@akemona-org/strapi-plugin-users-permissions 3.7.0

package/controllers/User.js

@@ -0,0 +1,125 @@
+'use strict';
+
+/**
+ * User.js controller
+ *
+ * @description: A set of functions called "actions" for managing `User`.
+ */
+
+const _ = require('lodash');
+const { sanitizeEntity } = require('@akemona-org/strapi-utils');
+const adminUserController = require('./user/admin');
+const apiUserController = require('./user/api');
+
+const sanitizeUser = (user) =>
+  sanitizeEntity(user, {
+    model: strapi.query('user', 'users-permissions').model,
+  });
+
+const resolveController = (ctx) => {
+  const {
+    state: { isAuthenticatedAdmin },
+  } = ctx;
+
+  return isAuthenticatedAdmin ? adminUserController : apiUserController;
+};
+
+const resolveControllerMethod = (method) => (ctx) => {
+  const controller = resolveController(ctx);
+  const callbackFn = controller[method];
+
+  if (!_.isFunction(callbackFn)) {
+    return ctx.notFound();
+  }
+
+  return callbackFn(ctx);
+};
+
+module.exports = {
+  create: resolveControllerMethod('create'),
+  update: resolveControllerMethod('update'),
+
+  /**
+   * Retrieve user records.
+   * @return {Object|Array}
+   */
+  async find(ctx, next, { populate } = {}) {
+    let users;
+
+    if (_.has(ctx.query, '_q')) {
+      // use core strapi query to search for users
+      users = await strapi.query('user', 'users-permissions').search(ctx.query, populate);
+    } else {
+      users = await strapi.plugins['users-permissions'].services.user.fetchAll(ctx.query, populate);
+    }
+
+    ctx.body = users.map(sanitizeUser);
+  },
+
+  /**
+   * Retrieve a user record.
+   * @return {Object}
+   */
+  async findOne(ctx) {
+    const { id } = ctx.params;
+    let data = await strapi.plugins['users-permissions'].services.user.fetch({
+      id,
+    });
+
+    if (data) {
+      data = sanitizeUser(data);
+    }
+
+    // Send 200 `ok`
+    ctx.body = data;
+  },
+
+  /**
+   * Retrieve user count.
+   * @return {Number}
+   */
+  async count(ctx) {
+    if (_.has(ctx.query, '_q')) {
+      return await strapi.plugins['users-permissions'].services.user.countSearch(ctx.query);
+    }
+    ctx.body = await strapi.plugins['users-permissions'].services.user.count(ctx.query);
+  },
+
+  /**
+   * Destroy a/an user record.
+   * @return {Object}
+   */
+  async destroy(ctx) {
+    const { id } = ctx.params;
+    const data = await strapi.plugins['users-permissions'].services.user.remove({ id });
+    ctx.send(sanitizeUser(data));
+  },
+
+  async destroyAll(ctx) {
+    const {
+      request: { query },
+    } = ctx;
+
+    const toRemove = Object.values(_.omit(query, 'source'));
+    const { primaryKey } = strapi.query('user', 'users-permissions');
+    const finalQuery = { [`${primaryKey}_in`]: toRemove, _limit: 100 };
+
+    const data = await strapi.plugins['users-permissions'].services.user.removeAll(finalQuery);
+
+    ctx.send(data);
+  },
+
+  /**
+   * Retrieve authenticated user.
+   * @return {Object|Array}
+   */
+  async me(ctx) {
+    const user = ctx.state.user;
+
+    if (!user) {
+      return ctx.badRequest(null, [{ messages: [{ id: 'No authorization header was found' }] }]);
+    }
+
+    ctx.body = sanitizeUser(user);
+  },
+};

package/controllers/UsersPermissions.js

@@ -0,0 +1,291 @@
+'use strict';
+
+/**
+ * UsersPermissions.js controller
+ *
+ * @description: A set of functions called "actions" of the `users-permissions` plugin.
+ */
+
+const _ = require('lodash');
+const { isValidEmailTemplate } = require('./validation/email-template');
+
+module.exports = {
+  /**
+   * Default action.
+   *
+   * @return {Object}
+   */
+  async createRole(ctx) {
+    if (_.isEmpty(ctx.request.body)) {
+      return ctx.badRequest(null, [{ messages: [{ id: 'Cannot be empty' }] }]);
+    }
+
+    try {
+      await strapi.plugins['users-permissions'].services.userspermissions.createRole(
+        ctx.request.body
+      );
+
+      ctx.send({ ok: true });
+    } catch (err) {
+      strapi.log.error(err);
+      ctx.badRequest(null, [{ messages: [{ id: 'An error occured' }] }]);
+    }
+  },
+
+  async deleteRole(ctx) {
+    // Fetch public role.
+    const publicRole = await strapi.query('role', 'users-permissions').findOne({ type: 'public' });
+
+    const publicRoleID = publicRole.id;
+
+    const roleID = ctx.params.role;
+
+    if (!roleID) {
+      return ctx.badRequest(null, [{ messages: [{ id: 'Bad request' }] }]);
+    }
+
+    // Prevent from removing the public role.
+    if (roleID.toString() === publicRoleID.toString()) {
+      return ctx.badRequest(null, [{ messages: [{ id: 'Unauthorized' }] }]);
+    }
+
+    try {
+      await strapi.plugins['users-permissions'].services.userspermissions.deleteRole(
+        roleID,
+        publicRoleID
+      );
+
+      ctx.send({ ok: true });
+    } catch (err) {
+      strapi.log.error(err);
+      ctx.badRequest(null, [{ messages: [{ id: 'Bad request' }] }]);
+    }
+  },
+
+  async getPermissions(ctx) {
+    try {
+      const permissions = await strapi.plugins[
+        'users-permissions'
+      ].services.userspermissions.getActions();
+
+      ctx.send({ permissions });
+    } catch (err) {
+      ctx.badRequest(null, [{ message: [{ id: 'Not Found' }] }]);
+    }
+  },
+
+  async getPolicies(ctx) {
+    ctx.send({
+      policies: _.without(
+        _.keys(strapi.plugins['users-permissions'].config.policies),
+        'permissions'
+      ),
+    });
+  },
+
+  async getRole(ctx) {
+    const { id } = ctx.params;
+    const { lang } = ctx.query;
+    const plugins = await strapi.plugins['users-permissions'].services.userspermissions.getPlugins(
+      lang
+    );
+    const role = await strapi.plugins['users-permissions'].services.userspermissions.getRole(
+      id,
+      plugins
+    );
+
+    if (_.isEmpty(role)) {
+      return ctx.badRequest(null, [{ messages: [{ id: `Role don't exist` }] }]);
+    }
+
+    ctx.send({ role });
+  },
+
+  async getRoles(ctx) {
+    try {
+      const roles = await strapi.plugins['users-permissions'].services.userspermissions.getRoles();
+
+      ctx.send({ roles });
+    } catch (err) {
+      ctx.badRequest(null, [{ messages: [{ id: 'Not found' }] }]);
+    }
+  },
+
+  async getRoutes(ctx) {
+    try {
+      const routes = await strapi.plugins[
+        'users-permissions'
+      ].services.userspermissions.getRoutes();
+
+      ctx.send({ routes });
+    } catch (err) {
+      ctx.badRequest(null, [{ messages: [{ id: 'Not found' }] }]);
+    }
+  },
+
+  async index(ctx) {
+    // Send 200 `ok`
+    ctx.send({ message: 'ok' });
+  },
+
+  async searchUsers(ctx) {
+    const { id } = ctx.params;
+
+    const data = await strapi.query('user', 'users-permissions').custom(searchQueries)({
+      id,
+    });
+
+    ctx.send(data);
+  },
+
+  async updateRole(ctx) {
+    const roleID = ctx.params.role;
+
+    if (_.isEmpty(ctx.request.body)) {
+      return ctx.badRequest(null, [{ messages: [{ id: 'Bad request' }] }]);
+    }
+
+    try {
+      await strapi.plugins['users-permissions'].services.userspermissions.updateRole(
+        roleID,
+        ctx.request.body
+      );
+
+      ctx.send({ ok: true });
+    } catch (err) {
+      strapi.log.error(err);
+      ctx.badRequest(null, [{ messages: [{ id: 'An error occurred' }] }]);
+    }
+  },
+
+  async getEmailTemplate(ctx) {
+    ctx.send(
+      await strapi
+        .store({
+          environment: '',
+          type: 'plugin',
+          name: 'users-permissions',
+          key: 'email',
+        })
+        .get()
+    );
+  },
+
+  async updateEmailTemplate(ctx) {
+    if (_.isEmpty(ctx.request.body)) {
+      return ctx.badRequest(null, [{ messages: [{ id: 'Cannot be empty' }] }]);
+    }
+
+    const emailTemplates = ctx.request.body['email-templates'];
+
+    for (let key in emailTemplates) {
+      const template = emailTemplates[key].options.message;
+
+      if (!isValidEmailTemplate(template)) {
+        return ctx.badRequest(null, [{ messages: [{ id: 'Invalid template' }] }]);
+      }
+    }
+
+    await strapi
+      .store({
+        environment: '',
+        type: 'plugin',
+        name: 'users-permissions',
+        key: 'email',
+      })
+      .set({ value: emailTemplates });
+
+    ctx.send({ ok: true });
+  },
+
+  async getAdvancedSettings(ctx) {
+    ctx.send({
+      settings: await strapi
+        .store({
+          environment: '',
+          type: 'plugin',
+          name: 'users-permissions',
+          key: 'advanced',
+        })
+        .get(),
+      roles: await strapi.plugins['users-permissions'].services.userspermissions.getRoles(),
+    });
+  },
+
+  async updateAdvancedSettings(ctx) {
+    if (_.isEmpty(ctx.request.body)) {
+      return ctx.badRequest(null, [{ messages: [{ id: 'Cannot be empty' }] }]);
+    }
+
+    await strapi
+      .store({
+        environment: '',
+        type: 'plugin',
+        name: 'users-permissions',
+        key: 'advanced',
+      })
+      .set({ value: ctx.request.body });
+
+    ctx.send({ ok: true });
+  },
+
+  async getProviders(ctx) {
+    const providers = await strapi
+      .store({
+        environment: '',
+        type: 'plugin',
+        name: 'users-permissions',
+        key: 'grant',
+      })
+      .get();
+
+    for (const provider in providers) {
+      if (provider !== 'email') {
+        providers[provider].redirectUri = strapi.plugins[
+          'users-permissions'
+        ].services.providers.buildRedirectUri(provider);
+      }
+    }
+
+    ctx.send(providers);
+  },
+
+  async updateProviders(ctx) {
+    if (_.isEmpty(ctx.request.body)) {
+      return ctx.badRequest(null, [{ messages: [{ id: 'Cannot be empty' }] }]);
+    }
+
+    await strapi
+      .store({
+        environment: '',
+        type: 'plugin',
+        name: 'users-permissions',
+        key: 'grant',
+      })
+      .set({ value: ctx.request.body.providers });
+
+    ctx.send({ ok: true });
+  },
+};
+
+const searchQueries = {
+  bookshelf({ model }) {
+    return ({ id }) => {
+      return model
+        .query(function(qb) {
+          qb.where('username', 'LIKE', `%${id}%`).orWhere('email', 'LIKE', `%${id}%`);
+        })
+        .fetchAll()
+        .then(results => results.toJSON());
+    };
+  },
+  mongoose({ model }) {
+    return ({ id }) => {
+      const re = new RegExp(id);
+
+      return model.find({
+        $or: [{ username: re }, { email: re }],
+      });
+    };
+  },
+};

package/controllers/user/admin.js

@@ -0,0 +1,224 @@
+'use strict';
+
+const _ = require('lodash');
+
+const { contentTypes: contentTypesUtils } = require('@akemona-org/strapi-utils');
+
+const { UPDATED_BY_ATTRIBUTE, CREATED_BY_ATTRIBUTE } = contentTypesUtils.constants;
+
+const formatError = (error) => [
+  { messages: [{ id: error.id, message: error.message, field: error.field }] },
+];
+
+const userModel = 'plugins::users-permissions.user';
+const ACTIONS = {
+  read: 'plugins::content-manager.explorer.read',
+  create: 'plugins::content-manager.explorer.create',
+  edit: 'plugins::content-manager.explorer.update',
+  delete: 'plugins::content-manager.explorer.delete',
+};
+
+const findEntityAndCheckPermissions = async (ability, action, model, id) => {
+  const entity = await strapi.query('user', 'users-permissions').findOne({ id });
+
+  if (_.isNil(entity)) {
+    throw strapi.errors.notFound();
+  }
+
+  const pm = strapi.admin.services.permission.createPermissionsManager({ ability, action, model });
+
+  const roles = _.has(entity, `${CREATED_BY_ATTRIBUTE}.id`)
+    ? await strapi.query('role', 'admin').find({ 'users.id': entity[CREATED_BY_ATTRIBUTE].id }, [])
+    : [];
+  const entityWithRoles = _.set(_.cloneDeep(entity), `${CREATED_BY_ATTRIBUTE}.roles`, roles);
+
+  if (pm.ability.cannot(pm.action, pm.toSubject(entityWithRoles))) {
+    throw strapi.errors.forbidden();
+  }
+
+  return { pm, entity };
+};
+
+module.exports = {
+  /**
+   * Create a/an user record.
+   * @return {Object}
+   */
+  async create(ctx) {
+    const {
+      request: { body },
+      state: { userAbility, admin },
+    } = ctx;
+    const { email, username, password } = body;
+
+    const pm = strapi.admin.services.permission.createPermissionsManager({
+      ability: userAbility,
+      action: ACTIONS.create,
+      model: userModel,
+    });
+
+    if (!pm.isAllowed) {
+      throw strapi.errors.forbidden();
+    }
+
+    const sanitizedBody = pm.pickPermittedFieldsOf(body, { subject: userModel });
+
+    const advanced = await strapi
+      .store({
+        environment: '',
+        type: 'plugin',
+        name: 'users-permissions',
+        key: 'advanced',
+      })
+      .get();
+
+    if (!email) return ctx.badRequest('missing.email');
+    if (!username) return ctx.badRequest('missing.username');
+    if (!password) return ctx.badRequest('missing.password');
+
+    const userWithSameUsername = await strapi
+      .query('user', 'users-permissions')
+      .findOne({ username });
+
+    if (userWithSameUsername) {
+      return ctx.badRequest(
+        null,
+        formatError({
+          id: 'Auth.form.error.username.taken',
+          message: 'Username already taken.',
+          field: ['username'],
+        })
+      );
+    }
+
+    if (advanced.unique_email) {
+      const userWithSameEmail = await strapi
+        .query('user', 'users-permissions')
+        .findOne({ email: email.toLowerCase() });
+
+      if (userWithSameEmail) {
+        return ctx.badRequest(
+          null,
+
+          formatError({
+            id: 'Auth.form.error.email.taken',
+            message: 'Email already taken.',
+            field: ['email'],
+          })
+        );
+      }
+    }
+
+    const user = {
+      ...sanitizedBody,
+      provider: 'local',
+      [CREATED_BY_ATTRIBUTE]: admin.id,
+      [UPDATED_BY_ATTRIBUTE]: admin.id,
+    };
+
+    user.email = user.email.toLowerCase();
+
+    if (!user.role) {
+      const defaultRole = await strapi
+        .query('role', 'users-permissions')
+        .findOne({ type: advanced.default_role }, []);
+
+      user.role = defaultRole.id;
+    }
+
+    try {
+      const data = await strapi.plugins['users-permissions'].services.user.add(user);
+
+      ctx.created(pm.sanitize(data, { action: ACTIONS.read }));
+    } catch (error) {
+      ctx.badRequest(null, formatError(error));
+    }
+  },
+  /**
+   * Update a/an user record.
+   * @return {Object}
+   */
+
+  async update(ctx) {
+    const advancedConfigs = await strapi
+      .store({
+        environment: '',
+        type: 'plugin',
+        name: 'users-permissions',
+        key: 'advanced',
+      })
+      .get();
+
+    const {
+      params: { id },
+      request: { body },
+      state: { userAbility, admin },
+    } = ctx;
+    const { email, username, password } = body;
+
+    const { pm, entity: user } = await findEntityAndCheckPermissions(
+      userAbility,
+      ACTIONS.edit,
+      userModel,
+      id
+    );
+
+    if (_.has(body, 'email') && !email) {
+      return ctx.badRequest('email.notNull');
+    }
+
+    if (_.has(body, 'username') && !username) {
+      return ctx.badRequest('username.notNull');
+    }
+
+    if (_.has(body, 'password') && !password && user.provider === 'local') {
+      return ctx.badRequest('password.notNull');
+    }
+
+    if (_.has(body, 'username')) {
+      const userWithSameUsername = await strapi
+        .query('user', 'users-permissions')
+        .findOne({ username });
+
+      if (userWithSameUsername && userWithSameUsername.id != id) {
+        return ctx.badRequest(
+          null,
+          formatError({
+            id: 'Auth.form.error.username.taken',
+            message: 'username.alreadyTaken.',
+            field: ['username'],
+          })
+        );
+      }
+    }
+
+    if (_.has(body, 'email') && advancedConfigs.unique_email) {
+      const userWithSameEmail = await strapi
+        .query('user', 'users-permissions')
+        .findOne({ email: email.toLowerCase() });
+
+      if (userWithSameEmail && userWithSameEmail.id != id) {
+        return ctx.badRequest(
+          null,
+          formatError({
+            id: 'Auth.form.error.email.taken',
+            message: 'Email already taken',
+            field: ['email'],
+          })
+        );
+      }
+      body.email = body.email.toLowerCase();
+    }
+
+    const sanitizedData = pm.pickPermittedFieldsOf(body, { subject: pm.toSubject(user) });
+    const updateData = _.omit({ ...sanitizedData, updated_by: admin.id }, 'created_by');
+
+    if (_.has(body, 'password') && password === user.password) {
+      delete updateData.password;
+    }
+
+    const data = await strapi.plugins['users-permissions'].services.user.edit({ id }, updateData);
+
+    ctx.body = pm.sanitize(data, { action: ACTIONS.read });
+  },
+};