@punch-in/strapi-admin 3.6.8

package/ee/admin/hooks/useSettingsMenu/utils/customGlobalLinks.js

@@ -0,0 +1,18 @@
+import { SETTINGS_BASE_URL } from '../../../../../admin/src/config';
+import adminPermissions from '../../../../../admin/src/permissions';
+
+const ssoGlobalRoutes = ENABLED_EE_FEATURES.includes('sso')
+  ? [
+      {
+        title: { id: 'Settings.sso.title' },
+        to: `${SETTINGS_BASE_URL}/single-sign-on`,
+        name: 'sso',
+        isDisplayed: false,
+        permissions: adminPermissions.settings.sso.main,
+      },
+    ]
+  : [];
+
+const customGlobalLinks = [...ssoGlobalRoutes];
+
+export default customGlobalLinks;

package/ee/admin/permissions/customPermissions.js

@@ -0,0 +1,11 @@
+const customPermissions = {
+  settings: {
+    sso: {
+      main: [{ action: 'admin::provider-login.read', subject: null }],
+      read: [{ action: 'admin::provider-login.read', subject: null }],
+      update: [{ action: 'admin::provider-login.update', subject: null }],
+    },
+  },
+};
+
+export default customPermissions;

package/ee/config/admin-actions.js

@@ -0,0 +1,24 @@
+'use strict';
+
+module.exports = {
+  features: {
+    sso: [
+      {
+        uid: 'provider-login.read',
+        displayName: 'Read',
+        pluginName: 'admin',
+        section: 'settings',
+        category: 'single sign on',
+        subCategory: 'options',
+      },
+      {
+        uid: 'provider-login.update',
+        displayName: 'Update',
+        pluginName: 'admin',
+        section: 'settings',
+        category: 'single sign on',
+        subCategory: 'options',
+      },
+    ],
+  },
+};

package/ee/config/functions/bootstrap.js

@@ -0,0 +1,19 @@
+'use strict';
+
+// eslint-disable-next-line node/no-extraneous-require
+const { features } = require('strapi/lib/utils/ee');
+const executeCEBootstrap = require('../../../config/functions/bootstrap');
+const {
+  features: { sso: ssoActions },
+} = require('../admin-actions');
+const { getService } = require('../../../utils');
+
+module.exports = async () => {
+  const { actionProvider } = getService('permission');
+
+  if (features.isEnabled('sso')) {
+    await actionProvider.registerMany(ssoActions);
+  }
+
+  await executeCEBootstrap();
+};

package/ee/config/routes.json

@@ -0,0 +1,28 @@
+{
+  "routes": [
+    {
+      "method": "POST",
+      "path": "/roles",
+      "handler": "role.create",
+      "config": {
+        "policies": []
+      }
+    },
+    {
+      "method": "DELETE",
+      "path": "/roles/:id",
+      "handler": "role.deleteOne",
+      "config": {
+        "policies": []
+      }
+    },
+    {
+      "method": "POST",
+      "path": "/roles/batch-delete",
+      "handler": "role.deleteMany",
+      "config": {
+        "policies": []
+      }
+    }
+  ]
+}

package/ee/controllers/authentication/constants.js

@@ -0,0 +1,11 @@
+'use strict';
+
+const PROVIDER_REDIRECT_BASE = '/auth/login';
+const PROVIDER_REDIRECT_SUCCESS = `${PROVIDER_REDIRECT_BASE}/success`;
+const PROVIDER_REDIRECT_ERROR = `${PROVIDER_REDIRECT_BASE}/error`;
+
+module.exports = {
+  PROVIDER_REDIRECT_BASE,
+  PROVIDER_REDIRECT_SUCCESS,
+  PROVIDER_REDIRECT_ERROR,
+};

package/ee/controllers/authentication/index.js

@@ -0,0 +1,11 @@
+'use strict';
+
+const middlewares = require('./middlewares');
+const constants = require('./constants');
+const utils = require('./utils');
+
+module.exports = {
+  middlewares,
+  constants,
+  utils,
+};

package/ee/controllers/authentication/middlewares.js

@@ -0,0 +1,114 @@
+'use strict';
+
+const passport = require('koa-passport');
+
+const utils = require('./utils');
+
+const defaultConnectionError = () => new Error('Invalid connection payload');
+
+const authenticate = async (ctx, next) => {
+  const {
+    params: { provider },
+  } = ctx;
+  const redirectUrls = utils.getPrefixedRedirectUrls();
+
+  return passport.authenticate(provider, null, async (error, profile) => {
+    if (error || !profile || !profile.email) {
+      if (error) {
+        strapi.log.error(error);
+      }
+
+      strapi.eventHub.emit('admin.auth.error', {
+        error: error || defaultConnectionError(),
+        provider,
+      });
+
+      return ctx.redirect(redirectUrls.error);
+    }
+
+    const user = await strapi.admin.services.user.findOne({ email: profile.email });
+    const scenario = user ? existingUserScenario : nonExistingUserScenario;
+
+    return scenario(ctx, next)(user || profile, provider);
+  })(ctx, next);
+};
+
+const existingUserScenario = (ctx, next) => async (user, provider) => {
+  const redirectUrls = utils.getPrefixedRedirectUrls();
+
+  if (!user.isActive) {
+    strapi.eventHub.emit('admin.auth.error', {
+      error: new Error(`Deactivated user tried to login (${user.id})`),
+      provider,
+    });
+    return ctx.redirect(redirectUrls.error);
+  }
+
+  ctx.state.user = user;
+  return next();
+};
+
+const nonExistingUserScenario = (ctx, next) => async (profile, provider) => {
+  const { email, firstname, lastname, username } = profile;
+  const redirectUrls = utils.getPrefixedRedirectUrls();
+  const adminStore = await utils.getAdminStore();
+  const { providers } = await adminStore.get({ key: 'auth' });
+
+  // We need at least the username or the firstname/lastname combination to register a new user
+  const isMissingRegisterFields = !username && (!firstname || !lastname);
+
+  if (!providers.autoRegister || !providers.defaultRole || isMissingRegisterFields) {
+    strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });
+    return ctx.redirect(redirectUrls.error);
+  }
+
+  const defaultRole = await strapi.admin.services.role.findOne({ id: providers.defaultRole });
+
+  // If the default role has been misconfigured, redirect with an error
+  if (!defaultRole) {
+    strapi.eventHub.emit('admin.auth.error', { error: defaultConnectionError(), provider });
+    return ctx.redirect(redirectUrls.error);
+  }
+
+  // Register a new user with the information given by the provider and login with it
+  ctx.state.user = await strapi.admin.services.user.create({
+    email,
+    username,
+    firstname,
+    lastname,
+    roles: [defaultRole.id],
+    isActive: true,
+    registrationToken: null,
+  });
+
+  strapi.eventHub.emit('admin.auth.autoRegistration', {
+    user: ctx.state.user,
+    provider,
+  });
+
+  return next();
+};
+
+const redirectWithAuth = ctx => {
+  const {
+    params: { provider },
+  } = ctx;
+  const redirectUrls = utils.getPrefixedRedirectUrls();
+  const { user } = ctx.state;
+
+  const jwt = strapi.admin.services.token.createJwtToken(user);
+
+  const isProduction = strapi.config.environment === 'production';
+
+  const cookiesOptions = { httpOnly: false, secure: isProduction, overwrite: true };
+
+  strapi.eventHub.emit('admin.auth.success', { user, provider });
+
+  ctx.cookies.set('jwtToken', jwt, cookiesOptions);
+  ctx.redirect(redirectUrls.success);
+};
+
+module.exports = {
+  authenticate,
+  redirectWithAuth,
+};

package/ee/controllers/authentication/utils.js

@@ -0,0 +1,23 @@
+'use strict';
+
+const { mapValues } = require('lodash/fp');
+const { PROVIDER_REDIRECT_ERROR, PROVIDER_REDIRECT_SUCCESS } = require('./constants');
+
+const PROVIDER_URLS_MAP = {
+  success: PROVIDER_REDIRECT_SUCCESS,
+  error: PROVIDER_REDIRECT_ERROR,
+};
+
+const getAdminStore = async () => strapi.store({ type: 'core', environment: '', name: 'admin' });
+
+const getPrefixedRedirectUrls = () => {
+  const { url: adminUrl } = strapi.config.get('admin');
+  const prefixUrl = url => `${adminUrl || ''}${url}`;
+
+  return mapValues(prefixUrl, PROVIDER_URLS_MAP);
+};
+
+module.exports = {
+  getAdminStore,
+  getPrefixedRedirectUrls,
+};

package/ee/controllers/authentication.js

@@ -0,0 +1,68 @@
+'use strict';
+
+const { pick, merge } = require('lodash/fp');
+const compose = require('koa-compose');
+
+const { validateProviderOptionsUpdate } = require('../validation/authentication');
+const { middlewares, utils } = require('./authentication/index');
+
+const toProviderDTO = pick(['uid', 'displayName', 'icon']);
+const toProviderLoginOptionsDTO = pick(['autoRegister', 'defaultRole']);
+
+const providerAuthenticationFlow = compose([
+  middlewares.authenticate,
+  middlewares.redirectWithAuth,
+]);
+
+module.exports = {
+  async getProviders(ctx) {
+    const { providerRegistry } = strapi.admin.services.passport;
+
+    ctx.body = providerRegistry.getAll().map(toProviderDTO);
+  },
+
+  async getProviderLoginOptions(ctx) {
+    const adminStore = await utils.getAdminStore();
+    const { providers: providersOptions } = await adminStore.get({ key: 'auth' });
+
+    ctx.body = {
+      data: toProviderLoginOptionsDTO(providersOptions),
+    };
+  },
+
+  async updateProviderLoginOptions(ctx) {
+    const {
+      request: { body },
+    } = ctx;
+
+    try {
+      await validateProviderOptionsUpdate(body);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const adminStore = await utils.getAdminStore();
+    const currentAuthOptions = await adminStore.get({ key: 'auth' });
+    const newAuthOptions = merge(currentAuthOptions, { providers: body });
+
+    await adminStore.set({ key: 'auth', value: newAuthOptions });
+
+    ctx.body = {
+      data: toProviderLoginOptionsDTO(newAuthOptions.providers),
+    };
+  },
+
+  providerLogin(ctx, next) {
+    const {
+      params: { provider: providerName },
+    } = ctx;
+
+    const { providerRegistry } = strapi.admin.services.passport;
+
+    if (!providerRegistry.has(providerName)) {
+      throw strapi.errors.badRequest(`Invalid provider supplied: ${providerName}`);
+    }
+
+    return providerAuthenticationFlow(ctx, next);
+  },
+};

package/ee/controllers/permission.js

@@ -0,0 +1,21 @@
+'use strict';
+
+const { getService } = require('../../utils');
+const { formatConditions } = require('../../controllers/formatters');
+
+module.exports = {
+  async getAll(ctx) {
+    const { sectionsBuilder, actionProvider, conditionProvider } = getService('permission');
+
+    const actions = actionProvider.values();
+    const conditions = conditionProvider.values();
+    const sections = await sectionsBuilder.build(actions);
+
+    ctx.body = {
+      data: {
+        conditions: formatConditions(conditions),
+        sections,
+      },
+    };
+  },
+};

package/ee/controllers/role.js

@@ -0,0 +1,116 @@
+'use strict';
+
+const { yup, formatYupErrors } = require('strapi-utils');
+const {
+  validateRoleCreateInput,
+  validateRoleDeleteInput,
+  validateRolesDeleteInput,
+} = require('../validation/role');
+const { getService } = require('../../utils');
+const { validatedUpdatePermissionsInput } = require('../validation/permission');
+const { SUPER_ADMIN_CODE } = require('../../services/constants');
+
+module.exports = {
+  /**
+   * Create a new role
+   * @param {KoaContext} ctx - koa context
+   */
+  async create(ctx) {
+    try {
+      await validateRoleCreateInput(ctx.request.body);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const roleService = getService('role');
+
+    const role = await roleService.create(ctx.request.body);
+    const sanitizedRole = roleService.sanitizeRole(role);
+
+    ctx.created({ data: sanitizedRole });
+  },
+
+  /**
+   * Delete a role
+   * @param {KoaContext} ctx - koa context
+   */
+  async deleteOne(ctx) {
+    const { id } = ctx.params;
+
+    try {
+      await validateRoleDeleteInput(id);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const roleService = getService('role');
+
+    const roles = await roleService.deleteByIds([id]);
+    const sanitizedRole = roles.map(roleService.sanitizeRole)[0] || null;
+
+    return ctx.deleted({
+      data: sanitizedRole,
+    });
+  },
+
+  /**
+   * delete several roles
+   * @param {KoaContext} ctx - koa context
+   */
+  async deleteMany(ctx) {
+    const { body } = ctx.request;
+    try {
+      await validateRolesDeleteInput(body);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const roleService = getService('role');
+
+    const roles = await roleService.deleteByIds(body.ids);
+    const sanitizedRoles = roles.map(roleService.sanitizeRole);
+
+    return ctx.deleted({
+      data: sanitizedRoles,
+    });
+  },
+
+  /**
+   * Updates the permissions assigned to a role
+   * @param {KoaContext} ctx - koa context
+   */
+  async updatePermissions(ctx) {
+    const { id } = ctx.params;
+    const { body: input } = ctx.request;
+
+    const roleService = getService('role');
+    const permissionService = getService('permission');
+
+    const role = await roleService.findOne({ id });
+
+    if (!role) {
+      return ctx.notFound('role.notFound');
+    }
+
+    try {
+      if (role.code === SUPER_ADMIN_CODE) {
+        throw formatYupErrors(new yup.ValidationError("Super admin permissions can't be edited."));
+      }
+
+      await validatedUpdatePermissionsInput(input);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    if (!role) {
+      return ctx.notFound('role.notFound');
+    }
+
+    const permissions = await roleService.assignPermissions(role.id, input.permissions);
+    const sanitizedPermissions = permissions.map(permissionService.sanitizePermission);
+
+    ctx.body = {
+      data: sanitizedPermissions,
+    };
+  },
+};

package/ee/controllers/user.js

@@ -0,0 +1,36 @@
+'use strict';
+
+const { pick } = require('lodash/fp');
+const { validateUserCreationInput } = require('../validation/user');
+
+const pickUserCreationAttributes = pick(['firstname', 'lastname', 'email', 'roles']);
+
+module.exports = {
+  async create(ctx) {
+    const { body } = ctx.request;
+
+    try {
+      await validateUserCreationInput(body);
+    } catch (err) {
+      return ctx.badRequest('ValidationError', err);
+    }
+
+    const attributes = pickUserCreationAttributes(body);
+    const { useSSORegistration } = body;
+
+    const userAlreadyExists = await strapi.admin.services.user.exists({ email: attributes.email });
+
+    if (userAlreadyExists) {
+      return ctx.badRequest('Email already taken');
+    }
+
+    if (useSSORegistration) {
+      Object.assign(attributes, { registrationToken: null, isActive: true });
+    }
+
+    const createdUser = await strapi.admin.services.user.create(attributes);
+    const userInfo = strapi.admin.services.user.sanitizeUser(createdUser);
+
+    ctx.created({ data: userInfo });
+  },
+};

package/ee/middlewares/features-routes/defaults.json

@@ -0,0 +1,5 @@
+{
+  "features-routes": {
+    "enabled": true
+  }
+}

package/ee/middlewares/features-routes/index.js

@@ -0,0 +1,23 @@
+'use strict';
+
+// eslint-disable-next-line node/no-extraneous-require
+const { features } = require('strapi/lib/utils/ee');
+const routes = require('./routes');
+
+module.exports = strapi => ({
+  beforeInitialize() {
+    strapi.config.middleware.load.before.unshift('features-routes');
+  },
+
+  initialize() {
+    loadFeaturesRoutes();
+  },
+});
+
+const loadFeaturesRoutes = () => {
+  for (const [feature, getFeatureRoutes] of Object.entries(routes)) {
+    if (features.isEnabled(feature)) {
+      strapi.admin.config.routes.push(...getFeatureRoutes);
+    }
+  }
+};

package/ee/middlewares/features-routes/routes.js

@@ -0,0 +1,43 @@
+'use strict';
+
+module.exports = {
+  sso: [
+    {
+      method: 'GET',
+      path: '/providers',
+      handler: 'authentication.getProviders',
+    },
+    {
+      method: 'GET',
+      path: '/connect/:provider',
+      handler: 'authentication.providerLogin',
+    },
+    {
+      method: 'POST',
+      path: '/connect/:provider',
+      handler: 'authentication.providerLogin',
+    },
+    {
+      method: 'GET',
+      path: '/providers/options',
+      handler: 'authentication.getProviderLoginOptions',
+      config: {
+        policies: [
+          'admin::isAuthenticatedAdmin',
+          ['admin::hasPermissions', ['admin::provider-login.read']],
+        ],
+      },
+    },
+    {
+      method: 'PUT',
+      path: '/providers/options',
+      handler: 'authentication.updateProviderLoginOptions',
+      config: {
+        policies: [
+          'admin::isAuthenticatedAdmin',
+          ['admin::hasPermissions', ['admin::provider-login.update']],
+        ],
+      },
+    },
+  ],
+};

package/ee/services/passport/provider-registry.js

@@ -0,0 +1,27 @@
+'use strict';
+
+module.exports = () => {
+  const registry = new Map();
+
+  Object.assign(registry, {
+    register(provider) {
+      if (strapi.isLoaded) {
+        throw new Error(`You can't register new provider after the boostrap`);
+      }
+
+      this.set(provider.uid, provider);
+    },
+
+    registerMany(providers) {
+      providers.forEach(provider => {
+        this.register(provider);
+      });
+    },
+
+    getAll() {
+      return Array.from(this.values());
+    },
+  });
+
+  return registry;
+};

package/ee/services/passport/sso.js

@@ -0,0 +1,25 @@
+'use strict';
+
+const { authEventsMapper } = require('../../../services/passport');
+const createProviderRegistry = require('./provider-registry');
+
+const providerRegistry = createProviderRegistry();
+
+const getStrategyCallbackURL = providerName => `/admin/connect/${providerName}`;
+
+const syncProviderRegistryWithConfig = () => {
+  const { providers = [] } = strapi.config.get('server.admin.auth', {});
+
+  providerRegistry.registerMany(providers);
+};
+
+const SSOAuthEventsMapper = {
+  onSSOAutoRegistration: 'admin.auth.autoRegistration',
+};
+
+module.exports = {
+  providerRegistry,
+  getStrategyCallbackURL,
+  syncProviderRegistryWithConfig,
+  authEventsMapper: { ...authEventsMapper, ...SSOAuthEventsMapper },
+};

package/ee/services/passport.js

@@ -0,0 +1,32 @@
+'use strict';
+
+// eslint-disable-next-line node/no-extraneous-require
+const { features } = require('strapi/lib/utils/ee');
+
+const createLocalStrategy = require('../../services/passport/local-strategy');
+const sso = require('./passport/sso');
+
+const getPassportStrategies = () => {
+  const localStrategy = createLocalStrategy(strapi);
+
+  if (!features.isEnabled('sso')) {
+    return [localStrategy];
+  }
+
+  if (!strapi.isLoaded) {
+    sso.syncProviderRegistryWithConfig();
+  }
+
+  const providers = sso.providerRegistry.getAll();
+  const strategies = providers.map(provider => provider.createStrategy(strapi));
+
+  return [localStrategy, ...strategies];
+};
+
+module.exports = {
+  getPassportStrategies,
+};
+
+if (features.isEnabled('sso')) {
+  Object.assign(module.exports, sso);
+}