@akemona-org/strapi-admin 3.7.0

package/package.json

@@ -0,0 +1,129 @@
+{
+  "name": "@akemona-org/strapi-admin",
+  "publishConfig": {
+    "access": "public"
+  },
+  "version": "3.7.0",
+  "description": "Strapi Admin",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/akemona/strapi.git"
+  },
+  "scripts": {
+    "test": "echo \"no tests yet\"",
+    "develop": "webpack-dev-server --config webpack.config.dev.js",
+    "develop:ce": "STRAPI_DISABLE_EE=true webpack-dev-server --config webpack.config.dev.js",
+    "analyze:bundle": "ANALYZE_BUNDLE=true webpack --config webpack.config.dev.js"
+  },
+  "main": "index.js",
+  "dependencies": {
+    "@akemona-org/strapi-helper-plugin": "3.7.0",
+    "@akemona-org/strapi-utils": "3.7.0",
+    "@babel/core": "^7.14.0",
+    "@babel/plugin-proposal-async-generator-functions": "^7.13.15",
+    "@babel/plugin-proposal-class-properties": "^7.12.1",
+    "@babel/plugin-syntax-dynamic-import": "^7.2.0",
+    "@babel/plugin-transform-modules-commonjs": "^7.12.1",
+    "@babel/plugin-transform-runtime": "^7.13.15",
+    "@babel/polyfill": "^7.12.1",
+    "@babel/preset-env": "^7.13.15",
+    "@babel/preset-react": "^7.13.13",
+    "@babel/runtime": "^7.13.17",
+    "@buffetjs/core": "3.3.8",
+    "@buffetjs/custom": "3.3.8",
+    "@buffetjs/hooks": "3.3.8",
+    "@buffetjs/icons": "3.3.8",
+    "@buffetjs/styles": "3.3.8",
+    "@buffetjs/utils": "3.3.8",
+    "@casl/ability": "^4.1.5",
+    "@fingerprintjs/fingerprintjs": "3.1.1",
+    "@fortawesome/fontawesome-free": "^5.15.3",
+    "@fortawesome/fontawesome-svg-core": "^1.2.35",
+    "@fortawesome/free-brands-svg-icons": "^5.15.3",
+    "@fortawesome/free-solid-svg-icons": "^5.15.3",
+    "@fortawesome/react-fontawesome": "^0.1.14",
+    "autoprefixer": "^9.8.6",
+    "axios": "^0.21.1",
+    "babel-loader": "^8.1.0",
+    "bcryptjs": "^2.4.3",
+    "bootstrap": "^4.6.0",
+    "chalk": "^4.1.1",
+    "chokidar": "^3.5.1",
+    "classnames": "^2.3.1",
+    "cross-env": "^7.0.3",
+    "css-loader": "^2.1.1",
+    "duplicate-package-checker-webpack-plugin": "^3.0.0",
+    "execa": "^1.0.0",
+    "file-loader": "^6.2.0",
+    "font-awesome": "^4.7.0",
+    "formik": "^2.2.6",
+    "friendly-errors-webpack-plugin": "^1.7.0",
+    "fs-extra": "^9.1.0",
+    "history": "^4.9.0",
+    "hoist-non-react-statics": "^3.3.0",
+    "html-loader": "^0.5.5",
+    "html-webpack-plugin": "^3.2.0",
+    "immer": "9.0.16",
+    "immutable": "^3.8.2",
+    "invariant": "^2.2.4",
+    "is-wsl": "^2.0.0",
+    "js-cookie": "2.2.1",
+    "jsonwebtoken": "8.5.1",
+    "koa-compose": "4.1.0",
+    "koa-passport": "5.0.0",
+    "lodash": "4.17.21",
+    "match-sorter": "^4.0.2",
+    "mini-css-extract-plugin": "^1.4.0",
+    "moment": "^2.29.4",
+    "p-map": "4.0.0",
+    "passport-local": "1.0.0",
+    "prop-types": "^15.7.2",
+    "qs": "6.10.1",
+    "react": "^16.14.0",
+    "react-copy-to-clipboard": "^5.0.3",
+    "react-dnd": "^10.0.2",
+    "react-dnd-html5-backend": "^10.0.2",
+    "react-dom": "^16.9.0",
+    "react-error-boundary": "3.1.1",
+    "react-fast-compare": "^3.2.0",
+    "react-helmet": "^6.1.0",
+    "react-intl": "4.5.0",
+    "react-is": "^16.12.0",
+    "react-loadable": "^5.5.0",
+    "react-query": "3.13.12",
+    "react-redux": "7.2.3",
+    "react-router": "^5.2.0",
+    "react-router-dom": "^5.0.0",
+    "react-select": "^4.0.2",
+    "react-tooltip": "4.2.18",
+    "react-transition-group": "4.4.1",
+    "react-virtualized": "^9.22.3",
+    "reactstrap": "8.4.1",
+    "redux": "^4.0.1",
+    "redux-immutable": "^4.0.0",
+    "redux-saga": "^0.16.0",
+    "reselect": "^4.0.0",
+    "sanitize.css": "^4.1.0",
+    "semver": "7.3.5",
+    "sift": "13.5.0",
+    "style-loader": "^0.23.1",
+    "styled-components": "^5.2.3",
+    "terser-webpack-plugin": "^1.2.3",
+    "url-loader": "^1.1.2",
+    "video-react": "^0.13.2",
+    "webpack": "^4.46.0",
+    "webpack-cli": "^3.3.12",
+    "webpack-dev-server": "^3.11.2",
+    "webpackbar": "^4.0.0",
+    "yup": "^0.32.9"
+  },
+  "engines": {
+    "node": ">=10.16.0 <=14.x.x",
+    "npm": ">=6.0.0"
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "devDependencies": {
+    "webpack-bundle-analyzer": "4.4.0"
+  },
+  "gitHead": "129a8d6191b55810fd66448dcc47fee829df986c"
+}

package/services/action.js

@@ -0,0 +1,34 @@
+'use strict';
+
+const { isNil } = require('lodash/fp');
+const { getService } = require('../utils');
+const { AUTHOR_CODE, PUBLISH_ACTION } = require('./constants');
+
+// TODO: move actionProvider here instead of in the permission service
+
+/**
+ * Returns actions available for a role.
+ * @param {string|number} roleId
+ * @returns {object[]}
+ */
+const getAllowedActionsForRole = async roleId => {
+  const { actionProvider } = getService('permission');
+
+  if (!isNil(roleId)) {
+    const role = await getService('role').findOne({ id: roleId });
+
+    if (!role) {
+      throw new strapi.errors.notFound('role.notFound');
+    }
+
+    if (role.code === AUTHOR_CODE) {
+      return actionProvider.values().filter(({ actionId }) => actionId !== PUBLISH_ACTION);
+    }
+  }
+
+  return actionProvider.values();
+};
+
+module.exports = {
+  getAllowedActionsForRole,
+};

package/services/auth.js

@@ -0,0 +1,113 @@
+'use strict';
+
+const bcrypt = require('bcryptjs');
+const _ = require('lodash');
+const { getAbsoluteAdminUrl } = require('@akemona-org/strapi-utils');
+
+/**
+ * hashes a password
+ * @param {string} password - password to hash
+ * @returns {string} hashed password
+ */
+const hashPassword = (password) => bcrypt.hash(password, 10);
+
+/**
+ * Validate a password
+ * @param {string} password
+ * @param {string} hash
+ * @returns {boolean} is the password valid
+ */
+const validatePassword = (password, hash) => bcrypt.compare(password, hash);
+
+/**
+ * Check login credentials
+ * @param {Object} options
+ * @param {string} options.email
+ * @param {string} options.password
+ */
+const checkCredentials = async ({ email, password }) => {
+  const user = await strapi.query('user', 'admin').findOne({ email });
+
+  if (!user || !user.password) {
+    return [null, false, { message: 'Invalid credentials' }];
+  }
+
+  const isValid = await validatePassword(password, user.password);
+
+  if (!isValid) {
+    return [null, false, { message: 'Invalid credentials' }];
+  }
+
+  if (!(user.isActive === true)) {
+    return [null, false, { message: 'User not active' }];
+  }
+
+  return [null, user];
+};
+
+/**
+ * Send an email to the user if it exists or do nothing
+ * @param {Object} param params
+ * @param {string} param.email user email for which to reset the password
+ */
+const forgotPassword = async ({ email } = {}) => {
+  const user = await strapi.query('user', 'admin').findOne({ email, isActive: true });
+
+  if (!user) {
+    return;
+  }
+
+  const resetPasswordToken = strapi.admin.services.token.createToken();
+  await strapi.admin.services.user.updateById(user.id, { resetPasswordToken });
+
+  // Send an email to the admin.
+  const url = `${getAbsoluteAdminUrl(
+    strapi.config
+  )}/auth/reset-password?code=${resetPasswordToken}`;
+  return strapi.plugins.email.services.email
+    .sendTemplatedEmail(
+      {
+        to: user.email,
+        from: strapi.config.get('server.admin.forgotPassword.from'),
+        replyTo: strapi.config.get('server.admin.forgotPassword.replyTo'),
+      },
+      strapi.config.get('server.admin.forgotPassword.emailTemplate'),
+      {
+        url,
+        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),
+      }
+    )
+    .catch((err) => {
+      // log error server side but do not disclose it to the user to avoid leaking informations
+      strapi.log.error(err);
+    });
+};
+
+/**
+ * Reset a user password
+ * @param {Object} param params
+ * @param {string} param.resetPasswordToken token generated to request a password reset
+ * @param {string} param.password new user password
+ */
+const resetPassword = async ({ resetPasswordToken, password } = {}) => {
+  const matchingUser = await strapi
+    .query('user', 'admin')
+    .findOne({ resetPasswordToken, isActive: true });
+
+  if (!matchingUser) {
+    throw strapi.errors.badRequest();
+  }
+
+  return strapi.admin.services.user.updateById(matchingUser.id, {
+    password,
+    resetPasswordToken: null,
+  });
+};
+
+module.exports = {
+  checkCredentials,
+  validatePassword,
+  hashPassword,
+  forgotPassword,
+  resetPassword,
+};

package/services/condition.js

@@ -0,0 +1,14 @@
+'use strict';
+
+const { isString } = require('lodash/fp');
+const { getService } = require('../utils');
+
+const isValidCondition = condition => {
+  const { conditionProvider } = getService('permission');
+
+  return isString(condition) && conditionProvider.has(condition);
+};
+
+module.exports = {
+  isValidCondition,
+};

package/services/constants.js

@@ -0,0 +1,12 @@
+'use strict';
+
+module.exports = {
+  SUPER_ADMIN_CODE: 'strapi-super-admin',
+  EDITOR_CODE: 'strapi-editor',
+  AUTHOR_CODE: 'strapi-author',
+  READ_ACTION: 'plugins::content-manager.explorer.read',
+  CREATE_ACTION: 'plugins::content-manager.explorer.create',
+  UPDATE_ACTION: 'plugins::content-manager.explorer.update',
+  DELETE_ACTION: 'plugins::content-manager.explorer.delete',
+  PUBLISH_ACTION: 'plugins::content-manager.explorer.publish',
+};

package/services/content-type.js

@@ -0,0 +1,208 @@
+'use strict';
+
+const _ = require('lodash');
+const { uniq, startsWith, intersection } = require('lodash/fp');
+const { contentTypes: contentTypesUtils } = require('@akemona-org/strapi-utils');
+const { getService } = require('../utils');
+const actionDomain = require('../domain/action');
+const permissionDomain = require('../domain/permission');
+
+/**
+ * Creates an array of paths to the fields and nested fields, without path nodes
+ * @param {string} model model used to get the nested fields
+ * @param {Object} options
+ * @param {string} options.prefix prefix to add to the path
+ * @param {number} options.nestingLevel level of nesting to achieve
+ * @param {object} options.components components where components attributes can be found
+ * @param {object} options.requiredOnly only returns required nestedFields
+ * @param {object} options.existingFields fields that are already selected, meaning that some sub-fields may be required
+ * @returns {array<string>}
+ * @param model
+ */
+const getNestedFields = (
+  model,
+  { prefix = '', nestingLevel = 15, components = {}, requiredOnly = false, existingFields = [] }
+) => {
+  if (nestingLevel === 0) {
+    return prefix ? [prefix] : [];
+  }
+
+  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);
+
+  return _.reduce(
+    model.attributes,
+    (fields, attr, key) => {
+      if (nonAuthorizableFields.includes(key)) return fields;
+
+      const fieldPath = prefix ? `${prefix}.${key}` : key;
+      const requiredOrNotNeeded = !requiredOnly || attr.required === true;
+      const insideExistingFields = existingFields && existingFields.some(startsWith(fieldPath));
+
+      if (attr.type === 'component') {
+        if (requiredOrNotNeeded || insideExistingFields) {
+          const compoFields = getNestedFields(components[attr.component], {
+            nestingLevel: nestingLevel - 1,
+            prefix: fieldPath,
+            components,
+            requiredOnly,
+            existingFields,
+          });
+
+          if (requiredOnly && compoFields.length === 0 && attr.required) {
+            return fields.concat(fieldPath);
+          }
+
+          return fields.concat(compoFields);
+        }
+        return fields;
+      }
+
+      if (requiredOrNotNeeded) {
+        return fields.concat(fieldPath);
+      }
+
+      return fields;
+    },
+    []
+  );
+};
+
+/**
+ * Creates an array of paths to the fields and nested fields, with path nodes
+ * @param {string} model model used to get the nested fields
+ * @param {Object} options
+ * @param {string} options.prefix prefix to add to the path
+ * @param {number} options.nestingLevel level of nesting to achieve
+ * @param {object} options.components components where components attributes can be found
+ * @returns {array<string>}
+ */
+
+const getNestedFieldsWithIntermediate = (
+  model,
+  { prefix = '', nestingLevel = 15, components = {} }
+) => {
+  if (nestingLevel === 0) {
+    return [];
+  }
+
+  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);
+
+  return _.reduce(
+    model.attributes,
+    (fields, attr, key) => {
+      if (nonAuthorizableFields.includes(key)) return fields;
+
+      const fieldPath = prefix ? `${prefix}.${key}` : key;
+      fields.push(fieldPath);
+
+      if (attr.type === 'component') {
+        const compoFields = getNestedFieldsWithIntermediate(components[attr.component], {
+          nestingLevel: nestingLevel - 1,
+          prefix: fieldPath,
+          components,
+        });
+
+        fields.push(...compoFields);
+      }
+
+      return fields;
+    },
+    []
+  );
+};
+
+/**
+ * Creates an array of permissions with the "properties.fields" attribute filled
+ * @param {array} actions array of actions
+ * @param {object} options
+ * @param {number} options.nestingLevel level of nesting
+ * @param {array} options.restrictedSubjects subjectsId to ignore
+ * @returns {Permission[]}
+ */
+const getPermissionsWithNestedFields = (
+  actions,
+  { nestingLevel, restrictedSubjects = [] } = {}
+) => {
+  return actions.reduce((permissions, action) => {
+    const validSubjects = action.subjects.filter(
+      (subject) => !restrictedSubjects.includes(subject)
+    );
+
+    // Create a Permission for each subject (content-type uid) within the action
+    for (const subject of validSubjects) {
+      const fields = actionDomain.appliesToProperty('fields', action)
+        ? getNestedFields(strapi.contentTypes[subject], {
+            components: strapi.components,
+            nestingLevel,
+          })
+        : undefined;
+
+      const permission = permissionDomain.create({
+        action: action.actionId,
+        subject,
+        properties: { fields },
+      });
+
+      permissions.push(permission);
+    }
+
+    return permissions;
+  }, []);
+};
+
+/**
+ * Cleans permissions' fields (add required ones, remove the non-existing ones)
+ * @param {Permission[]} permissions array of existing permissions in db
+ * @param {object} options
+ * @param {number} options.nestingLevel level of nesting
+ * @returns {Permission[]}
+ */
+const cleanPermissionFields = (permissions, { nestingLevel } = {}) => {
+  const { actionProvider } = getService('permission');
+
+  return permissions.map((permission) => {
+    const {
+      action: actionId,
+      subject,
+      properties: { fields },
+    } = permission;
+
+    const action = actionProvider.get(actionId);
+
+    // todo see if it's possible to check property on action + subject (async)
+    if (!actionDomain.appliesToProperty('fields', action)) {
+      return permissionDomain.deleteProperty('fields', permission);
+    }
+
+    if (!subject || !strapi.contentTypes[subject]) {
+      return permission;
+    }
+
+    const possibleFields = getNestedFieldsWithIntermediate(strapi.contentTypes[subject], {
+      components: strapi.components,
+      nestingLevel,
+    });
+
+    const requiredFields = getNestedFields(strapi.contentTypes[subject], {
+      components: strapi.components,
+      requiredOnly: true,
+      nestingLevel,
+      existingFields: fields,
+    });
+
+    const badNestedFields = uniq([...intersection(fields, possibleFields), ...requiredFields]);
+
+    const newFields = badNestedFields.filter(
+      (field) => !badNestedFields.some(startsWith(`${field}.`))
+    );
+
+    return permissionDomain.setProperty('fields', newFields, permission);
+  }, []);
+};
+
+module.exports = {
+  getNestedFields,
+  getPermissionsWithNestedFields,
+  cleanPermissionFields,
+  getNestedFieldsWithIntermediate,
+};

package/services/metrics.js

@@ -0,0 +1,18 @@
+'use strict';
+
+const sendDidInviteUser = async () => {
+  // const numberOfUsers = await strapi.admin.services.user.count();
+  // const numberOfRoles = await strapi.admin.services.role.count();
+  // return strapi.telemetry.send('didInviteUser', { numberOfRoles, numberOfUsers });
+  return true;
+};
+
+const sendDidUpdateRolePermissions = async () => {
+  // return strapi.telemetry.send('didUpdateRolePermissions');
+  return true;
+};
+
+module.exports = {
+  sendDidInviteUser,
+  sendDidUpdateRolePermissions,
+};

package/services/passport/local-strategy.js

@@ -0,0 +1,21 @@
+'use strict';
+
+const { Strategy: LocalStrategy } = require('passport-local');
+
+const createLocalStrategy = strapi => {
+  return new LocalStrategy(
+    {
+      usernameField: 'email',
+      passwordField: 'password',
+      session: false,
+    },
+    (email, password, done) => {
+      return strapi.admin.services.auth
+        .checkCredentials({ email, password })
+        .then(([error, user, message]) => done(error, user, message))
+        .catch(error => done(error));
+    }
+  );
+};
+
+module.exports = createLocalStrategy;

package/services/passport.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const passport = require('koa-passport');
+const { isFunction } = require('lodash/fp');
+
+const createLocalStrategy = require('./passport/local-strategy');
+
+const authEventsMapper = {
+  onConnectionSuccess: 'admin.auth.success',
+  onConnectionError: 'admin.auth.error',
+};
+
+const valueIsFunctionType = ([, value]) => isFunction(value);
+const keyIsValidEventName = ([key]) => {
+  return Object.keys(strapi.admin.services.passport.authEventsMapper).includes(key);
+};
+
+const getPassportStrategies = () => [createLocalStrategy(strapi)];
+
+const registerAuthEvents = () => {
+  const { events = {} } = strapi.config.get('server.admin.auth', {});
+  const { authEventsMapper } = strapi.admin.services.passport;
+
+  const eventList = Object.entries(events)
+    .filter(keyIsValidEventName)
+    .filter(valueIsFunctionType);
+
+  for (const [eventName, handler] of eventList) {
+    strapi.eventHub.on(authEventsMapper[eventName], handler);
+  }
+};
+
+const init = () => {
+  strapi.admin.services.passport
+    .getPassportStrategies()
+    .forEach(strategy => passport.use(strategy));
+
+  registerAuthEvents();
+
+  return passport.initialize();
+};
+
+module.exports = {
+  init,
+  getPassportStrategies,
+  authEventsMapper,
+};

package/services/permission/engine-hooks.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const { cloneDeep, has } = require('lodash/fp');
+const { hooks } = require('@akemona-org/strapi-utils');
+
+const permissionDomain = require('../../domain/permission');
+
+/**
+ * Create a hook map used by the permission Engine
+ */
+const createEngineHooks = () => ({
+  willEvaluatePermission: hooks.createAsyncSeriesHook(),
+  willRegisterPermission: hooks.createAsyncSeriesHook(),
+});
+
+/**
+ * Create a context from a domain {@link Permission} used by the WillEvaluate hook
+ * @param {Permission} permission
+ * @return {{readonly permission: Permission, addCondition(string): this}}
+ */
+const createWillEvaluateContext = (permission) => ({
+  get permission() {
+    return cloneDeep(permission);
+  },
+
+  addCondition(condition) {
+    Object.assign(permission, permissionDomain.addCondition(condition, permission));
+
+    return this;
+  },
+});
+
+/**
+ * Create a context from a casl Permission & some options
+ * @param caslPermission
+ * @param {object} options
+ * @param {Permission} options.permission
+ * @param {object} options.user
+ */
+const createWillRegisterContext = (caslPermission, { permission, user }) => ({
+  get permission() {
+    return cloneDeep(permission);
+  },
+
+  get user() {
+    return cloneDeep(user);
+  },
+
+  condition: {
+    and(rawConditionObject) {
+      if (!caslPermission.condition) {
+        Object.assign(caslPermission, { condition: { $and: [] } });
+      }
+
+      caslPermission.condition.$and.push(rawConditionObject);
+
+      return this;
+    },
+
+    or(rawConditionObject) {
+      if (!caslPermission.condition) {
+        Object.assign(caslPermission, { condition: { $and: [] } });
+      }
+
+      const orClause = caslPermission.condition.$and.find(has('$or'));
+
+      if (orClause) {
+        orClause.$or.push(rawConditionObject);
+      } else {
+        caslPermission.condition.$and.push({ $or: [rawConditionObject] });
+      }
+
+      return this;
+    },
+  },
+});
+
+module.exports = {
+  createEngineHooks,
+  createWillEvaluateContext,
+  createWillRegisterContext,
+};