@strapi/admin 4.0.0-next.12 → 4.0.0-next.16

package/server/services/api-token.js

@@ -0,0 +1,173 @@
+'use strict';
+
+const crypto = require('crypto');
+
+/**
+ * @typedef {'read-only'|'full-access'} TokenType
+ */
+
+/**
+ * @typedef ApiToken
+ *
+ * @property {number|string} id
+ * @property {string} name
+ * @property {string} [description]
+ * @property {string} accessKey
+ * @property {TokenType} type
+ */
+
+/** @constant {Array<string>} */
+const SELECT_FIELDS = ['id', 'name', 'description', 'type'];
+
+/**
+ * @param {Object} whereParams
+ * @param {string|number} [whereParams.id]
+ * @param {string} [whereParams.name]
+ * @param {string} [whereParams.description]
+ * @param {string} [whereParams.accessKey]
+ *
+ * @returns {Promise<boolean>}
+ */
+const exists = async (whereParams = {}) => {
+  const apiToken = await getBy(whereParams);
+
+  return !!apiToken;
+};
+
+/**
+ * @param {string} accessKey
+ *
+ * @returns {string}
+ */
+const hash = accessKey => {
+  return crypto
+    .createHmac('sha512', strapi.config.get('server.admin.api-token.salt'))
+    .update(accessKey)
+    .digest('hex');
+};
+
+/**
+ * @param {Object} attributes
+ * @param {TokenType} attributes.type
+ * @param {string} attributes.name
+ * @param {string} [attributes.description]
+ *
+ * @returns {Promise<ApiToken>}
+ */
+const create = async attributes => {
+  const accessKey = crypto.randomBytes(128).toString('hex');
+
+  const apiToken = await strapi.query('admin::api-token').create({
+    select: SELECT_FIELDS,
+    data: {
+      ...attributes,
+      accessKey: hash(accessKey),
+    },
+  });
+
+  return {
+    ...apiToken,
+    accessKey,
+  };
+};
+
+/**
+ * @returns {void}
+ */
+const createSaltIfNotDefined = () => {
+  if (strapi.config.get('server.admin.api-token.salt')) {
+    return;
+  }
+
+  if (process.env.API_TOKEN_SALT) {
+    throw new Error(
+      `There's something wrong with the configuration of your api-token salt. If you have changed the env variable used in the configuration file, please verify that you have created and set the variable in your .env file.`
+    );
+  }
+
+  const salt = crypto.randomBytes(16).toString('hex');
+  strapi.fs.appendFile('.env', `API_TOKEN_SALT=${salt}\n`);
+  strapi.config.set('server.admin.api-token.salt', salt);
+};
+
+/**
+ * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
+ */
+const list = async () => {
+  return strapi.query('admin::api-token').findMany({
+    select: SELECT_FIELDS,
+    orderBy: { name: 'ASC' },
+  });
+};
+
+/**
+ * @param {string|number} id
+ *
+ * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
+ */
+const revoke = async id => {
+  return strapi.query('admin::api-token').delete({ select: SELECT_FIELDS, where: { id } });
+};
+
+/**
+ * @param {string|number} id
+ *
+ * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
+ */
+const getById = async id => {
+  return getBy({ id });
+};
+
+/**
+ * @param {string} name
+ *
+ * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
+ */
+const getByName = async name => {
+  return getBy({ name });
+};
+
+/**
+ * @param {string|number} id
+ * @param {Object} attributes
+ * @param {TokenType} attributes.type
+ * @param {string} attributes.name
+ * @param {string} [attributes.description]
+ *
+ * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
+ */
+const update = async (id, attributes) => {
+  return strapi
+    .query('admin::api-token')
+    .update({ where: { id }, data: attributes, select: SELECT_FIELDS });
+};
+
+/**
+ * @param {Object} whereParams
+ * @param {string|number} [whereParams.id]
+ * @param {string} [whereParams.name]
+ * @param {string} [whereParams.description]
+ * @param {string} [whereParams.accessKey]
+ *
+ * @returns {Promise<Omit<ApiToken, 'accessKey'> | null>}
+ */
+const getBy = async (whereParams = {}) => {
+  if (Object.keys(whereParams).length === 0) {
+    return null;
+  }
+
+  return strapi.query('admin::api-token').findOne({ select: SELECT_FIELDS, where: whereParams });
+};
+
+module.exports = {
+  create,
+  exists,
+  createSaltIfNotDefined,
+  hash,
+  list,
+  revoke,
+  getById,
+  update,
+  getByName,
+  getBy,
+};

package/server/services/constants.js

@@ -10,4 +10,8 @@ module.exports = {
   UPDATE_ACTION: 'plugin::content-manager.explorer.update',
   DELETE_ACTION: 'plugin::content-manager.explorer.delete',
   PUBLISH_ACTION: 'plugin::content-manager.explorer.publish',
+  API_TOKEN_TYPE: {
+    READ_ONLY: 'read-only',
+    FULL_ACCESS: 'full-access',
+  },
 };

package/server/services/index.js

@@ -12,4 +12,5 @@ module.exports = {
   condition: require('./condition'),
   auth: require('./auth'),
   action: require('./action'),
+  'api-token': require('./api-token'),
 };

package/server/services/passport/local-strategy.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const { toLower } = require('lodash/fp');
 const { Strategy: LocalStrategy } = require('passport-local');
 
 const createLocalStrategy = strapi => {
@@ -11,7 +12,7 @@ const createLocalStrategy = strapi => {
     },
     (email, password, done) => {
       return strapi.admin.services.auth
-        .checkCredentials({ email, password })
+        .checkCredentials({ email: toLower(email), password })
         .then(([error, user, message]) => done(error, user, message))
         .catch(error => done(error));
     }

package/server/services/permission/permissions-manager/index.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const _ = require('lodash');
-const { cloneDeep, isObject, set, isArray } = require('lodash/fp');
+const { cloneDeep, isPlainObject } = require('lodash/fp');
 const { subject: asSubject } = require('@casl/ability');
 const { permittedFieldsOf } = require('@casl/ability/extra');
 const {
@@ -35,22 +35,15 @@ module.exports = ({ ability, action, model }) => ({
     return buildStrapiQuery(buildCaslQuery(ability, queryAction, model));
   },
 
-  // FIXME:
-  queryFrom(query = {}, action) {
-    const permissionQuery = this.getQuery(action);
-
+  addPermissionsQueryTo(query = {}, action) {
     const newQuery = cloneDeep(query);
-    const { _where } = query;
-
-    if (isObject(_where) && !isArray(_where)) {
-      Object.assign(newQuery, { _where: [_where] });
-    }
+    const permissionQuery = this.getQuery(action);
 
-    if (!_where) {
-      Object.assign(newQuery, { _where: [] });
-    }
+    newQuery.filters = isPlainObject(query.filters)
+      ? { $and: [query.filters, permissionQuery] }
+      : permissionQuery;
 
-    return set('_where', newQuery._where.concat(permissionQuery), newQuery);
+    return newQuery;
   },
 
   sanitize(data, options = {}) {

package/server/services/permission/permissions-manager/query-builers.js

@@ -3,79 +3,63 @@
 // TODO: migration
 const _ = require('lodash');
 const { rulesToQuery } = require('@casl/ability/extra');
-const { VALID_REST_OPERATORS } = require('@strapi/utils');
 
-const ops = {
-  common: VALID_REST_OPERATORS.map(op => `$${op}`),
-  boolean: ['$or', '$and'],
-  cleanable: ['$elemMatch'],
+const operatorsMap = {
+  $in: '$in',
+  $nin: '$notIn',
+  $exists: '$notNull',
+  $gte: '$gte',
+  $gt: '$gt',
+  $lte: '$lte',
+  $lt: '$lt',
+  $eq: '$eq',
+  $ne: '$ne',
+  $and: '$and',
+  $or: '$or',
+  $not: '$not',
 };
 
-const buildCaslQuery = (ability, action, model) => {
-  const query = rulesToQuery(ability, action, model, o => o.conditions);
-  return _.get(query, '$or[0].$and', {});
+const mapKey = key => {
+  if (_.isString(key) && key.startsWith('$') && key in operatorsMap) {
+    return operatorsMap[key];
+  }
+  return key;
 };
 
-const buildStrapiQuery = caslQuery => {
-  const transform = _.flow([flattenDeep, cleanupUnwantedProperties]);
-  return transform(caslQuery);
+const buildCaslQuery = (ability, action, model) => {
+  return rulesToQuery(ability, action, model, o => o.conditions);
 };
 
-const flattenDeep = condition => {
-  if (_.isArray(condition)) {
-    return _.map(condition, flattenDeep);
-  }
-
-  if (!_.isObject(condition)) {
-    return condition;
-  }
-
-  const shouldIgnore = e => !!ops.common.includes(e);
-  const shouldPerformTransformation = (v, k) => _.isObject(v) && !_.isArray(v) && !shouldIgnore(k);
-
-  const result = {};
-  const set = (key, value) => (result[key] = value);
-
-  const getTransformParams = (prevKey, v, k) =>
-    shouldIgnore(k) ? [`${prevKey}_${k.replace('$', '')}`, v] : [`${prevKey}.${k}`, v];
-
-  _.each(condition, (value, key) => {
-    if (ops.boolean.includes(key)) {
-      set(key.replace('$', '_'), _.map(value, flattenDeep));
-    } else if (shouldPerformTransformation(value, key)) {
-      _.each(flattenDeep(value), (v, k) => {
-        set(...getTransformParams(key, v, k));
-      });
-    } else {
-      set(key, flattenDeep(value));
-    }
-  });
-
-  return result;
+const buildStrapiQuery = caslQuery => {
+  return unwrapDeep(caslQuery);
 };
 
-const cleanupUnwantedProperties = condition => {
-  if (!_.isObject(condition)) {
-    return condition;
+const unwrapDeep = obj => {
+  if (!_.isPlainObject(obj) && !_.isArray(obj)) {
+    return obj;
   }
-
-  if (_.isArray(condition)) {
-    return condition.map(cleanupUnwantedProperties);
+  if (_.isArray(obj)) {
+    return obj.map(v => unwrapDeep(v));
   }
 
-  const shouldClean = e =>
-    typeof e === 'string' ? ops.cleanable.find(o => e.includes(`.${o}`)) : undefined;
-
   return _.reduce(
-    condition,
-    (acc, value, key) => {
-      const keyToClean = shouldClean(key);
-      const newKey = keyToClean ? key.split(`.${keyToClean}`).join('') : key;
-
-      return {
-        ...acc,
-        [newKey]: _.isArray(value) ? value.map(cleanupUnwantedProperties) : value,
-      };
+    obj,
+    (acc, v, k) => {
+      const key = mapKey(k);
+
+      if (_.isPlainObject(v)) {
+        if ('$elemMatch' in v) {
+          v = v.$elemMatch; // removing this key
+        }
+        _.setWith(acc, key, unwrapDeep(v));
+      } else if (_.isArray(v)) {
+        // prettier-ignore
+        _.setWith(acc, key, v.map(v => unwrapDeep(v)));
+      } else {
+        _.setWith(acc, key, v);
+      }
+
+      return acc;
     },
     {}
   );

package/server/services/role.js

@@ -26,6 +26,8 @@ const sanitizeRole = omit(['users', 'permissions']);
 const COMPARABLE_FIELDS = ['conditions', 'properties', 'subject', 'action'];
 const pickComparableFields = pick(COMPARABLE_FIELDS);
 
+const jsonClean = data => JSON.parse(JSON.stringify(data));
+
 /**
  * Compare two permissions
  * @param {Permission} p1
@@ -33,7 +35,11 @@ const pickComparableFields = pick(COMPARABLE_FIELDS);
  * @returns {boolean}
  */
 const arePermissionsEqual = (p1, p2) => {
-  return deepEqual(pickComparableFields(p1), pickComparableFields(p2));
+  if (p1.action === p2.action) {
+    return deepEqual(jsonClean(pickComparableFields(p1)), jsonClean(pickComparableFields(p2)));
+  }
+
+  return false;
 };
 
 /**

package/server/services/user.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const _ = require('lodash');
+const { defaults } = require('lodash/fp');
 const { stringIncludes } = require('@strapi/utils');
 const { createUser, hasSuperAdminRole } = require('../domain/user');
 const { password: passwordValidator } = require('../validation/common-validators');
@@ -103,7 +104,7 @@ const updateById = async (id, attributes) => {
  * @param {string} password - new password
  */
 const resetPasswordByEmail = async (email, password) => {
-  const user = await findOne({ email });
+  const user = await strapi.query('admin::user').findOne({ where: { email }, populate: ['roles'] });
 
   if (!user) {
     throw new Error(`User not found for email: ${email}`);
@@ -125,7 +126,7 @@ const resetPasswordByEmail = async (email, password) => {
  * @param {int|string} userId user's id to look for
  */
 const isLastSuperAdminUser = async userId => {
-  const user = await findOne({ id: userId }, ['roles']);
+  const user = await findOne(userId);
   const superAdminRole = await getService('role').getSuperAdminWithUsersCount();
 
   return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);
@@ -180,8 +181,8 @@ const register = async ({ registrationToken, userInfo }) => {
 /**
  * Find one user
  */
-const findOne = async (where = {}, populate = ['roles']) => {
-  return strapi.query('admin::user').findOne({ where, populate });
+const findOne = async (id, populate = ['roles']) => {
+  return strapi.entityService.findOne('admin::user', id, { populate });
 };
 
 /** Find many users (paginated)
@@ -189,15 +190,8 @@ const findOne = async (where = {}, populate = ['roles']) => {
  * @returns {Promise<user>}
  */
 const findPage = async (query = {}) => {
-  const { page = 1, pageSize = 100, populate = ['roles'] } = query;
-
-  return strapi.query('admin::user').findPage({
-    where: query.filters,
-    _q: query._q,
-    populate,
-    page,
-    pageSize,
-  });
+  const enrichedQuery = defaults({ populate: ['roles'] }, query);
+  return strapi.entityService.findPage('admin::user', enrichedQuery);
 };
 
 /** Delete a user

package/server/strategies/admin.js

@@ -0,0 +1,46 @@
+'use strict';
+
+const { getService } = require('../utils');
+
+/** @type {import('.').AuthenticateFunction} */
+const authenticate = async ctx => {
+  const { authorization } = ctx.request.header;
+
+  if (!authorization) {
+    return { authenticated: false };
+  }
+
+  const parts = authorization.split(/\s+/);
+
+  if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {
+    return { authenticated: false };
+  }
+
+  const token = parts[1];
+  const { payload, isValid } = getService('token').decodeJwtToken(token);
+
+  if (!isValid) {
+    return { authenticated: false };
+  }
+
+  const user = await strapi
+    .query('admin::user')
+    .findOne({ where: { id: payload.id }, populate: ['roles'] });
+
+  if (!user || !(user.isActive === true)) {
+    return { authenticated: false };
+  }
+
+  const userAbility = await getService('permission').engine.generateUserAbility(user);
+
+  ctx.state.userAbility = userAbility;
+  ctx.state.user = user;
+
+  return { authenticated: true, credentials: user };
+};
+
+/** @type {import('.').AuthStrategy} */
+module.exports = {
+  name: 'admin',
+  authenticate,
+};

package/server/strategies/api-token.js

@@ -0,0 +1,62 @@
+'use strict';
+
+const constants = require('../services/constants');
+const { getService } = require('../utils');
+
+/** @type {import('.').AuthenticateFunction} */
+const authenticate = async ctx => {
+  const apiTokenService = getService('api-token');
+  const { authorization } = ctx.request.header;
+
+  if (!authorization) {
+    return { authenticated: false };
+  }
+
+  const parts = authorization.split(/\s+/);
+
+  if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {
+    return { authenticated: false };
+  }
+
+  const token = parts[1];
+  const apiToken = await apiTokenService.getBy({
+    accessKey: apiTokenService.hash(token),
+  });
+
+  if (!apiToken) {
+    return { authenticated: false };
+  }
+
+  return { authenticated: true, credentials: apiToken };
+};
+
+/** @type {import('.').VerifyFunction} */
+const verify = (auth, config) => {
+  const { errors } = strapi.container.get('auth');
+  const { credentials: apiToken } = auth;
+
+  if (!apiToken) {
+    throw new errors.UnauthorizedError();
+  }
+
+  if (apiToken.type === constants.API_TOKEN_TYPE.FULL_ACCESS) {
+    return;
+  }
+
+  /**
+   * If you don't have `full-access` you can only access `find` and `findOne`
+   * scopes. If the route has no scope, then you can't get access to it.
+   */
+  if (config.scope && (config.scope.endsWith('find') || config.scope.endsWith('findOne'))) {
+    return;
+  }
+
+  throw new errors.ForbiddenError();
+};
+
+/** @type {import('.').AuthStrategy} */
+module.exports = {
+  name: 'api-token',
+  authenticate,
+  verify,
+};

package/server/strategies/index.js

@@ -0,0 +1,25 @@
+'use strict';
+
+/**
+ * @typedef {{authenticated: boolean, error?: string, credentials?: Record<any, any>}} AuthenticateResponse
+ * @typedef {(ctx: Record<any, any>) => AuthenticateResponse | Promise<AuthenticateResponse>} AuthenticateFunction
+ * @typedef {{strategy: AuthStrategy, credentials?: Record<any, any>}} VerifyInputAuth
+ * @typedef {{scope: string, [key: any]: any}} VerifyInputConfig
+ * @typedef {(auth: VerifyInputAuth, config: VerifyInputConfig) => void | Promise<void>} VerifyFunction
+ */
+
+/**
+ * @typedef AuthStrategy
+ *
+ * @property {string} name
+ * @property {AuthenticateFunction} authenticate
+ * @property {VerifyFunction} [verify]
+ */
+
+/**
+ * @type {Record<string, AuthStrategy>}
+ */
+module.exports = {
+  admin: require('./admin'),
+  'api-token': require('./api-token'),
+};

package/server/utils/index.d.ts

@@ -5,15 +5,17 @@ import * as contentType from '../services/content-type';
 import * as metrics from '../services/metrics';
 import * as token from '../services/token';
 import * as auth from '../services/auth';
+import * as apiToken from '../services/api-token';
 
 type S = {
   role: typeof role;
   user: typeof user;
   permission: typeof permission;
-  ['content-type']: typeof contentType;
+  'content-type': typeof contentType;
   token: typeof token;
   auth: typeof auth;
   metrics: typeof metrics;
+  'api-token': typeof apiToken;
 };
 
-export function getService<T extends keyof S>(name: T): ReturnType<S[T]>;
+export function getService<T extends keyof S>(name: T): S[T];

package/server/validation/api-tokens.js

@@ -0,0 +1,53 @@
+'use strict';
+
+const { yup, formatYupErrors } = require('@strapi/utils');
+const constants = require('../services/constants');
+
+const handleReject = error => Promise.reject(formatYupErrors(error));
+
+const apiTokenCreationSchema = yup
+  .object()
+  .shape({
+    name: yup
+      .string()
+      .min(1)
+      .required(),
+    description: yup.string().optional(),
+    type: yup
+      .string()
+      .oneOf(Object.values(constants.API_TOKEN_TYPE))
+      .required(),
+  })
+  .noUnknown();
+
+const validateApiTokenCreationInput = async data => {
+  return apiTokenCreationSchema
+    .validate(data, { strict: true, abortEarly: false })
+    .catch(handleReject);
+};
+
+const apiTokenUpdateSchema = yup
+  .object()
+  .shape({
+    name: yup
+      .string()
+      .min(1)
+      .notNull(),
+    description: yup.string().nullable(),
+    type: yup
+      .string()
+      .oneOf(Object.values(constants.API_TOKEN_TYPE))
+      .notNull(),
+  })
+  .noUnknown();
+
+const validateApiTokenUpdateInput = async data => {
+  return apiTokenUpdateSchema
+    .validate(data, { strict: true, abortEarly: false })
+    .catch(handleReject);
+};
+
+module.exports = {
+  validateApiTokenCreationInput,
+  validateApiTokenUpdateInput,
+};

package/admin/src/components/AutoReloadOverlayBlockerProvider/Content.js

@@ -1,29 +0,0 @@
-import React from 'react';
-import { FormattedMessage } from 'react-intl';
-import PropTypes from 'prop-types';
-
-const Content = ({ description, title }) => {
-  return (
-    <>
-      <h4>
-        <FormattedMessage {...title} />
-      </h4>
-      <p>
-        <FormattedMessage {...description} />
-      </p>
-    </>
-  );
-};
-
-Content.propTypes = {
-  description: PropTypes.shape({
-    id: PropTypes.string.isRequired,
-    defaultMessage: PropTypes.string.isRequired,
-  }).isRequired,
-  title: PropTypes.shape({
-    id: PropTypes.string.isRequired,
-    defaultMessage: PropTypes.string.isRequired,
-  }).isRequired,
-};
-
-export default Content;