@strapi/admin 4.16.2 → 4.17.0

package/server/services/action.js

@@ -1,35 +0,0 @@
-'use strict';
-
-const { isNil } = require('lodash/fp');
-const { NotFoundError } = require('@strapi/utils').errors;
-const { getService } = require('../utils');
-const { AUTHOR_CODE, PUBLISH_ACTION } = require('./constants');
-
-// TODO: move actionProvider here instead of in the permission service
-
-/**
- * Returns actions available for a role.
- * @param {string|number} roleId
- * @returns {object[]}
- */
-const getAllowedActionsForRole = async (roleId) => {
-  const { actionProvider } = getService('permission');
-
-  if (!isNil(roleId)) {
-    const role = await getService('role').findOne({ id: roleId });
-
-    if (!role) {
-      throw new NotFoundError('role.notFound');
-    }
-
-    if (role.code === AUTHOR_CODE) {
-      return actionProvider.values().filter(({ actionId }) => actionId !== PUBLISH_ACTION);
-    }
-  }
-
-  return actionProvider.values();
-};
-
-module.exports = {
-  getAllowedActionsForRole,
-};

package/server/services/api-token.js

@@ -1,453 +0,0 @@
-'use strict';
-
-const crypto = require('crypto');
-const { omit, difference, isNil, isEmpty, map, isArray, uniq } = require('lodash/fp');
-const { ValidationError, NotFoundError } = require('@strapi/utils').errors;
-const constants = require('./constants');
-
-/**
- * @typedef {'read-only'|'full-access'|'custom'} TokenType
- */
-
-/**
- * @typedef ApiToken
- *
- * @property {number|string} id
- * @property {string} name
- * @property {string} description
- * @property {string} accessKey
- * @property {number} lastUsedAt
- * @property {number} lifespan
- * @property {number} expiresAt
- * @property {TokenType} type
- * @property {(number|ApiTokenPermission)[]} permissions
- */
-
-/**
- * @typedef ApiTokenPermission
- *
- * @property {number|string} id
- * @property {string} action
- * @property {ApiToken|number} token
- */
-
-/** @constant {Array<string>} */
-const SELECT_FIELDS = [
-  'id',
-  'name',
-  'description',
-  'lastUsedAt',
-  'type',
-  'lifespan',
-  'expiresAt',
-  'createdAt',
-  'updatedAt',
-];
-
-/** @constant {Array<string>} */
-const POPULATE_FIELDS = ['permissions'];
-
-// TODO: we need to ensure the permissions are actually valid registered permissions!
-
-/**
- * Assert that a token's permissions attribute is valid for its type
- *
- * @param {ApiToken} token
- */
-const assertCustomTokenPermissionsValidity = (attributes) => {
-  // Ensure non-custom tokens doesn't have permissions
-  if (attributes.type !== constants.API_TOKEN_TYPE.CUSTOM && !isEmpty(attributes.permissions)) {
-    throw new ValidationError('Non-custom tokens should not reference permissions');
-  }
-
-  // Custom type tokens should always have permissions attached to them
-  if (attributes.type === constants.API_TOKEN_TYPE.CUSTOM && !isArray(attributes.permissions)) {
-    throw new ValidationError('Missing permissions attribute for custom token');
-  }
-
-  // Permissions provided for a custom type token should be valid/registered permissions UID
-  if (attributes.type === constants.API_TOKEN_TYPE.CUSTOM) {
-    const validPermissions = strapi.contentAPI.permissions.providers.action.keys();
-    const invalidPermissions = difference(attributes.permissions, validPermissions);
-
-    if (!isEmpty(invalidPermissions)) {
-      throw new ValidationError(`Unknown permissions provided: ${invalidPermissions.join(', ')}`);
-    }
-  }
-};
-
-/**
- * Assert that a token's lifespan is valid
- *
- * @param {ApiToken} token
- */
-const assertValidLifespan = ({ lifespan }) => {
-  if (isNil(lifespan)) {
-    return;
-  }
-
-  if (!Object.values(constants.API_TOKEN_LIFESPANS).includes(lifespan)) {
-    throw new ValidationError(
-      `lifespan must be one of the following values: 
-      ${Object.values(constants.API_TOKEN_LIFESPANS).join(', ')}`
-    );
-  }
-};
-
-/**
- * Flatten a token's database permissions objects to an array of strings
- *
- * @param {ApiToken} token
- *
- * @returns {ApiToken}
- */
-const flattenTokenPermissions = (token) => {
-  if (!token) return token;
-  return {
-    ...token,
-    permissions: isArray(token.permissions) ? map('action', token.permissions) : token.permissions,
-  };
-};
-
-/**
- *  Get a token
- *
- * @param {Object} whereParams
- * @param {string|number} whereParams.id
- * @param {string} whereParams.name
- * @param {number} whereParams.lastUsedAt
- * @param {string} whereParams.description
- * @param {string} whereParams.accessKey
- *
- * @returns {Promise<Omit<ApiToken, 'accessKey'> | null>}
- */
-const getBy = async (whereParams = {}) => {
-  if (Object.keys(whereParams).length === 0) {
-    return null;
-  }
-
-  const token = await strapi
-    .query('admin::api-token')
-    .findOne({ select: SELECT_FIELDS, populate: POPULATE_FIELDS, where: whereParams });
-
-  if (!token) return token;
-  return flattenTokenPermissions(token);
-};
-
-/**
- * Check if token exists
- *
- * @param {Object} whereParams
- * @param {string|number} whereParams.id
- * @param {string} whereParams.name
- * @param {number} whereParams.lastUsedAt
- * @param {string} whereParams.description
- * @param {string} whereParams.accessKey
- *
- * @returns {Promise<boolean>}
- */
-const exists = async (whereParams = {}) => {
-  const apiToken = await getBy(whereParams);
-
-  return !!apiToken;
-};
-
-/**
- * Return a secure sha512 hash of an accessKey
- *
- * @param {string} accessKey
- *
- * @returns {string}
- */
-const hash = (accessKey) => {
-  return crypto
-    .createHmac('sha512', strapi.config.get('admin.apiToken.salt'))
-    .update(accessKey)
-    .digest('hex');
-};
-
-/**
- * @param {number} lifespan
- *
- * @returns { { lifespan: null | number, expiresAt: null | number } }
- */
-const getExpirationFields = (lifespan) => {
-  // it must be nil or a finite number >= 0
-  const isValidNumber = Number.isFinite(lifespan) && lifespan > 0;
-  if (!isValidNumber && !isNil(lifespan)) {
-    throw new ValidationError('lifespan must be a positive number or null');
-  }
-
-  return {
-    lifespan: lifespan || null,
-    expiresAt: lifespan ? Date.now() + lifespan : null,
-  };
-};
-
-/**
- * Create a token and its permissions
- *
- * @param {Object} attributes
- * @param {TokenType} attributes.type
- * @param {string} attributes.name
- * @param {number} attributes.lifespan
- * @param {string[]} attributes.permissions
- * @param {string} attributes.description
- *
- * @returns {Promise<ApiToken>}
- */
-const create = async (attributes) => {
-  const accessKey = crypto.randomBytes(128).toString('hex');
-
-  assertCustomTokenPermissionsValidity(attributes);
-  assertValidLifespan(attributes);
-
-  // Create the token
-  const apiToken = await strapi.query('admin::api-token').create({
-    select: SELECT_FIELDS,
-    populate: POPULATE_FIELDS,
-    data: {
-      ...omit('permissions', attributes),
-      accessKey: hash(accessKey),
-      ...getExpirationFields(attributes.lifespan),
-    },
-  });
-
-  const result = { ...apiToken, accessKey };
-
-  // If this is a custom type token, create and the related permissions
-  if (attributes.type === constants.API_TOKEN_TYPE.CUSTOM) {
-    // TODO: createMany doesn't seem to create relation properly, implement a better way rather than a ton of queries
-    // const permissionsCount = await strapi.query('admin::api-token-permission').createMany({
-    //   populate: POPULATE_FIELDS,
-    //   data: attributes.permissions.map(action => ({ action, token: apiToken })),
-    // });
-    await Promise.all(
-      uniq(attributes.permissions).map((action) =>
-        strapi.query('admin::api-token-permission').create({
-          data: { action, token: apiToken },
-        })
-      )
-    );
-
-    const currentPermissions = await strapi.entityService.load(
-      'admin::api-token',
-      apiToken,
-      'permissions'
-    );
-
-    if (currentPermissions) {
-      Object.assign(result, { permissions: map('action', currentPermissions) });
-    }
-  }
-
-  return result;
-};
-
-/**
- * @param {string|number} id
- *
- * @returns {Promise<ApiToken>}
- */
-const regenerate = async (id) => {
-  const accessKey = crypto.randomBytes(128).toString('hex');
-
-  const apiToken = await strapi.query('admin::api-token').update({
-    select: ['id', 'accessKey'],
-    where: { id },
-    data: {
-      accessKey: hash(accessKey),
-    },
-  });
-
-  if (!apiToken) {
-    throw new NotFoundError('The provided token id does not exist');
-  }
-
-  return {
-    ...apiToken,
-    accessKey,
-  };
-};
-
-/**
- * @returns {void}
- */
-const checkSaltIsDefined = () => {
-  if (!strapi.config.get('admin.apiToken.salt')) {
-    // TODO V5: stop reading API_TOKEN_SALT
-    if (process.env.API_TOKEN_SALT) {
-      process.emitWarning(`[deprecated] In future versions, Strapi will stop reading directly from the environment variable API_TOKEN_SALT. Please set apiToken.salt in config/admin.js instead.
-For security reasons, keep storing the secret in an environment variable and use env() to read it in config/admin.js (ex: \`apiToken: { salt: env('API_TOKEN_SALT') }\`). See https://docs.strapi.io/developer-docs/latest/setup-deployment-guides/configurations/optional/environment.html#configuration-using-environment-variables.`);
-
-      strapi.config.set('admin.apiToken.salt', process.env.API_TOKEN_SALT);
-    } else {
-      throw new Error(
-        `Missing apiToken.salt. Please set apiToken.salt in config/admin.js (ex: you can generate one using Node with \`crypto.randomBytes(16).toString('base64')\`).
-For security reasons, prefer storing the secret in an environment variable and read it in config/admin.js. See https://docs.strapi.io/developer-docs/latest/setup-deployment-guides/configurations/optional/environment.html#configuration-using-environment-variables.`
-      );
-    }
-  }
-};
-
-/**
- * Return a list of all tokens and their permissions
- *
- * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
- */
-const list = async () => {
-  const tokens = await strapi.query('admin::api-token').findMany({
-    select: SELECT_FIELDS,
-    populate: POPULATE_FIELDS,
-    orderBy: { name: 'ASC' },
-  });
-
-  if (!tokens) return tokens;
-  return tokens.map((token) => flattenTokenPermissions(token));
-};
-
-/**
- * Revoke (delete) a token
- *
- * @param {string|number} id
- *
- * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
- */
-const revoke = async (id) => {
-  return strapi
-    .query('admin::api-token')
-    .delete({ select: SELECT_FIELDS, populate: POPULATE_FIELDS, where: { id } });
-};
-
-/**
- * Retrieve a token by id
- *
- * @param {string|number} id
- *
- * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
- */
-const getById = async (id) => {
-  return getBy({ id });
-};
-
-/**
- * Retrieve a token by name
- *
- * @param {string} name
- *
- * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
- */
-const getByName = async (name) => {
-  return getBy({ name });
-};
-
-/**
- * Update a token and its permissions
- *
- * @param {string|number} id
- * @param {Object} attributes
- * @param {TokenType} attributes.type
- * @param {string} attributes.name
- * @param {number} attributes.lastUsedAt
- * @param {string[]} attributes.permissions
- * @param {string} attributes.description
- *
- * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
- */
-const update = async (id, attributes) => {
-  // retrieve token without permissions
-  const originalToken = await strapi.query('admin::api-token').findOne({ where: { id } });
-
-  if (!originalToken) {
-    throw new NotFoundError('Token not found');
-  }
-
-  const changingTypeToCustom =
-    attributes.type === constants.API_TOKEN_TYPE.CUSTOM &&
-    originalToken.type !== constants.API_TOKEN_TYPE.CUSTOM;
-
-  // if we're updating the permissions on any token type, or changing from non-custom to custom, ensure they're still valid
-  // if neither type nor permissions are changing, we don't need to validate again or else we can't allow partial update
-  if (attributes.permissions || changingTypeToCustom) {
-    assertCustomTokenPermissionsValidity({
-      ...originalToken,
-      ...attributes,
-      type: attributes.type || originalToken.type,
-    });
-  }
-
-  assertValidLifespan(attributes);
-
-  const updatedToken = await strapi.query('admin::api-token').update({
-    select: SELECT_FIELDS,
-    where: { id },
-    data: omit('permissions', attributes),
-  });
-
-  // custom tokens need to have their permissions updated as well
-  if (updatedToken.type === constants.API_TOKEN_TYPE.CUSTOM && attributes.permissions) {
-    const currentPermissionsResult = await strapi.entityService.load(
-      'admin::api-token',
-      updatedToken,
-      'permissions'
-    );
-
-    const currentPermissions = map('action', currentPermissionsResult || []);
-    const newPermissions = uniq(attributes.permissions);
-
-    const actionsToDelete = difference(currentPermissions, newPermissions);
-    const actionsToAdd = difference(newPermissions, currentPermissions);
-
-    // TODO: improve efficiency here
-    // method using a loop -- works but very inefficient
-    await Promise.all(
-      actionsToDelete.map((action) =>
-        strapi.query('admin::api-token-permission').delete({
-          where: { action, token: id },
-        })
-      )
-    );
-
-    // TODO: improve efficiency here
-    // using a loop -- works but very inefficient
-    await Promise.all(
-      actionsToAdd.map((action) =>
-        strapi.query('admin::api-token-permission').create({
-          data: { action, token: id },
-        })
-      )
-    );
-  }
-  // if type is not custom, make sure any old permissions get removed
-  else if (updatedToken.type !== constants.API_TOKEN_TYPE.CUSTOM) {
-    await strapi.query('admin::api-token-permission').delete({
-      where: { token: id },
-    });
-  }
-
-  // retrieve permissions
-  const permissionsFromDb = await strapi.entityService.load(
-    'admin::api-token',
-    updatedToken,
-    'permissions'
-  );
-
-  return {
-    ...updatedToken,
-    permissions: permissionsFromDb ? permissionsFromDb.map((p) => p.action) : undefined,
-  };
-};
-
-module.exports = {
-  create,
-  regenerate,
-  exists,
-  checkSaltIsDefined,
-  hash,
-  list,
-  revoke,
-  getById,
-  update,
-  getByName,
-  getBy,
-};

package/server/services/auth.js

@@ -1,117 +0,0 @@
-'use strict';
-
-const bcrypt = require('bcryptjs');
-const _ = require('lodash');
-const { getAbsoluteAdminUrl } = require('@strapi/utils');
-const { ApplicationError } = require('@strapi/utils').errors;
-const { getService } = require('../utils');
-
-/**
- * hashes a password
- * @param {string} password - password to hash
- * @returns {string} hashed password
- */
-const hashPassword = (password) => bcrypt.hash(password, 10);
-
-/**
- * Validate a password
- * @param {string} password
- * @param {string} hash
- * @returns {Promise<boolean>} is the password valid
- */
-const validatePassword = (password, hash) => bcrypt.compare(password, hash);
-
-/**
- * Check login credentials
- * @param {Object} options
- * @param {string} options.email
- * @param {string} options.password
- */
-const checkCredentials = async ({ email, password }) => {
-  const user = await strapi.query('admin::user').findOne({ where: { email } });
-
-  if (!user || !user.password) {
-    return [null, false, { message: 'Invalid credentials' }];
-  }
-
-  const isValid = await validatePassword(password, user.password);
-
-  if (!isValid) {
-    return [null, false, { message: 'Invalid credentials' }];
-  }
-
-  if (!(user.isActive === true)) {
-    return [null, false, { message: 'User not active' }];
-  }
-
-  return [null, user];
-};
-
-/**
- * Send an email to the user if it exists or do nothing
- * @param {Object} param params
- * @param {string} param.email user email for which to reset the password
- */
-const forgotPassword = async ({ email } = {}) => {
-  const user = await strapi.query('admin::user').findOne({ where: { email, isActive: true } });
-
-  if (!user) {
-    return;
-  }
-
-  const resetPasswordToken = getService('token').createToken();
-  await getService('user').updateById(user.id, { resetPasswordToken });
-
-  // Send an email to the admin.
-  const url = `${getAbsoluteAdminUrl(
-    strapi.config
-  )}/auth/reset-password?code=${resetPasswordToken}`;
-  return strapi
-    .plugin('email')
-    .service('email')
-    .sendTemplatedEmail(
-      {
-        to: user.email,
-        from: strapi.config.get('admin.forgotPassword.from'),
-        replyTo: strapi.config.get('admin.forgotPassword.replyTo'),
-      },
-      strapi.config.get('admin.forgotPassword.emailTemplate'),
-      {
-        url,
-        user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),
-      }
-    )
-    .catch((err) => {
-      // log error server side but do not disclose it to the user to avoid leaking informations
-      strapi.log.error(err);
-    });
-};
-
-/**
- * Reset a user password
- * @param {Object} param params
- * @param {string} param.resetPasswordToken token generated to request a password reset
- * @param {string} param.password new user password
- */
-const resetPassword = async ({ resetPasswordToken, password } = {}) => {
-  const matchingUser = await strapi
-    .query('admin::user')
-    .findOne({ where: { resetPasswordToken, isActive: true } });
-
-  if (!matchingUser) {
-    throw new ApplicationError();
-  }
-
-  return getService('user').updateById(matchingUser.id, {
-    password,
-    resetPasswordToken: null,
-  });
-};
-
-module.exports = {
-  checkCredentials,
-  validatePassword,
-  hashPassword,
-  forgotPassword,
-  resetPassword,
-};

package/server/services/condition.js

@@ -1,14 +0,0 @@
-'use strict';
-
-const { isString } = require('lodash/fp');
-const { getService } = require('../utils');
-
-const isValidCondition = (condition) => {
-  const { conditionProvider } = getService('permission');
-
-  return isString(condition) && conditionProvider.has(condition);
-};
-
-module.exports = {
-  isValidCondition,
-};

package/server/services/constants.js

@@ -1,37 +0,0 @@
-'use strict';
-
-const DAY_IN_MS = 24 * 60 * 60 * 1000;
-
-module.exports = {
-  CONTENT_TYPE_SECTION: 'contentTypes',
-  SUPER_ADMIN_CODE: 'strapi-super-admin',
-  EDITOR_CODE: 'strapi-editor',
-  AUTHOR_CODE: 'strapi-author',
-  READ_ACTION: 'plugin::content-manager.explorer.read',
-  CREATE_ACTION: 'plugin::content-manager.explorer.create',
-  UPDATE_ACTION: 'plugin::content-manager.explorer.update',
-  DELETE_ACTION: 'plugin::content-manager.explorer.delete',
-  PUBLISH_ACTION: 'plugin::content-manager.explorer.publish',
-  API_TOKEN_TYPE: {
-    READ_ONLY: 'read-only',
-    FULL_ACCESS: 'full-access',
-    CUSTOM: 'custom',
-  },
-  // The front-end only displays these values
-  API_TOKEN_LIFESPANS: {
-    UNLIMITED: null,
-    DAYS_7: 7 * DAY_IN_MS,
-    DAYS_30: 30 * DAY_IN_MS,
-    DAYS_90: 90 * DAY_IN_MS,
-  },
-  TRANSFER_TOKEN_TYPE: {
-    PUSH: 'push',
-    PULL: 'pull',
-  },
-  TRANSFER_TOKEN_LIFESPANS: {
-    UNLIMITED: null,
-    DAYS_7: 7 * DAY_IN_MS,
-    DAYS_30: 30 * DAY_IN_MS,
-    DAYS_90: 90 * DAY_IN_MS,
-  },
-};