@akemona-org/strapi 3.7.0

package/lib/middlewares/xss/index.js

@@ -0,0 +1,30 @@
+'use strict';
+
+const convert = require('koa-convert');
+const { xssProtection } = require('koa-lusca');
+
+module.exports = strapi => {
+  return {
+    initialize() {
+      const defaults = require('./defaults.json');
+
+      strapi.app.use(async (ctx, next) => {
+        if (ctx.request.admin) {
+          return await convert(
+            xssProtection({
+              enabled: true,
+              mode: defaults.xss.mode,
+            })
+          )(ctx, next);
+        }
+
+        const xssConfig = strapi.config.get('middleware.settings.xss');
+        if (xssConfig.enabled) {
+          return await convert(xssProtection(xssConfig))(ctx, next);
+        }
+
+        await next();
+      });
+    },
+  };
+};

package/lib/services/core-store.js

@@ -0,0 +1,144 @@
+'use strict';
+
+const coreStoreModel = config => ({
+  connection: config.get('database.defaultConnection'),
+  uid: 'strapi::core-store',
+  info: {
+    name: 'core_store',
+    description: '',
+  },
+  pluginOptions: {
+    'content-manager': {
+      visible: false,
+    },
+    'content-type-builder': {
+      visible: false,
+    },
+  },
+  attributes: {
+    key: {
+      type: 'string',
+    },
+    value: {
+      type: 'text',
+    },
+    type: {
+      type: 'string',
+    },
+    environment: {
+      type: 'string',
+    },
+    tag: {
+      type: 'string',
+    },
+  },
+  globalId: 'StrapiConfigs',
+  collectionName: 'core_store',
+});
+
+const createCoreStore = ({ environment: defaultEnv, db }) => {
+  return (source = {}) => {
+    async function get(params = {}) {
+      const { key, environment = defaultEnv, type = 'core', name = '', tag = '' } = Object.assign(
+        {},
+        source,
+        params
+      );
+
+      const prefix = `${type}${name ? `_${name}` : ''}`;
+
+      const where = {
+        key: `${prefix}_${key}`,
+        environment,
+        tag,
+      };
+
+      const data = await db.query('core_store').findOne(where);
+
+      if (!data) {
+        return null;
+      }
+
+      if (
+        data.type === 'object' ||
+        data.type === 'array' ||
+        data.type === 'boolean' ||
+        data.type === 'string'
+      ) {
+        try {
+          return JSON.parse(data.value);
+        } catch (err) {
+          return new Date(data.value);
+        }
+      } else if (data.type === 'number') {
+        return parseFloat(data.value);
+      } else {
+        return null;
+      }
+    }
+
+    async function set(params = {}) {
+      const { key, value, environment = defaultEnv, type, name, tag = '' } = Object.assign(
+        {},
+        source,
+        params
+      );
+
+      const prefix = `${type}${name ? `_${name}` : ''}`;
+
+      const where = {
+        key: `${prefix}_${key}`,
+        environment,
+        tag,
+      };
+
+      const data = await db.query('core_store').findOne(where);
+
+      if (data) {
+        Object.assign(data, {
+          value: JSON.stringify(value) || value.toString(),
+          type: (typeof value).toString(),
+        });
+
+        await db.query('core_store').update({ id: data.id }, data);
+      } else {
+        const data = Object.assign({}, where, {
+          value: JSON.stringify(value) || value.toString(),
+          type: (typeof value).toString(),
+          tag,
+        });
+
+        await db.query('core_store').create(data);
+      }
+    }
+
+    async function deleteFn(params = {}) {
+      const { key, environment = defaultEnv, type, name, tag = '' } = Object.assign(
+        {},
+        source,
+        params
+      );
+
+      const prefix = `${type}${name ? `_${name}` : ''}`;
+
+      const where = {
+        key: `${prefix}_${key}`,
+        environment,
+        tag,
+      };
+
+      await db.query('core_store').delete(where);
+    }
+
+    return {
+      get,
+      set,
+      delete: deleteFn,
+    };
+  };
+};
+
+module.exports = {
+  coreStoreModel,
+  createCoreStore,
+};

package/lib/services/entity-service.js

@@ -0,0 +1,260 @@
+'use strict';
+
+const _ = require('lodash');
+const delegate = require('delegates');
+
+const {
+  sanitizeEntity,
+  webhook: webhookUtils,
+  contentTypes: contentTypesUtils,
+} = require('@akemona-org/strapi-utils');
+const uploadFiles = require('./utils/upload-files');
+
+// TODO: those should be strapi events used by the webhooks not the other way arround
+const { ENTRY_CREATE, ENTRY_UPDATE, ENTRY_DELETE } = webhookUtils.webhookEvents;
+
+module.exports = (ctx) => {
+  const implementation = createDefaultImplementation(ctx);
+
+  const service = {
+    implementation,
+    decorate(decorator) {
+      if (typeof decorator !== 'function') {
+        throw new Error(`Decorator must be a function, received ${typeof decorator}`);
+      }
+
+      this.implementation = Object.assign({}, this.implementation, decorator(this.implementation));
+      return this;
+    },
+  };
+
+  const delegator = delegate(service, 'implementation');
+
+  // delegate every method in implementation
+  Object.keys(service.implementation).forEach((key) => delegator.method(key));
+
+  return service;
+};
+
+const createDefaultImplementation = ({ db, eventHub, entityValidator }) => ({
+  /**
+   * expose some utils so the end users can use them
+   */
+  uploadFiles,
+
+  /**
+   * Returns default opt
+   * it is async so decorators can do async processing
+   * @param {object} params - query params to extend
+   * @param {object=} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async wrapOptions(options = {}) {
+    return options;
+  },
+
+  /**
+   * Returns a list of entries
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async find(opts, { model }) {
+    const { params, populate } = await this.wrapOptions(opts, { model, action: 'find' });
+
+    const { kind } = db.getModel(model);
+
+    // return first element and ignore filters
+    if (kind === 'singleType') {
+      const results = await db.query(model).find({ ...params, _limit: 1 }, populate);
+      return _.first(results) || null;
+    }
+
+    return db.query(model).find(params, populate);
+  },
+
+  /**
+   * Returns a paginated list of entries
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async findPage(opts, { model }) {
+    const { params, populate } = await this.wrapOptions(opts, { model, action: 'findPage' });
+
+    return db.query(model).findPage(params, populate);
+  },
+
+  /**
+   * Returns a list of entries with relation counters
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async findWithRelationCounts(opts, { model }) {
+    const { params, populate } = await this.wrapOptions(opts, {
+      model,
+      action: 'findWithRelationCounts',
+    });
+
+    return db.query(model).findWithRelationCounts(params, populate);
+  },
+
+  /**
+   * Returns one entry
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async findOne(opts, { model }) {
+    const { params, populate } = await this.wrapOptions(opts, { model, action: 'findOne' });
+
+    return db.query(model).findOne(params, populate);
+  },
+
+  /**
+   * Returns a count of entries
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async count(opts, { model }) {
+    const { params } = await this.wrapOptions(opts, { model, action: 'count' });
+
+    return db.query(model).count(params);
+  },
+
+  /**
+   * Creates & returns a new entry
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async create(opts, { model }) {
+    const { data, files } = await this.wrapOptions(opts, { model, action: 'create' });
+
+    const modelDef = db.getModel(model);
+
+    const isDraft = contentTypesUtils.isDraft(data, modelDef);
+
+    const validData = await entityValidator.validateEntityCreation(modelDef, data, { isDraft });
+
+    let entry = await db.query(model).create(validData);
+
+    if (files && Object.keys(files).length > 0) {
+      await this.uploadFiles(entry, files, { model });
+      entry = await this.findOne({ params: { id: entry.id } }, { model });
+    }
+
+    eventHub.emit(ENTRY_CREATE, {
+      model: modelDef.modelName,
+      entry: sanitizeEntity(entry, { model: modelDef }),
+    });
+
+    return entry;
+  },
+
+  /**
+   * Updates & returns an existing entry
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async update(opts, { model }) {
+    const { params, data, files } = await this.wrapOptions(opts, { model, action: 'update' });
+
+    const modelDef = db.getModel(model);
+    const existingEntry = await db.query(model).findOne(params);
+
+    const isDraft = contentTypesUtils.isDraft(existingEntry, modelDef);
+
+    const validData = await entityValidator.validateEntityUpdate(modelDef, data, {
+      isDraft,
+    });
+
+    let entry = await db.query(model).update(params, validData);
+
+    if (files && Object.keys(files).length > 0) {
+      await this.uploadFiles(entry, files, { model });
+      entry = await this.findOne({ params: { id: entry.id } }, { model });
+    }
+
+    eventHub.emit(ENTRY_UPDATE, {
+      model: modelDef.modelName,
+      entry: sanitizeEntity(entry, { model: modelDef }),
+    });
+
+    return entry;
+  },
+
+  /**
+   * Deletes & returns the entry that was deleted
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async delete(opts, { model }) {
+    const { params } = await this.wrapOptions(opts, { model, action: 'delete' });
+
+    const entry = await db.query(model).delete(params);
+
+    const modelDef = db.getModel(model);
+    eventHub.emit(ENTRY_DELETE, {
+      model: modelDef.modelName,
+      entry: sanitizeEntity(entry, { model: modelDef }),
+    });
+
+    return entry;
+  },
+
+  /**
+   * Returns a list of matching entries
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async search(opts, { model }) {
+    const { params, populate } = await this.wrapOptions(opts, { model, action: 'search' });
+
+    return db.query(model).search(params, populate);
+  },
+
+  /**
+   * Returns a list of matching entries with relations counters
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async searchWithRelationCounts(opts, { model }) {
+    const { params, populate } = await this.wrapOptions(opts, {
+      model,
+      action: 'searchWithRelationCounts',
+    });
+
+    return db.query(model).searchWithRelationCounts(params, populate);
+  },
+
+  /**
+   * Returns a paginated list of matching entries
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async searchPage(opts, { model }) {
+    const { params, populate } = await this.wrapOptions(opts, { model, action: 'searchPage' });
+
+    return db.query(model).searchPage(params, populate);
+  },
+
+  /**
+   * Promise to count searched records
+   * @param {object} opts - Query options object (params, data, files, populate)
+   * @param {object} ctx - Query context
+   * @param {object} ctx.model - Model that is being used
+   */
+  async countSearch(opts, { model }) {
+    const { params } = await this.wrapOptions(opts, { model, action: 'countSearch' });
+
+    return db.query(model).countSearch(params);
+  },
+});

package/lib/services/entity-validator/index.js

@@ -0,0 +1,199 @@
+/**
+ * Entity validator
+ * Module that will validate input data for entity creation or edition
+ */
+'use strict';
+
+const { has, assoc, prop } = require('lodash/fp');
+const strapiUtils = require('@akemona-org/strapi-utils');
+const validators = require('./validators');
+
+const { yup, formatYupErrors } = strapiUtils;
+const { isMediaAttribute, isScalarAttribute, getWritableAttributes } = strapiUtils.contentTypes;
+
+const addMinMax = (attr, validator, data) => {
+  if (Number.isInteger(attr.min) && (attr.required || (Array.isArray(data) && data.length > 0))) {
+    validator = validator.min(attr.min);
+  }
+  if (Number.isInteger(attr.max)) {
+    validator = validator.max(attr.max);
+  }
+  return validator;
+};
+
+const addRequiredValidation = (createOrUpdate) => (required, validator) => {
+  if (required) {
+    if (createOrUpdate === 'creation') {
+      validator = validator.notNil();
+    } else if (createOrUpdate === 'update') {
+      validator = validator.notNull();
+    }
+  } else {
+    validator = validator.nullable();
+  }
+  return validator;
+};
+
+const addDefault = (createOrUpdate) => (attr, validator) => {
+  if (createOrUpdate === 'creation') {
+    if (
+      ((attr.type === 'component' && attr.repeatable) || attr.type === 'dynamiczone') &&
+      !attr.required
+    ) {
+      validator = validator.default([]);
+    } else {
+      validator = validator.default(attr.default);
+    }
+  } else {
+    validator = validator.default(undefined);
+  }
+
+  return validator;
+};
+
+const preventCast = (validator) => validator.transform((val, originalVal) => originalVal);
+
+const createComponentValidator =
+  (createOrUpdate) =>
+  (attr, data, { isDraft }) => {
+    let validator;
+
+    const [model] = strapi.db.getModelsByAttribute(attr);
+    if (!model) {
+      throw new Error('Validation failed: Model not found');
+    }
+
+    if (prop('repeatable', attr) === true) {
+      validator = yup
+        .array()
+        .of(
+          yup.lazy((item) =>
+            createModelValidator(createOrUpdate)(model, item, { isDraft }).notNull()
+          )
+        );
+      validator = addRequiredValidation(createOrUpdate)(true, validator);
+      validator = addMinMax(attr, validator, data);
+    } else {
+      validator = createModelValidator(createOrUpdate)(model, data, { isDraft });
+      validator = addRequiredValidation(createOrUpdate)(!isDraft && attr.required, validator);
+    }
+
+    return validator;
+  };
+
+const createDzValidator =
+  (createOrUpdate) =>
+  (attr, data, { isDraft }) => {
+    let validator;
+
+    validator = yup.array().of(
+      yup.lazy((item) => {
+        const model = strapi.getModel(prop('__component', item));
+        const schema = yup
+          .object()
+          .shape({
+            __component: yup.string().required().oneOf(Object.keys(strapi.components)),
+          })
+          .notNull();
+
+        return model
+          ? schema.concat(createModelValidator(createOrUpdate)(model, item, { isDraft }))
+          : schema;
+      })
+    );
+    validator = addRequiredValidation(createOrUpdate)(true, validator);
+    validator = addMinMax(attr, validator, data);
+
+    return validator;
+  };
+
+const createRelationValidator =
+  (createOrUpdate) =>
+  (attr, data, { isDraft }) => {
+    let validator;
+
+    if (Array.isArray(data)) {
+      validator = yup.array().of(yup.mixed());
+    } else {
+      validator = yup.mixed();
+    }
+    validator = addRequiredValidation(createOrUpdate)(!isDraft && attr.required, validator);
+
+    return validator;
+  };
+
+const createScalarAttributeValidator =
+  (createOrUpdate) =>
+  (attr, { isDraft }) => {
+    let validator;
+
+    if (has(attr.type, validators)) {
+      validator = validators[attr.type](attr, { isDraft });
+    } else {
+      // No validators specified - fall back to mixed
+      validator = yup.mixed();
+    }
+
+    validator = addRequiredValidation(createOrUpdate)(!isDraft && attr.required, validator);
+
+    return validator;
+  };
+
+const createAttributeValidator =
+  (createOrUpdate) =>
+  (attr, data, { isDraft }) => {
+    let validator;
+    if (isMediaAttribute(attr)) {
+      validator = yup.mixed();
+    } else if (isScalarAttribute(attr)) {
+      validator = createScalarAttributeValidator(createOrUpdate)(attr, { isDraft });
+    } else {
+      if (attr.type === 'component') {
+        validator = createComponentValidator(createOrUpdate)(attr, data, { isDraft });
+      } else if (attr.type === 'dynamiczone') {
+        validator = createDzValidator(createOrUpdate)(attr, data, { isDraft });
+      } else {
+        validator = createRelationValidator(createOrUpdate)(attr, data, { isDraft });
+      }
+
+      validator = preventCast(validator);
+    }
+
+    validator = addDefault(createOrUpdate)(attr, validator);
+
+    return validator;
+  };
+
+const createModelValidator =
+  (createOrUpdate) =>
+  (model, data, { isDraft }) => {
+    const writableAttributes = model ? getWritableAttributes(model) : [];
+
+    const schema = writableAttributes.reduce((validators, attributeName) => {
+      const validator = createAttributeValidator(createOrUpdate)(
+        model.attributes[attributeName],
+        prop(attributeName, data),
+        { isDraft }
+      );
+
+      return assoc(attributeName, validator)(validators);
+    }, {});
+
+    return yup.object().shape(schema);
+  };
+
+const createValidateEntity =
+  (createOrUpdate) =>
+  async (model, data, { isDraft = false } = {}) => {
+    try {
+      const validator = createModelValidator(createOrUpdate)(model, data, { isDraft }).required();
+      return await validator.validate(data, { abortEarly: false });
+    } catch (e) {
+      throw strapi.errors.badRequest('ValidationError', { errors: formatYupErrors(e) });
+    }
+  };
+
+module.exports = {
+  validateEntityCreation: createValidateEntity('creation'),
+  validateEntityUpdate: createValidateEntity('update'),
+};