    const input = ctx.request.body;
+
+    try {
+      await validateAdminRegistrationInput(input);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const hasAdmin = await strapi.admin.services.user.exists();
+
+    if (hasAdmin) {
+      return ctx.badRequest('You cannot register a new super admin');
+    }
+
+    const superAdminRole = await strapi.admin.services.role.getSuperAdmin();
+
+    if (!superAdminRole) {
+      throw new Error(
+        "Cannot register the first admin because the super admin role doesn't exist."
+      );
+    }
+
+    const user = await strapi.admin.services.user.create({
+      ...input,
+      registrationToken: null,
+      isActive: true,
+      roles: superAdminRole ? [superAdminRole.id] : [],
+    });
+
+    // await strapi.telemetry.send('didCreateFirstAdmin');
+
+    ctx.body = {
+      data: {
+        token: strapi.admin.services.token.createJwtToken(user),
+        user: strapi.admin.services.user.sanitizeUser(user),
+      },
+    };
+  },
+
+  async forgotPassword(ctx) {
+    const input = ctx.request.body;
+
+    try {
+      await validateForgotPasswordInput(input);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    strapi.admin.services.auth.forgotPassword(input);
+
+    ctx.status = 204;
+  },
+
+  async resetPassword(ctx) {
+    const input = ctx.request.body;
+
+    try {
+      await validateResetPasswordInput(input);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const user = await strapi.admin.services.auth.resetPassword(input);
+
+    ctx.body = {
+      data: {
+        token: strapi.admin.services.token.createJwtToken(user),
+        user: strapi.admin.services.user.sanitizeUser(user),
+      },
+    };
+  },
+};

package/controllers/formatters/conditions.js

@@ -0,0 +1,12 @@
+'use strict';
+
+const { pick, map } = require('lodash/fp');
+
+// visible fields for the API
+const publicFields = ['id', 'displayName', 'category'];
+
+const formatConditions = map(pick(publicFields));
+
+module.exports = {
+  formatConditions,
+};

package/controllers/formatters/format-actions-by-sections.js

@@ -0,0 +1,37 @@
+'use strict';
+
+/**
+ * Transform an array of actions to a more nested format
+ * @param {Array<Action>} actions - array of actions
+ * @returns {Object} "{ contentTypes, plugins, settings }"
+ */
+const formatActionsBySections = actions =>
+  actions.reduce((result, p) => {
+    const checkboxItem = {
+      displayName: p.displayName,
+      action: p.actionId,
+    };
+
+    switch (p.section) {
+      case 'contentTypes':
+        checkboxItem.subjects = p.subjects;
+        break;
+      case 'plugins':
+        checkboxItem.subCategory = p.subCategory;
+        checkboxItem.plugin = `plugin::${p.pluginName}`;
+        break;
+      case 'settings':
+        checkboxItem.category = p.category;
+        checkboxItem.subCategory = p.subCategory;
+        break;
+      case 'default':
+        throw new Error(`Unknown section ${p.section}`);
+    }
+
+    result[p.section] = result[p.section] || [];
+    result[p.section].push(checkboxItem);
+
+    return result;
+  }, {});
+
+module.exports = formatActionsBySections;

package/controllers/formatters/index.js

@@ -0,0 +1,9 @@
+'use strict';
+
+const formatActionsBySections = require('./format-actions-by-sections');
+const { formatConditions } = require('./conditions');
+
+module.exports = {
+  formatActionsBySections,
+  formatConditions,
+};

package/controllers/permission.js

@@ -0,0 +1,51 @@
+'use strict';
+
+const { validateCheckPermissionsInput } = require('../validation/permission');
+const { getService } = require('../utils');
+const { formatConditions } = require('./formatters');
+
+module.exports = {
+  /**
+   * Check each permissions from `request.body.permissions` and returns an array of booleans
+   * @param {KoaContext} ctx - koa context
+   */
+  async check(ctx) {
+    const { body: input } = ctx.request;
+    const { userAbility } = ctx.state;
+
+    try {
+      await validateCheckPermissionsInput(input);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const { engine } = getService('permission');
+
+    const checkPermissionsFn = engine.checkMany(userAbility);
+
+    ctx.body = {
+      data: checkPermissionsFn(input.permissions),
+    };
+  },
+
+  /**
+   * Returns every permissions, in nested format
+   * @param {KoaContext} ctx - koa context
+   */
+  async getAll(ctx) {
+    const { role: roleId } = ctx.query;
+
+    const { sectionsBuilder, conditionProvider } = getService('permission');
+
+    const actions = await getService('action').getAllowedActionsForRole(roleId);
+    const conditions = conditionProvider.values();
+    const sections = await sectionsBuilder.build(actions);
+
+    ctx.body = {
+      data: {
+        conditions: formatConditions(conditions),
+        sections,
+      },
+    };
+  },
+};

package/controllers/role.js

@@ -0,0 +1,148 @@
+'use strict';
+
+const { yup, formatYupErrors } = require('@akemona-org/strapi-utils');
+const { validateRoleUpdateInput } = require('../validation/role');
+const { validatedUpdatePermissionsInput } = require('../validation/permission');
+const { EDITOR_CODE, AUTHOR_CODE, SUPER_ADMIN_CODE } = require('../services/constants');
+const { getService } = require('../utils');
+
+module.exports = {
+  /**
+   * Returns on role by id
+   * @param {KoaContext} ctx - koa context
+   */
+  async findOne(ctx) {
+    const { id } = ctx.params;
+    const role = await getService('role').findOneWithUsersCount({ id });
+
+    if (!role) {
+      return ctx.notFound('role.notFound');
+    }
+
+    ctx.body = {
+      data: role,
+    };
+  },
+
+  /**
+   * Returns every roles
+   * @param {KoaContext} ctx - koa context
+   */
+  async findAll(ctx) {
+    const roles = await getService('role').findAllWithUsersCount();
+
+    ctx.body = {
+      data: roles,
+    };
+  },
+
+  /**
+   * Updates a role by id
+   * @param {KoaContext} ctx - koa context
+   */
+  async update(ctx) {
+    const { id } = ctx.params;
+    const { body } = ctx.request;
+
+    const roleService = getService('role');
+
+    try {
+      await validateRoleUpdateInput(body);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const role = await roleService.findOne({ id });
+
+    if (!role) {
+      return ctx.notFound('role.notFound');
+    }
+
+    if (role.code === SUPER_ADMIN_CODE) {
+      return ctx.badRequest("Super admin can't be edited.");
+    }
+
+    const updatedRole = await roleService.update({ id }, body);
+    const sanitizedRole = roleService.sanitizeRole(updatedRole);
+
+    ctx.body = {
+      data: sanitizedRole,
+    };
+  },
+
+  /**
+   * Returns the permissions assigned to a role
+   * @param {KoaContext} ctx - koa context
+   */
+  async getPermissions(ctx) {
+    const { id } = ctx.params;
+
+    const roleService = getService('role');
+    const permissionService = getService('permission');
+
+    const role = await roleService.findOne({ id });
+
+    if (!role) {
+      return ctx.notFound('role.notFound');
+    }
+
+    const permissions = await permissionService.find({ role: role.id, _limit: -1 });
+    const sanitizedPermissions = permissions.map(permissionService.sanitizePermission);
+
+    ctx.body = {
+      data: sanitizedPermissions,
+    };
+  },
+
+  /**
+   * Updates the permissions assigned to a role
+   * @param {KoaContext} ctx - koa context
+   */
+  async updatePermissions(ctx) {
+    const { id } = ctx.params;
+    const { body: input } = ctx.request;
+
+    const { findOne, assignPermissions } = getService('role');
+    const { sanitizePermission, actionProvider } = getService('permission');
+
+    const role = await findOne({ id });
+
+    if (!role) {
+      return ctx.notFound('role.notFound');
+    }
+
+    try {
+      if (role.code === SUPER_ADMIN_CODE) {
+        throw formatYupErrors(new yup.ValidationError("Super admin permissions can't be edited."));
+      }
+
+      await validatedUpdatePermissionsInput(input, role);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    let permissionsToAssign;
+
+    if ([EDITOR_CODE, AUTHOR_CODE].includes(role.code)) {
+      permissionsToAssign = input.permissions.map((permission) => {
+        const action = actionProvider.get(permission.action);
+
+        if (action.section !== 'contentTypes') {
+          return permission;
+        }
+
+        const conditions = role.code === AUTHOR_CODE ? ['admin::is-creator'] : [];
+
+        return { ...permission, conditions };
+      });
+    } else {
+      permissionsToAssign = input.permissions;
+    }
+
+    const permissions = await assignPermissions(role.id, permissionsToAssign);
+
+    ctx.body = {
+      data: permissions.map(sanitizePermission),
+    };
+  },
+};

package/controllers/user.js

@@ -0,0 +1,136 @@
+'use strict';
+
+const _ = require('lodash');
+const {
+  validateUserCreationInput,
+  validateUserUpdateInput,
+  validateUsersDeleteInput,
+} = require('../validation/user');
+
+module.exports = {
+  async create(ctx) {
+    const { body } = ctx.request;
+
+    try {
+      await validateUserCreationInput(body);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const attributes = _.pick(body, [
+      'firstname',
+      'lastname',
+      'email',
+      'roles',
+      'preferedLanguage',
+    ]);
+
+    const userAlreadyExists = await strapi.admin.services.user.exists({
+      email: attributes.email,
+    });
+
+    if (userAlreadyExists) {
+      return ctx.badRequest('Email already taken');
+    }
+
+    const createdUser = await strapi.admin.services.user.create(attributes);
+
+    const userInfo = strapi.admin.services.user.sanitizeUser(createdUser);
+
+    // Send 201 created
+    ctx.created({ data: userInfo });
+  },
+
+  async find(ctx) {
+    const method = _.has(ctx.query, '_q') ? 'searchPage' : 'findPage';
+
+    const { results, pagination } = await strapi.admin.services.user[method](ctx.query);
+
+    ctx.body = {
+      data: {
+        results: results.map(strapi.admin.services.user.sanitizeUser),
+        pagination,
+      },
+    };
+  },
+
+  async findOne(ctx) {
+    const { id } = ctx.params;
+
+    const user = await strapi.admin.services.user.findOne({ id });
+
+    if (!user) {
+      return ctx.notFound('User does not exist');
+    }
+
+    ctx.body = {
+      data: strapi.admin.services.user.sanitizeUser(user),
+    };
+  },
+
+  async update(ctx) {
+    const { id } = ctx.params;
+    const { body: input } = ctx.request;
+
+    try {
+      await validateUserUpdateInput(input);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    if (_.has(input, 'email')) {
+      const uniqueEmailCheck = await strapi.admin.services.user.exists({
+        id_ne: id,
+        email: input.email,
+      });
+
+      if (uniqueEmailCheck) {
+        return ctx.badRequest('A user with this email address already exists');
+      }
+    }
+
+    const updatedUser = await strapi.admin.services.user.updateById(id, input);
+
+    if (!updatedUser) {
+      return ctx.notFound('User does not exist');
+    }
+
+    ctx.body = {
+      data: strapi.admin.services.user.sanitizeUser(updatedUser),
+    };
+  },
+
+  async deleteOne(ctx) {
+    const { id } = ctx.params;
+
+    const deletedUser = await strapi.admin.services.user.deleteById(id);
+
+    if (!deletedUser) {
+      return ctx.notFound('User not found');
+    }
+
+    return ctx.deleted({
+      data: strapi.admin.services.user.sanitizeUser(deletedUser),
+    });
+  },
+
+  /**
+   * Delete several users
+   * @param {KoaContext} ctx - koa context
+   */
+  async deleteMany(ctx) {
+    const { body } = ctx.request;
+    try {
+      await validateUsersDeleteInput(body);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const users = await strapi.admin.services.user.deleteByIds(body.ids);
+    const sanitizedUsers = users.map(strapi.admin.services.user.sanitizeUser);
+
+    return ctx.deleted({
+      data: sanitizedUsers,
+    });
+  },
+};

package/doc/change-the-login-page-logo.md

@@ -0,0 +1,28 @@
+# Change the logo of the login page
+
+In order to change the logo of the login page follow these steps:
+
+### 1 Add your new logo in your `./my-project/admin/src/<mylogo>.png`'s folder project (the location doesn't matter)
+
+### 2 Create a configuration file:
+
+**`Path: ./my-project/admin/src/config.js`**
+
+```js
+import MyLogo from './<mylogo>.png';
+
+export const LOGIN_LOGO = MyLogo;
+export const SHOW_TUTORIALS = true;
+```
+
+### 3 Rebuild your app
+
+```js
+# Using yarn
+
+yarn build
+
+# Using npm
+
+npm run build
+```

package/doc/customize-menu.md

@@ -0,0 +1,17 @@
+# Customizing the Admin leftMenu
+
+You can choose which *Content Types* you want to display in the admin.
+
+For example if you want to display only the `user` content type you have to edit the `layout.js` file located in
+`my-project/admin/config/layout.js` as follows:
+
+```js
+module.exports = {
+  contentTypesToShow: [
+    {
+      label: '',
+      destination: 'user'
+    }
+  ],
+};
+```

package/doc/disable-tracking.md

@@ -0,0 +1,16 @@
+# DISCLAIMER:
+
+Google Analytics allows us to analyze the usage of Strapi. The aim is to
+improve the product and helps us to understand how you interact with the Admin.
+
+Note: The collected data are anonymous and aren't sold to anyone!
+
+If you don't want to share your data with us, you can simply modify the `strapi` object in the package.json as follows:
+
+```json
+{
+  "strapi": {
+    "uuid": false
+  }
+}
+```