@strapi/admin 4.16.2 → 4.18.0

package/server/controllers/authentication.js

@@ -1,172 +0,0 @@
-'use strict';
-
-const passport = require('koa-passport');
-const compose = require('koa-compose');
-const { ApplicationError, ValidationError } = require('@strapi/utils').errors;
-const { getService } = require('../utils');
-const {
-  validateRegistrationInput,
-  validateAdminRegistrationInput,
-  validateRegistrationInfoQuery,
-  validateForgotPasswordInput,
-  validateResetPasswordInput,
-  validateRenewTokenInput,
-} = require('../validation/authentication');
-
-module.exports = {
-  login: compose([
-    (ctx, next) => {
-      return passport.authenticate('local', { session: false }, (err, user, info) => {
-        if (err) {
-          strapi.eventHub.emit('admin.auth.error', { error: err, provider: 'local' });
-          // if this is a recognized error, allow it to bubble up to user
-          if (err.details?.code === 'LOGIN_NOT_ALLOWED') {
-            throw err;
-          }
-
-          // for all other errors throw a generic error to prevent leaking info
-          return ctx.notImplemented();
-        }
-
-        if (!user) {
-          strapi.eventHub.emit('admin.auth.error', {
-            error: new Error(info.message),
-            provider: 'local',
-          });
-          throw new ApplicationError(info.message);
-        }
-
-        ctx.state.user = user;
-
-        const sanitizedUser = getService('user').sanitizeUser(user);
-        strapi.eventHub.emit('admin.auth.success', { user: sanitizedUser, provider: 'local' });
-
-        return next();
-      })(ctx, next);
-    },
-    (ctx) => {
-      const { user } = ctx.state;
-
-      ctx.body = {
-        data: {
-          token: getService('token').createJwtToken(user),
-          user: getService('user').sanitizeUser(ctx.state.user), // TODO: fetch more detailed info
-        },
-      };
-    },
-  ]),
-
-  async renewToken(ctx) {
-    await validateRenewTokenInput(ctx.request.body);
-
-    const { token } = ctx.request.body;
-
-    const { isValid, payload } = getService('token').decodeJwtToken(token);
-
-    if (!isValid) {
-      throw new ValidationError('Invalid token');
-    }
-
-    ctx.body = {
-      data: {
-        token: getService('token').createJwtToken({ id: payload.id }),
-      },
-    };
-  },
-
-  async registrationInfo(ctx) {
-    await validateRegistrationInfoQuery(ctx.request.query);
-
-    const { registrationToken } = ctx.request.query;
-
-    const registrationInfo = await getService('user').findRegistrationInfo(registrationToken);
-
-    if (!registrationInfo) {
-      throw new ValidationError('Invalid registrationToken');
-    }
-
-    ctx.body = { data: registrationInfo };
-  },
-
-  async register(ctx) {
-    const input = ctx.request.body;
-
-    await validateRegistrationInput(input);
-
-    const user = await getService('user').register(input);
-
-    ctx.body = {
-      data: {
-        token: getService('token').createJwtToken(user),
-        user: getService('user').sanitizeUser(user),
-      },
-    };
-  },
-
-  async registerAdmin(ctx) {
-    const input = ctx.request.body;
-
-    await validateAdminRegistrationInput(input);
-
-    const hasAdmin = await getService('user').exists();
-
-    if (hasAdmin) {
-      throw new ApplicationError('You cannot register a new super admin');
-    }
-
-    const superAdminRole = await getService('role').getSuperAdmin();
-
-    if (!superAdminRole) {
-      throw new ApplicationError(
-        "Cannot register the first admin because the super admin role doesn't exist."
-      );
-    }
-
-    const user = await getService('user').create({
-      ...input,
-      registrationToken: null,
-      isActive: true,
-      roles: superAdminRole ? [superAdminRole.id] : [],
-    });
-
-    strapi.telemetry.send('didCreateFirstAdmin');
-
-    ctx.body = {
-      data: {
-        token: getService('token').createJwtToken(user),
-        user: getService('user').sanitizeUser(user),
-      },
-    };
-  },
-
-  async forgotPassword(ctx) {
-    const input = ctx.request.body;
-
-    await validateForgotPasswordInput(input);
-
-    getService('auth').forgotPassword(input);
-
-    ctx.status = 204;
-  },
-
-  async resetPassword(ctx) {
-    const input = ctx.request.body;
-
-    await validateResetPasswordInput(input);
-
-    const user = await getService('auth').resetPassword(input);
-
-    ctx.body = {
-      data: {
-        token: getService('token').createJwtToken(user),
-        user: getService('user').sanitizeUser(user),
-      },
-    };
-  },
-
-  logout(ctx) {
-    const sanitizedUser = getService('user').sanitizeUser(ctx.state.user);
-    strapi.eventHub.emit('admin.logout', { user: sanitizedUser });
-    ctx.body = { data: {} };
-  },
-};

package/server/controllers/content-api.js

@@ -1,15 +0,0 @@
-'use strict';
-
-module.exports = {
-  async getPermissions(ctx) {
-    const actionsMap = await strapi.contentAPI.permissions.getActionsMap();
-
-    ctx.send({ data: actionsMap });
-  },
-
-  async getRoutes(ctx) {
-    const routesMap = await strapi.contentAPI.getRoutesMap();
-
-    ctx.send({ data: routesMap });
-  },
-};

package/server/controllers/formatters/conditions.js

@@ -1,12 +0,0 @@
-'use strict';
-
-const { pick, map } = require('lodash/fp');
-
-// visible fields for the API
-const publicFields = ['id', 'displayName', 'category'];
-
-const formatConditions = map(pick(publicFields));
-
-module.exports = {
-  formatConditions,
-};

package/server/controllers/formatters/format-actions-by-sections.js

@@ -1,40 +0,0 @@
-'use strict';
-
-/**
- * Transform an array of actions to a more nested format
- * @param {Array<Action>} actions - array of actions
- * @returns {Object} "{ contentTypes, plugins, settings }"
- */
-const formatActionsBySections = (actions) =>
-  actions.reduce((result, p) => {
-    const checkboxItem = {
-      displayName: p.displayName,
-      action: p.actionId,
-    };
-
-    switch (p.section) {
-      case 'contentTypes': {
-        checkboxItem.subjects = p.subjects;
-        break;
-      }
-      case 'plugins': {
-        checkboxItem.subCategory = p.subCategory;
-        checkboxItem.plugin = `plugin::${p.pluginName}`;
-        break;
-      }
-      case 'settings': {
-        checkboxItem.category = p.category;
-        checkboxItem.subCategory = p.subCategory;
-        break;
-      }
-      default:
-        throw new Error(`Unknown section ${p.section}`);
-    }
-
-    result[p.section] = result[p.section] || [];
-    result[p.section].push(checkboxItem);
-
-    return result;
-  }, {});
-
-module.exports = formatActionsBySections;

package/server/controllers/formatters/index.js

@@ -1,9 +0,0 @@
-'use strict';
-
-const formatActionsBySections = require('./format-actions-by-sections');
-const { formatConditions } = require('./conditions');
-
-module.exports = {
-  formatActionsBySections,
-  formatConditions,
-};

package/server/controllers/index.js

@@ -1,14 +0,0 @@
-'use strict';
-
-module.exports = {
-  admin: require('./admin'),
-  'api-token': require('./api-token'),
-  'authenticated-user': require('./authenticated-user'),
-  authentication: require('./authentication'),
-  permission: require('./permission'),
-  role: require('./role'),
-  transfer: require('./transfer'),
-  user: require('./user'),
-  webhooks: require('./webhooks'),
-  'content-api': require('./content-api'),
-};

package/server/controllers/permission.js

@@ -1,45 +0,0 @@
-'use strict';
-
-const { validateCheckPermissionsInput } = require('../validation/permission');
-const { getService } = require('../utils');
-const { formatConditions } = require('./formatters');
-
-module.exports = {
-  /**
-   * Check each permissions from `request.body.permissions` and returns an array of booleans
-   * @param {KoaContext} ctx - koa context
-   */
-  async check(ctx) {
-    const { body: input } = ctx.request;
-    const { userAbility } = ctx.state;
-
-    await validateCheckPermissionsInput(input);
-
-    const { engine } = getService('permission');
-
-    const checkPermissionsFn = engine.checkMany(userAbility);
-
-    ctx.body = {
-      data: checkPermissionsFn(input.permissions),
-    };
-  },
-
-  /**
-   * Returns every permissions, in nested format
-   * @param {KoaContext} ctx - koa context
-   */
-  async getAll(ctx) {
-    const { sectionsBuilder, actionProvider, conditionProvider } = getService('permission');
-
-    const actions = actionProvider.values();
-    const conditions = conditionProvider.values();
-    const sections = await sectionsBuilder.build(actions);
-
-    ctx.body = {
-      data: {
-        conditions: formatConditions(conditions),
-        sections,
-      },
-    };
-  },
-};

package/server/controllers/role.js

@@ -1,198 +0,0 @@
-'use strict';
-
-const { ApplicationError } = require('@strapi/utils').errors;
-const {
-  validateRoleUpdateInput,
-  validateRoleCreateInput,
-  validateRoleDeleteInput,
-  validateRolesDeleteInput,
-} = require('../validation/role');
-const { validatedUpdatePermissionsInput } = require('../validation/permission');
-const { SUPER_ADMIN_CODE } = require('../services/constants');
-const { getService } = require('../utils');
-
-module.exports = {
-  /**
-   * Create a new role
-   * @param {KoaContext} ctx - koa context
-   */
-  async create(ctx) {
-    await validateRoleCreateInput(ctx.request.body);
-
-    const roleService = getService('role');
-
-    const role = await roleService.create(ctx.request.body);
-    const sanitizedRole = roleService.sanitizeRole(role);
-
-    ctx.created({ data: sanitizedRole });
-  },
-
-  /**
-   * Returns on role by id
-   * @param {KoaContext} ctx - koa context
-   */
-  async findOne(ctx) {
-    const { id } = ctx.params;
-    const role = await getService('role').findOneWithUsersCount({ id });
-
-    if (!role) {
-      return ctx.notFound('role.notFound');
-    }
-
-    ctx.body = {
-      data: role,
-    };
-  },
-
-  /**
-   * Returns every roles
-   * @param {KoaContext} ctx - koa context
-   */
-  async findAll(ctx) {
-    const { query } = ctx.request;
-
-    const permissionsManager = getService('permission').createPermissionsManager({
-      ability: ctx.state.userAbility,
-      model: 'admin::role',
-    });
-
-    await permissionsManager.validateQuery(query);
-    const sanitizedQuery = await permissionsManager.sanitizeQuery(query);
-
-    const roles = await getService('role').findAllWithUsersCount(sanitizedQuery);
-
-    ctx.body = {
-      data: roles,
-    };
-  },
-
-  /**
-   * Updates a role by id
-   * @param {KoaContext} ctx - koa context
-   */
-  async update(ctx) {
-    const { id } = ctx.params;
-    const { body } = ctx.request;
-
-    const roleService = getService('role');
-
-    await validateRoleUpdateInput(body);
-
-    const role = await roleService.findOne({ id });
-
-    if (!role) {
-      return ctx.notFound('role.notFound');
-    }
-
-    if (role.code === SUPER_ADMIN_CODE) {
-      throw new ApplicationError("Super admin can't be edited.");
-    }
-
-    const updatedRole = await roleService.update({ id }, body);
-    const sanitizedRole = roleService.sanitizeRole(updatedRole);
-
-    ctx.body = {
-      data: sanitizedRole,
-    };
-  },
-
-  /**
-   * Returns the permissions assigned to a role
-   * @param {KoaContext} ctx - koa context
-   */
-  async getPermissions(ctx) {
-    const { id } = ctx.params;
-
-    const roleService = getService('role');
-    const permissionService = getService('permission');
-
-    const role = await roleService.findOne({ id });
-
-    if (!role) {
-      return ctx.notFound('role.notFound');
-    }
-
-    const permissions = await permissionService.findMany({ where: { role: { id: role.id } } });
-
-    const sanitizedPermissions = permissions.map(permissionService.sanitizePermission);
-
-    ctx.body = {
-      data: sanitizedPermissions,
-    };
-  },
-
-  /**
-   * Updates the permissions assigned to a role
-   * @param {KoaContext} ctx - koa context
-   */
-  async updatePermissions(ctx) {
-    const { id } = ctx.params;
-    const { body: input } = ctx.request;
-
-    const roleService = getService('role');
-    const permissionService = getService('permission');
-
-    const role = await roleService.findOne({ id });
-
-    if (!role) {
-      return ctx.notFound('role.notFound');
-    }
-
-    if (role.code === SUPER_ADMIN_CODE) {
-      throw new ApplicationError("Super admin permissions can't be edited.");
-    }
-
-    await validatedUpdatePermissionsInput(input);
-
-    if (!role) {
-      return ctx.notFound('role.notFound');
-    }
-
-    const permissions = await roleService.assignPermissions(role.id, input.permissions);
-
-    const sanitizedPermissions = permissions.map(permissionService.sanitizePermission);
-
-    ctx.body = {
-      data: sanitizedPermissions,
-    };
-  },
-
-  /**
-   * Delete a role
-   * @param {KoaContext} ctx - koa context
-   */
-  async deleteOne(ctx) {
-    const { id } = ctx.params;
-
-    await validateRoleDeleteInput(id);
-
-    const roleService = getService('role');
-
-    const roles = await roleService.deleteByIds([id]);
-
-    const sanitizedRole = roles.map((role) => roleService.sanitizeRole(role))[0] || null;
-
-    return ctx.deleted({
-      data: sanitizedRole,
-    });
-  },
-
-  /**
-   * delete several roles
-   * @param {KoaContext} ctx - koa context
-   */
-  async deleteMany(ctx) {
-    const { body } = ctx.request;
-
-    await validateRolesDeleteInput(body);
-
-    const roleService = getService('role');
-
-    const roles = await roleService.deleteByIds(body.ids);
-    const sanitizedRoles = roles.map(roleService.sanitizeRole);
-
-    return ctx.deleted({
-      data: sanitizedRoles,
-    });
-  },
-};

package/server/controllers/transfer/index.js

@@ -1,13 +0,0 @@
-'use strict';
-
-const { mapKeys } = require('lodash/fp');
-
-const runner = require('./runner');
-const token = require('./token');
-
-const prefixActionsName = (prefix, dict) => mapKeys((key) => `${prefix}-${key}`, dict);
-
-module.exports = {
-  ...prefixActionsName('runner', runner),
-  ...prefixActionsName('token', token),
-};

package/server/controllers/transfer/runner.js

@@ -1,28 +0,0 @@
-'use strict';
-
-const { createPushController, createPullController } =
-  require('@strapi/data-transfer').strapi.remote.handlers;
-const {
-  errors: { UnauthorizedError },
-} = require('@strapi/utils');
-
-const dataTransferAuthStrategy = require('../../strategies/data-transfer');
-
-/**
- * @param {import('koa').Context} ctx
- * @param {string} [scope]
- */
-const verify = async (ctx, scope) => {
-  const { auth } = ctx.state;
-
-  if (!auth) {
-    throw new UnauthorizedError();
-  }
-
-  await dataTransferAuthStrategy.verify(auth, { scope });
-};
-
-module.exports = {
-  push: createPushController({ verify }),
-  pull: createPullController({ verify }),
-};

package/server/controllers/transfer/token.js

@@ -1,131 +0,0 @@
-'use strict';
-
-const { trim, has } = require('lodash/fp');
-const {
-  errors: { ApplicationError },
-  stringEquals,
-} = require('@strapi/utils');
-
-const {
-  token: { validateTransferTokenCreationInput, validateTransferTokenUpdateInput },
-} = require('../../validation/transfer');
-const { getService } = require('../../utils');
-
-module.exports = {
-  async list(ctx) {
-    const transferService = getService('transfer');
-    const transferTokens = await transferService.token.list();
-
-    ctx.body = { data: transferTokens };
-  },
-
-  async getById(ctx) {
-    const { id } = ctx.params;
-    const tokenService = getService('transfer').token;
-
-    const transferToken = await tokenService.getById(id);
-
-    if (!transferToken) {
-      ctx.notFound('Transfer token not found');
-      return;
-    }
-
-    ctx.body = { data: transferToken };
-  },
-
-  async create(ctx) {
-    const { body } = ctx.request;
-    const { token: tokenService } = getService('transfer');
-
-    /**
-     * We trim fields to avoid having issues with either:
-     * - having a space at the end or start of the value
-     * - having only spaces as value (so that an empty field can be caught in validation)
-     */
-    const attributes = {
-      name: trim(body.name),
-      description: trim(body.description),
-      permissions: body.permissions,
-      lifespan: body.lifespan,
-    };
-
-    await validateTransferTokenCreationInput(attributes);
-
-    const alreadyExists = await tokenService.exists({ name: attributes.name });
-    if (alreadyExists) {
-      throw new ApplicationError('Name already taken');
-    }
-
-    const transferTokens = await tokenService.create(attributes);
-
-    ctx.created({ data: transferTokens });
-  },
-
-  async update(ctx) {
-    const { body } = ctx.request;
-    const { id } = ctx.params;
-    const { token: tokenService } = getService('transfer');
-
-    const attributes = body;
-    /**
-     * We trim fields to avoid having issues with either:
-     * - having a space at the end or start of the value
-     * - having only spaces as value (so that an empty field can be caught in validation)
-     */
-    if (has('name', attributes)) {
-      attributes.name = trim(body.name);
-    }
-
-    if (has('description', attributes) || attributes.description === null) {
-      attributes.description = trim(body.description);
-    }
-
-    await validateTransferTokenUpdateInput(attributes);
-
-    const apiTokenExists = await tokenService.getById(id);
-    if (!apiTokenExists) {
-      return ctx.notFound('Transfer token not found');
-    }
-
-    if (has('name', attributes)) {
-      const nameAlreadyTaken = await tokenService.getByName(attributes.name);
-
-      /**
-       * We cast the ids as string as the one coming from the ctx isn't cast
-       * as a Number in case it is supposed to be an integer. It remains
-       * as a string. This way we avoid issues with integers in the db.
-       */
-      if (!!nameAlreadyTaken && !stringEquals(nameAlreadyTaken.id, id)) {
-        throw new ApplicationError('Name already taken');
-      }
-    }
-
-    const apiToken = await tokenService.update(id, attributes);
-
-    ctx.body = { data: apiToken };
-  },
-
-  async revoke(ctx) {
-    const { id } = ctx.params;
-    const { token: tokenService } = getService('transfer');
-
-    const transferToken = await tokenService.revoke(id);
-
-    ctx.deleted({ data: transferToken });
-  },
-
-  async regenerate(ctx) {
-    const { id } = ctx.params;
-    const { token: tokenService } = getService('transfer');
-
-    const exists = await tokenService.getById(id);
-    if (!exists) {
-      ctx.notFound('Transfer token not found');
-      return;
-    }
-
-    const accessToken = await tokenService.regenerate(id);
-
-    ctx.created({ data: accessToken });
-  },
-};