@punch-in/strapi-admin 1.0.1

package/services/passport/local-strategy.js

@@ -0,0 +1,21 @@
+'use strict';
+
+const { Strategy: LocalStrategy } = require('passport-local');
+
+const createLocalStrategy = strapi => {
+  return new LocalStrategy(
+    {
+      usernameField: 'email',
+      passwordField: 'password',
+      session: false,
+    },
+    (email, password, done) => {
+      return strapi.admin.services.auth
+        .checkCredentials({ email, password })
+        .then(([error, user, message]) => done(error, user, message))
+        .catch(error => done(error));
+    }
+  );
+};
+
+module.exports = createLocalStrategy;

package/services/passport.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const passport = require('koa-passport');
+const { isFunction } = require('lodash/fp');
+
+const createLocalStrategy = require('./passport/local-strategy');
+
+const authEventsMapper = {
+  onConnectionSuccess: 'admin.auth.success',
+  onConnectionError: 'admin.auth.error',
+};
+
+const valueIsFunctionType = ([, value]) => isFunction(value);
+const keyIsValidEventName = ([key]) => {
+  return Object.keys(strapi.admin.services.passport.authEventsMapper).includes(key);
+};
+
+const getPassportStrategies = () => [createLocalStrategy(strapi)];
+
+const registerAuthEvents = () => {
+  const { events = {} } = strapi.config.get('server.admin.auth', {});
+  const { authEventsMapper } = strapi.admin.services.passport;
+
+  const eventList = Object.entries(events)
+    .filter(keyIsValidEventName)
+    .filter(valueIsFunctionType);
+
+  for (const [eventName, handler] of eventList) {
+    strapi.eventHub.on(authEventsMapper[eventName], handler);
+  }
+};
+
+const init = () => {
+  strapi.admin.services.passport
+    .getPassportStrategies()
+    .forEach(strategy => passport.use(strategy));
+
+  registerAuthEvents();
+
+  return passport.initialize();
+};
+
+module.exports = {
+  init,
+  getPassportStrategies,
+  authEventsMapper,
+};

package/services/permission/engine-hooks.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const { cloneDeep, has } = require('lodash/fp');
+const { hooks } = require('strapi-utils');
+
+const permissionDomain = require('../../domain/permission');
+
+/**
+ * Create a hook map used by the permission Engine
+ */
+const createEngineHooks = () => ({
+  willEvaluatePermission: hooks.createAsyncSeriesHook(),
+  willRegisterPermission: hooks.createAsyncSeriesHook(),
+});
+
+/**
+ * Create a context from a domain {@link Permission} used by the WillEvaluate hook
+ * @param {Permission} permission
+ * @return {{readonly permission: Permission, addCondition(string): this}}
+ */
+const createWillEvaluateContext = permission => ({
+  get permission() {
+    return cloneDeep(permission);
+  },
+
+  addCondition(condition) {
+    Object.assign(permission, permissionDomain.addCondition(condition, permission));
+
+    return this;
+  },
+});
+
+/**
+ * Create a context from a casl Permission & some options
+ * @param caslPermission
+ * @param {object} options
+ * @param {Permission} options.permission
+ * @param {object} options.user
+ */
+const createWillRegisterContext = (caslPermission, { permission, user }) => ({
+  get permission() {
+    return cloneDeep(permission);
+  },
+
+  get user() {
+    return cloneDeep(user);
+  },
+
+  condition: {
+    and(rawConditionObject) {
+      if (!caslPermission.condition) {
+        Object.assign(caslPermission, { condition: { $and: [] } });
+      }
+
+      caslPermission.condition.$and.push(rawConditionObject);
+
+      return this;
+    },
+
+    or(rawConditionObject) {
+      if (!caslPermission.condition) {
+        Object.assign(caslPermission, { condition: { $and: [] } });
+      }
+
+      const orClause = caslPermission.condition.$and.find(has('$or'));
+
+      if (orClause) {
+        orClause.$or.push(rawConditionObject);
+      } else {
+        caslPermission.condition.$and.push({ $or: [rawConditionObject] });
+      }
+
+      return this;
+    },
+  },
+});
+
+module.exports = {
+  createEngineHooks,
+  createWillEvaluateContext,
+  createWillRegisterContext,
+};

package/services/permission/engine.js

@@ -0,0 +1,275 @@
+'use strict';
+
+const {
+  curry,
+  map,
+  filter,
+  propEq,
+  isFunction,
+  isBoolean,
+  isArray,
+  isNil,
+  isEmpty,
+  isObject,
+  prop,
+  merge,
+  pick,
+  difference,
+  cloneDeep,
+} = require('lodash/fp');
+const { AbilityBuilder, Ability } = require('@casl/ability');
+const sift = require('sift');
+const permissionDomain = require('../../domain/permission/index');
+const { getService } = require('../../utils');
+const {
+  createEngineHooks,
+  createWillEvaluateContext,
+  createWillRegisterContext,
+} = require('./engine-hooks');
+
+const allowedOperations = [
+  '$or',
+  '$and',
+  '$eq',
+  '$ne',
+  '$in',
+  '$nin',
+  '$lt',
+  '$lte',
+  '$gt',
+  '$gte',
+  '$exists',
+  '$elemMatch',
+];
+const operations = pick(allowedOperations, sift);
+
+const conditionsMatcher = conditions => {
+  return sift.createQueryTester(conditions, { operations });
+};
+
+module.exports = conditionProvider => {
+  const state = {
+    hooks: createEngineHooks(),
+  };
+
+  return {
+    hooks: state.hooks,
+
+    /**
+     * Generate an ability based on the given user (using associated roles & permissions)
+     * @param user
+     * @param options
+     * @returns {Promise<Ability>}
+     */
+    async generateUserAbility(user, options) {
+      const permissions = await getService('permission').findUserPermissions(user);
+      const abilityCreator = this.generateAbilityCreatorFor(user);
+
+      return abilityCreator(permissions, options);
+    },
+
+    /**
+     * Create an ability factory for a specific user
+     * @param user
+     * @returns {function(*, *): Promise<Ability>}
+     */
+    generateAbilityCreatorFor(user) {
+      return async (permissions, options) => {
+        const { can, build } = new AbilityBuilder(Ability);
+
+        for (const permission of permissions) {
+          const registerFn = this.createRegisterFunction(can, permission, user);
+
+          await this.evaluate({ permission, user, options, registerFn });
+        }
+
+        return build({ conditionsMatcher });
+      };
+    },
+
+    /**
+     * Validate, invalidate and transform the permission attributes
+     * @param {Permission} permission
+     * @returns {null|Permission}
+     */
+    formatPermission(permission) {
+      const { actionProvider } = getService('permission');
+
+      const action = actionProvider.get(permission.action);
+
+      // If the action isn't registered into the action provider, then ignore the permission
+      if (!action) {
+        return null;
+      }
+
+      const properties = permission.properties || {};
+
+      // Only keep the properties allowed by the action (action.applyToProperties)
+      const propertiesName = Object.keys(properties);
+      const invalidProperties = difference(
+        propertiesName,
+        action.applyToProperties || propertiesName
+      );
+
+      const permissionWithSanitizedProperties = invalidProperties.reduce(
+        property => permissionDomain.deleteProperty(property, permission),
+        permission
+      );
+
+      // If the `fields` property is an empty array, then ignore the permission
+      const { fields } = properties;
+
+      if (isArray(fields) && isEmpty(fields)) {
+        return null;
+      }
+
+      return permissionWithSanitizedProperties;
+    },
+
+    /**
+     * Update the permission components through various processing
+     * @param {Permission} permission
+     * @returns {Promise<void>}
+     */
+    async applyPermissionProcessors(permission) {
+      const context = createWillEvaluateContext(permission);
+
+      // 1. Trigger willEvaluatePermission hook and await transformation operated on the permission
+      await state.hooks.willEvaluatePermission.call(context);
+    },
+
+    /**
+     * Register new rules using `registerFn` based on valid permission's conditions
+     * @param options {object}
+     * @param options.permission {object}
+     * @param options.user {object}
+     * @param options.options {object | undefined}
+     * @param options.registerFn {Function}
+     * @returns {Promise<void>}
+     */
+    async evaluate(options) {
+      const { user, registerFn, options: conditionOptions } = options;
+
+      // Assert options.permission validity and format it
+      const permission = this.formatPermission(options.permission);
+
+      // If options.permission is invalid, then ignore the permission
+      if (permission === null) {
+        return;
+      }
+
+      await this.applyPermissionProcessors(permission);
+
+      // Extract the up-to-date components from the permission
+      const { action, subject, properties = {}, conditions } = permission;
+
+      // Register the permission if there is no condition
+      if (isEmpty(conditions)) {
+        return registerFn({ action, subject, fields: properties.fields });
+      }
+
+      /** Set of functions used to resolve + evaluate conditions & register the permission if allowed */
+
+      // 1. Replace each condition name by its associated value
+      const resolveConditions = map(conditionProvider.get);
+
+      // 2. Filter conditions, only keep those whose handler is a function
+      const filterValidConditions = filter(condition => isFunction(condition.handler));
+
+      // 3. Evaluate the conditions handler and returns an object
+      // containing both the original condition and its result
+      const evaluateConditions = conditions => {
+        return Promise.all(
+          conditions.map(async condition => ({
+            condition,
+            result: await condition.handler(
+              user,
+              merge(conditionOptions, { permission: cloneDeep(permission) })
+            ),
+          }))
+        );
+      };
+
+      // 4. Only keeps booleans or objects as condition's result
+      const filterValidResults = filter(({ result }) => isBoolean(result) || isObject(result));
+
+      /**/
+
+      const evaluatedConditions = await Promise.resolve(conditions)
+        .then(resolveConditions)
+        .then(filterValidConditions)
+        .then(evaluateConditions)
+        .then(filterValidResults);
+
+      // Utils
+      const resultPropEq = propEq('result');
+      const pickResults = map(prop('result'));
+
+      if (evaluatedConditions.every(resultPropEq(false))) {
+        return;
+      }
+
+      // If there is no condition or if one of them return true, register the permission as is
+      if (isEmpty(evaluatedConditions) || evaluatedConditions.some(resultPropEq(true))) {
+        return registerFn({ action, subject, fields: properties.fields });
+      }
+
+      const results = pickResults(evaluatedConditions).filter(isObject);
+
+      if (isEmpty(results)) {
+        return registerFn({ action, subject, fields: properties.fields });
+      }
+
+      // Register the permission
+      return registerFn({
+        action,
+        subject,
+        fields: properties.fields,
+        condition: { $and: [{ $or: results }] },
+      });
+    },
+
+    /**
+     * Encapsulate a register function with custom params to fit `evaluatePermission`'s syntax
+     * @param can
+     * @param {Permission} permission
+     * @param {object} user
+     * @returns {function}
+     */
+    createRegisterFunction(can, permission, user) {
+      const registerToCasl = caslPermission => {
+        const { action, subject, fields, condition } = caslPermission;
+
+        can(
+          action,
+          isNil(subject) ? 'all' : subject,
+          fields,
+          isObject(condition) ? condition : undefined
+        );
+      };
+
+      const runWillRegisterHook = async caslPermission => {
+        const hookContext = createWillRegisterContext(caslPermission, {
+          permission,
+          user,
+        });
+
+        await state.hooks.willRegisterPermission.call(hookContext);
+
+        return caslPermission;
+      };
+
+      return async caslPermission => {
+        await runWillRegisterHook(caslPermission);
+        registerToCasl(caslPermission);
+      };
+    },
+
+    /**
+     * Check many permissions based on an ability
+     */
+    checkMany: curry((ability, permissions) => {
+      return permissions.map(({ action, subject, field }) => ability.can(action, subject, field));
+    }),
+  };
+};

package/services/permission/permissions-manager/index.js

@@ -0,0 +1,85 @@
+'use strict';
+
+const _ = require('lodash');
+const { cloneDeep, isObject, set, isArray } = require('lodash/fp');
+const { subject: asSubject } = require('@casl/ability');
+const { permittedFieldsOf } = require('@casl/ability/extra');
+const {
+  sanitizeEntity,
+  contentTypes: { constants },
+} = require('strapi-utils');
+const { buildStrapiQuery, buildCaslQuery } = require('./query-builers');
+
+module.exports = ({ ability, action, model }) => ({
+  ability,
+  action,
+  model,
+
+  get isAllowed() {
+    return this.ability.can(action, model);
+  },
+
+  toSubject(target, subjectType = model) {
+    return asSubject(subjectType, target);
+  },
+
+  pickPermittedFieldsOf(data, options = {}) {
+    return this.sanitize(data, { ...options, isOutput: false });
+  },
+
+  getQuery(queryAction = action) {
+    if (_.isUndefined(queryAction)) {
+      throw new Error('Action must be defined to build a permission query');
+    }
+
+    return buildStrapiQuery(buildCaslQuery(ability, queryAction, model));
+  },
+
+  queryFrom(query = {}, action) {
+    const permissionQuery = this.getQuery(action);
+
+    const newQuery = cloneDeep(query);
+    const { _where } = query;
+
+    if (isObject(_where) && !isArray(_where)) {
+      Object.assign(newQuery, { _where: [_where] });
+    }
+
+    if (!_where) {
+      Object.assign(newQuery, { _where: [] });
+    }
+
+    return set('_where', newQuery._where.concat(permissionQuery), newQuery);
+  },
+
+  sanitize(data, options = {}) {
+    const {
+      subject = this.toSubject(data),
+      action: actionOverride = action,
+      withPrivate = true,
+      isOutput = true,
+    } = options;
+
+    if (_.isArray(data)) {
+      return data.map(entity => this.sanitize(entity, { action, withPrivate, isOutput }));
+    }
+
+    const permittedFields = permittedFieldsOf(ability, actionOverride, subject);
+    const hasAtLeastOneRegisteredField = _.some(
+      _.flatMap(ability.rulesFor(actionOverride, subject), 'fields')
+    );
+    const shouldIncludeAllFields = _.isEmpty(permittedFields) && !hasAtLeastOneRegisteredField;
+
+    const sanitizedEntity = sanitizeEntity(data, {
+      model: strapi.getModel(model),
+      includeFields: shouldIncludeAllFields ? null : permittedFields,
+      withPrivate,
+      isOutput,
+    });
+
+    return _.omit(sanitizedEntity, [
+      `${constants.CREATED_BY_ATTRIBUTE}.roles`,
+      `${constants.UPDATED_BY_ATTRIBUTE}.roles`,
+    ]);
+  },
+});

package/services/permission/permissions-manager/query-builers.js

@@ -0,0 +1,86 @@
+'use strict';
+
+const _ = require('lodash');
+const { rulesToQuery } = require('@casl/ability/extra');
+const { VALID_REST_OPERATORS } = require('strapi-utils');
+
+const ops = {
+  common: VALID_REST_OPERATORS.map(op => `$${op}`),
+  boolean: ['$or', '$and'],
+  cleanable: ['$elemMatch'],
+};
+
+const buildCaslQuery = (ability, action, model) => {
+  const query = rulesToQuery(ability, action, model, o => o.conditions);
+  return _.get(query, '$or[0].$and', {});
+};
+
+const buildStrapiQuery = caslQuery => {
+  const transform = _.flow([flattenDeep, cleanupUnwantedProperties]);
+  return transform(caslQuery);
+};
+
+const flattenDeep = condition => {
+  if (_.isArray(condition)) {
+    return _.map(condition, flattenDeep);
+  }
+
+  if (!_.isObject(condition)) {
+    return condition;
+  }
+
+  const shouldIgnore = e => !!ops.common.includes(e);
+  const shouldPerformTransformation = (v, k) => _.isObject(v) && !_.isArray(v) && !shouldIgnore(k);
+
+  const result = {};
+  const set = (key, value) => (result[key] = value);
+
+  const getTransformParams = (prevKey, v, k) =>
+    shouldIgnore(k) ? [`${prevKey}_${k.replace('$', '')}`, v] : [`${prevKey}.${k}`, v];
+
+  _.each(condition, (value, key) => {
+    if (ops.boolean.includes(key)) {
+      set(key.replace('$', '_'), _.map(value, flattenDeep));
+    } else if (shouldPerformTransformation(value, key)) {
+      _.each(flattenDeep(value), (v, k) => {
+        set(...getTransformParams(key, v, k));
+      });
+    } else {
+      set(key, flattenDeep(value));
+    }
+  });
+
+  return result;
+};
+
+const cleanupUnwantedProperties = condition => {
+  if (!_.isObject(condition)) {
+    return condition;
+  }
+
+  if (_.isArray(condition)) {
+    return condition.map(cleanupUnwantedProperties);
+  }
+
+  const shouldClean = e =>
+    typeof e === 'string' ? ops.cleanable.find(o => e.includes(`.${o}`)) : undefined;
+
+  return _.reduce(
+    condition,
+    (acc, value, key) => {
+      const keyToClean = shouldClean(key);
+      const newKey = keyToClean ? key.split(`.${keyToClean}`).join('') : key;
+
+      return {
+        ...acc,
+        [newKey]: _.isArray(value) ? value.map(cleanupUnwantedProperties) : value,
+      };
+    },
+    {}
+  );
+};
+
+module.exports = {
+  buildCaslQuery,
+  buildStrapiQuery,
+};