@strapi/admin 4.16.2 → 4.18.0

package/server/services/content-type.js

@@ -1,208 +0,0 @@
-'use strict';
-
-const _ = require('lodash');
-const { uniq, startsWith, intersection } = require('lodash/fp');
-const { contentTypes: contentTypesUtils } = require('@strapi/utils');
-const { getService } = require('../utils');
-const actionDomain = require('../domain/action');
-const permissionDomain = require('../domain/permission');
-
-/**
- * Creates an array of paths to the fields and nested fields, without path nodes
- * @param {string} model model used to get the nested fields
- * @param {Object} options
- * @param {string} options.prefix prefix to add to the path
- * @param {number} options.nestingLevel level of nesting to achieve
- * @param {object} options.components components where components attributes can be found
- * @param {object} options.requiredOnly only returns required nestedFields
- * @param {object} options.existingFields fields that are already selected, meaning that some sub-fields may be required
- * @returns {array<string>}
- * @param model
- */
-const getNestedFields = (
-  model,
-  { prefix = '', nestingLevel = 15, components = {}, requiredOnly = false, existingFields = [] }
-) => {
-  if (nestingLevel === 0) {
-    return prefix ? [prefix] : [];
-  }
-
-  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);
-
-  return _.reduce(
-    model.attributes,
-    (fields, attr, key) => {
-      if (nonAuthorizableFields.includes(key)) return fields;
-
-      const fieldPath = prefix ? `${prefix}.${key}` : key;
-      const shouldBeIncluded = !requiredOnly || attr.required === true;
-      const insideExistingFields = existingFields && existingFields.some(startsWith(fieldPath));
-
-      if (attr.type === 'component') {
-        if (shouldBeIncluded || insideExistingFields) {
-          const compoFields = getNestedFields(components[attr.component], {
-            nestingLevel: nestingLevel - 1,
-            prefix: fieldPath,
-            components,
-            requiredOnly,
-            existingFields,
-          });
-
-          if (compoFields.length === 0 && shouldBeIncluded) {
-            return fields.concat(fieldPath);
-          }
-
-          return fields.concat(compoFields);
-        }
-        return fields;
-      }
-
-      if (shouldBeIncluded) {
-        return fields.concat(fieldPath);
-      }
-
-      return fields;
-    },
-    []
-  );
-};
-
-/**
- * Creates an array of paths to the fields and nested fields, with path nodes
- * @param {string} model model used to get the nested fields
- * @param {Object} options
- * @param {string} options.prefix prefix to add to the path
- * @param {number} options.nestingLevel level of nesting to achieve
- * @param {object} options.components components where components attributes can be found
- * @returns {array<string>}
- */
-
-const getNestedFieldsWithIntermediate = (
-  model,
-  { prefix = '', nestingLevel = 15, components = {} }
-) => {
-  if (nestingLevel === 0) {
-    return [];
-  }
-
-  const nonAuthorizableFields = contentTypesUtils.getNonVisibleAttributes(model);
-
-  return _.reduce(
-    model.attributes,
-    (fields, attr, key) => {
-      if (nonAuthorizableFields.includes(key)) return fields;
-
-      const fieldPath = prefix ? `${prefix}.${key}` : key;
-      fields.push(fieldPath);
-
-      if (attr.type === 'component') {
-        const compoFields = getNestedFieldsWithIntermediate(components[attr.component], {
-          nestingLevel: nestingLevel - 1,
-          prefix: fieldPath,
-          components,
-        });
-
-        fields.push(...compoFields);
-      }
-
-      return fields;
-    },
-    []
-  );
-};
-
-/**
- * Creates an array of permissions with the "properties.fields" attribute filled
- * @param {array} actions array of actions
- * @param {object} options
- * @param {number} options.nestingLevel level of nesting
- * @param {array} options.restrictedSubjects subjectsId to ignore
- * @returns {Permission[]}
- */
-const getPermissionsWithNestedFields = (
-  actions,
-  { nestingLevel, restrictedSubjects = [] } = {}
-) => {
-  return actions.reduce((permissions, action) => {
-    const validSubjects = action.subjects.filter(
-      (subject) => !restrictedSubjects.includes(subject)
-    );
-
-    // Create a Permission for each subject (content-type uid) within the action
-    for (const subject of validSubjects) {
-      const fields = actionDomain.appliesToProperty('fields', action)
-        ? getNestedFields(strapi.contentTypes[subject], {
-            components: strapi.components,
-            nestingLevel,
-          })
-        : undefined;
-
-      const permission = permissionDomain.create({
-        action: action.actionId,
-        subject,
-        properties: { fields },
-      });
-
-      permissions.push(permission);
-    }
-
-    return permissions;
-  }, []);
-};
-
-/**
- * Cleans permissions' fields (add required ones, remove the non-existing ones)
- * @param {Permission[]} permissions array of existing permissions in db
- * @param {object} options
- * @param {number} options.nestingLevel level of nesting
- * @returns {Permission[]}
- */
-const cleanPermissionFields = (permissions, { nestingLevel } = {}) => {
-  const { actionProvider } = getService('permission');
-
-  return permissions.map((permission) => {
-    const {
-      action: actionId,
-      subject,
-      properties: { fields },
-    } = permission;
-
-    const action = actionProvider.get(actionId);
-
-    // todo see if it's possible to check property on action + subject (async)
-    if (!actionDomain.appliesToProperty('fields', action)) {
-      return permissionDomain.deleteProperty('fields', permission);
-    }
-
-    if (!subject || !strapi.contentTypes[subject]) {
-      return permission;
-    }
-
-    const possibleFields = getNestedFieldsWithIntermediate(strapi.contentTypes[subject], {
-      components: strapi.components,
-      nestingLevel,
-    });
-
-    const requiredFields = getNestedFields(strapi.contentTypes[subject], {
-      components: strapi.components,
-      requiredOnly: true,
-      nestingLevel,
-      existingFields: fields,
-    });
-
-    const badNestedFields = uniq([...intersection(fields, possibleFields), ...requiredFields]);
-
-    const newFields = badNestedFields.filter(
-      (field) => !badNestedFields.some(startsWith(`${field}.`))
-    );
-
-    return permissionDomain.setProperty('fields', newFields, permission);
-  }, []);
-};
-
-module.exports = {
-  getNestedFields,
-  getPermissionsWithNestedFields,
-  cleanPermissionFields,
-  getNestedFieldsWithIntermediate,
-};

package/server/services/index.js

@@ -1,18 +0,0 @@
-'use strict';
-
-module.exports = {
-  user: require('./user'),
-  token: require('./token'),
-  role: require('./role'),
-  permission: require('./permission'),
-  passport: require('./passport'),
-  metrics: require('./metrics'),
-  'content-type': require('./content-type'),
-  constants: require('./constants'),
-  condition: require('./condition'),
-  auth: require('./auth'),
-  action: require('./action'),
-  'api-token': require('./api-token'),
-  transfer: require('./transfer'),
-  'project-settings': require('./project-settings'),
-};

package/server/services/metrics.js

@@ -1,44 +0,0 @@
-'use strict';
-
-const { getService } = require('../utils');
-
-const sendDidInviteUser = async () => {
-  const numberOfUsers = await getService('user').count();
-  const numberOfRoles = await getService('role').count();
-  strapi.telemetry.send('didInviteUser', {
-    groupProperties: { numberOfRoles, numberOfUsers },
-  });
-};
-
-const sendDidUpdateRolePermissions = async () => {
-  strapi.telemetry.send('didUpdateRolePermissions');
-};
-
-const sendDidChangeInterfaceLanguage = async () => {
-  const languagesInUse = await getService('user').getLanguagesInUse();
-  // This event is anonymous
-  strapi.telemetry.send('didChangeInterfaceLanguage', { userProperties: { languagesInUse } });
-};
-
-const sendUpdateProjectInformation = async () => {
-  const numberOfActiveAdminUsers = await getService('user').count({ isActive: true });
-  const numberOfAdminUsers = await getService('user').count();
-
-  strapi.telemetry.send('didUpdateProjectInformation', {
-    groupProperties: { numberOfActiveAdminUsers, numberOfAdminUsers },
-  });
-};
-
-const startCron = (strapi) => {
-  strapi.cron.add({
-    '0 0 0 * * *': () => sendUpdateProjectInformation(),
-  });
-};
-
-module.exports = {
-  sendDidInviteUser,
-  sendDidUpdateRolePermissions,
-  sendDidChangeInterfaceLanguage,
-  sendUpdateProjectInformation,
-  startCron,
-};

package/server/services/passport/local-strategy.js

@@ -1,28 +0,0 @@
-'use strict';
-
-const { toLower } = require('lodash/fp');
-const { Strategy: LocalStrategy } = require('passport-local');
-
-const createLocalStrategy = (strapi, middleware) => {
-  return new LocalStrategy(
-    {
-      usernameField: 'email',
-      passwordField: 'password',
-      session: false,
-    },
-    (email, password, done) => {
-      return strapi.admin.services.auth
-        .checkCredentials({ email: toLower(email), password })
-        .then(async ([error, user, message]) => {
-          if (middleware) {
-            return middleware([error, user, message], done);
-          }
-
-          return done(error, user, message);
-        })
-        .catch((error) => done(error));
-    }
-  );
-};
-
-module.exports = createLocalStrategy;

package/server/services/passport.js

@@ -1,45 +0,0 @@
-'use strict';
-
-const passport = require('koa-passport');
-const { isFunction } = require('lodash/fp');
-
-const createLocalStrategy = require('./passport/local-strategy');
-
-const authEventsMapper = {
-  onConnectionSuccess: 'admin.auth.success',
-  onConnectionError: 'admin.auth.error',
-};
-
-const valueIsFunctionType = ([, value]) => isFunction(value);
-const keyIsValidEventName = ([key]) => {
-  return Object.keys(strapi.admin.services.passport.authEventsMapper).includes(key);
-};
-
-const getPassportStrategies = () => [createLocalStrategy(strapi)];
-
-const registerAuthEvents = () => {
-  const { events = {} } = strapi.config.get('admin.auth', {});
-  const { authEventsMapper } = strapi.admin.services.passport;
-
-  const eventList = Object.entries(events).filter(keyIsValidEventName).filter(valueIsFunctionType);
-
-  for (const [eventName, handler] of eventList) {
-    strapi.eventHub.on(authEventsMapper[eventName], handler);
-  }
-};
-
-const init = () => {
-  strapi.admin.services.passport
-    .getPassportStrategies()
-    .forEach((strategy) => passport.use(strategy));
-
-  registerAuthEvents();
-
-  return passport.initialize();
-};
-
-module.exports = {
-  init,
-  getPassportStrategies,
-  authEventsMapper,
-};

package/server/services/permission/engine.js

@@ -1,85 +0,0 @@
-'use strict';
-
-const { curry, isArray, isEmpty, difference } = require('lodash/fp');
-const permissions = require('@strapi/permissions');
-
-const permissionDomain = require('../../domain/permission/index');
-const { getService } = require('../../utils');
-
-module.exports = (params) => {
-  const { providers } = params;
-
-  const engine = permissions.engine
-    .new({ providers })
-    /**
-     * Validate the permission's action exists in the action registry
-     */
-    .on('before-format::validate.permission', ({ permission }) => {
-      const action = providers.action.get(permission.action);
-
-      // If the action isn't registered into the action provider, then ignore the permission
-      if (!action) {
-        strapi.log.debug(
-          `Unknown action "${permission.action}" supplied when registering a new permission in engine`
-        );
-        return false;
-      }
-    })
-
-    /**
-     * Remove invalid properties from the permission based on the action (applyToProperties)
-     */
-    .on('format.permission', (permission) => {
-      const action = providers.action.get(permission.action);
-      const properties = permission.properties || {};
-
-      // Only keep the properties allowed by the action (action.applyToProperties)
-      const propertiesName = Object.keys(properties);
-      const invalidProperties = difference(
-        propertiesName,
-        action.applyToProperties || propertiesName
-      );
-
-      const permissionWithSanitizedProperties = invalidProperties.reduce(
-        (property) => permissionDomain.deleteProperty(property, permission),
-        permission
-      );
-
-      return permissionWithSanitizedProperties;
-    })
-
-    /**
-     * Ignore the permission if the fields property is an empty array (access to no field)
-     */
-    .on('after-format::validate.permission', ({ permission }) => {
-      const { fields } = permission.properties;
-
-      if (isArray(fields) && isEmpty(fields)) {
-        return false;
-      }
-    });
-
-  return {
-    get hooks() {
-      return engine.hooks;
-    },
-
-    /**
-     * Generate an ability based on the given user (using associated roles & permissions)
-     * @param user
-     * @returns {Promise<Ability>}
-     */
-    async generateUserAbility(user) {
-      const permissions = await getService('permission').findUserPermissions(user);
-
-      return engine.generateAbility(permissions, user);
-    },
-
-    /**
-     * Check many permissions based on an ability
-     */
-    checkMany: curry((ability, permissions) => {
-      return permissions.map(({ action, subject, field }) => ability.can(action, subject, field));
-    }),
-  };
-};

package/server/services/permission/permissions-manager/index.js

@@ -1,53 +0,0 @@
-'use strict';
-
-const _ = require('lodash');
-const { cloneDeep, isPlainObject } = require('lodash/fp');
-const { subject: asSubject } = require('@casl/ability');
-const createSanitizeHelpers = require('./sanitize');
-const createValidateHelpers = require('./validate');
-
-const { buildStrapiQuery, buildCaslQuery } = require('./query-builders');
-
-module.exports = ({ ability, action, model }) => ({
-  ability,
-  action,
-  model,
-
-  get isAllowed() {
-    return this.ability.can(action, model);
-  },
-
-  toSubject(target, subjectType = model) {
-    return asSubject(subjectType, target);
-  },
-
-  pickPermittedFieldsOf(data, options = {}) {
-    return this.sanitizeInput(data, options);
-  },
-
-  getQuery(queryAction = action) {
-    if (_.isUndefined(queryAction)) {
-      throw new Error('Action must be defined to build a permission query');
-    }
-
-    return buildStrapiQuery(buildCaslQuery(ability, queryAction, model));
-  },
-
-  addPermissionsQueryTo(query = {}, action) {
-    const newQuery = cloneDeep(query);
-    const permissionQuery = this.getQuery(action) ?? undefined;
-
-    if (isPlainObject(query.filters)) {
-      newQuery.filters = permissionQuery
-        ? { $and: [query.filters, permissionQuery] }
-        : query.filters;
-    } else {
-      newQuery.filters = permissionQuery;
-    }
-
-    return newQuery;
-  },
-
-  ...createSanitizeHelpers({ action, ability, model }),
-  ...createValidateHelpers({ action, ability, model }),
-});

package/server/services/permission/permissions-manager/query-builders.js

@@ -1,72 +0,0 @@
-'use strict';
-
-// TODO: migration
-const _ = require('lodash');
-const { rulesToQuery } = require('@casl/ability/extra');
-
-const operatorsMap = {
-  $in: '$in',
-  $nin: '$notIn',
-  $exists: '$notNull',
-  $gte: '$gte',
-  $gt: '$gt',
-  $lte: '$lte',
-  $lt: '$lt',
-  $eq: '$eq',
-  $ne: '$ne',
-  $and: '$and',
-  $or: '$or',
-  $not: '$not',
-};
-
-const mapKey = (key) => {
-  if (_.isString(key) && key.startsWith('$') && key in operatorsMap) {
-    return operatorsMap[key];
-  }
-  return key;
-};
-
-const buildCaslQuery = (ability, action, model) => {
-  return rulesToQuery(ability, action, model, (o) => o.conditions);
-};
-
-const buildStrapiQuery = (caslQuery) => {
-  return unwrapDeep(caslQuery);
-};
-
-const unwrapDeep = (obj) => {
-  if (!_.isPlainObject(obj) && !_.isArray(obj)) {
-    return obj;
-  }
-  if (_.isArray(obj)) {
-    return obj.map((v) => unwrapDeep(v));
-  }
-
-  return _.reduce(
-    obj,
-    (acc, v, k) => {
-      const key = mapKey(k);
-
-      if (_.isPlainObject(v)) {
-        if ('$elemMatch' in v) {
-          _.setWith(acc, key, unwrapDeep(v.$elemMatch));
-        } else {
-          _.setWith(acc, key, unwrapDeep(v));
-        }
-      } else if (_.isArray(v)) {
-        // prettier-ignore
-        _.setWith(acc, key, v.map(v => unwrapDeep(v)));
-      } else {
-        _.setWith(acc, key, v);
-      }
-
-      return acc;
-    },
-    {}
-  );
-};
-
-module.exports = {
-  buildCaslQuery,
-  buildStrapiQuery,
-};