@strapi/admin 4.16.2 → 4.18.0

package/server/strategies/__tests__/api-token.test.js

@@ -1,364 +0,0 @@
-'use strict';
-
-const {
-  errors: { UnauthorizedError },
-} = require('@strapi/utils');
-const createContext = require('../../../../../../test/helpers/create-context');
-const apiTokenStrategy = require('../api-token');
-
-describe('API Token Auth Strategy', () => {
-  describe('Authenticate an access key', () => {
-    const request = {
-      header: {
-        authorization: 'Bearer api-token_tests-api-token',
-      },
-    };
-
-    const apiToken = {
-      id: 1,
-      name: 'api-token_tests-name',
-      description: 'api-token_tests-description',
-      type: 'read-only',
-    };
-
-    const hash = jest.fn(() => 'api-token_tests-hashed-access-key');
-
-    test('Authenticates a valid hashed access key', async () => {
-      const getBy = jest.fn(() => apiToken);
-      const update = jest.fn(() => apiToken);
-      const ctx = createContext({}, { request });
-
-      global.strapi = {
-        admin: {
-          services: {
-            'api-token': {
-              getBy,
-              hash,
-            },
-          },
-        },
-        query() {
-          return { update };
-        },
-      };
-
-      const response = await apiTokenStrategy.authenticate(ctx);
-
-      expect(getBy).toHaveBeenCalledWith({ accessKey: 'api-token_tests-hashed-access-key' });
-
-      expect(response).toStrictEqual({ authenticated: true, credentials: apiToken });
-    });
-
-    test('Updates lastUsedAt if the token has not been used in the last hour', async () => {
-      // Mock lastUsedAt to be less than an hour ago
-      const getBy = jest.fn(() => ({
-        ...apiToken,
-        lastUsedAt: new Date(Date.now() - 3600000).toISOString(),
-      }));
-      const update = jest.fn(() => apiToken);
-      const ctx = createContext({}, { request });
-
-      global.strapi = {
-        admin: {
-          services: {
-            'api-token': {
-              getBy,
-              hash,
-            },
-          },
-        },
-        query() {
-          return { update };
-        },
-      };
-
-      await apiTokenStrategy.authenticate(ctx);
-      // It should update the lastUsedAt field if the token has not been used in the last hour
-      expect(update).toHaveBeenCalledWith({
-        data: { lastUsedAt: expect.any(Date) },
-        where: { id: apiToken.id },
-      });
-    });
-
-    test('Does not update lastUsedAt if the token has been used in the last hour', async () => {
-      // Mock lastUsedAt to be less than an hour ago
-      const getBy = jest.fn(() => ({
-        ...apiToken,
-        lastUsedAt: new Date().toISOString(),
-      }));
-      const update = jest.fn(() => apiToken);
-      const ctx = createContext({}, { request });
-
-      global.strapi = {
-        admin: {
-          services: {
-            'api-token': {
-              getBy,
-              hash,
-            },
-          },
-        },
-        query() {
-          return { update };
-        },
-      };
-
-      await apiTokenStrategy.authenticate(ctx);
-      expect(update).not.toHaveBeenCalled();
-    });
-
-    test('Fails to authenticate if the authorization header is missing', async () => {
-      const ctx = createContext({}, { request: { header: {} } });
-
-      const response = await apiTokenStrategy.authenticate(ctx);
-
-      expect(response).toStrictEqual({ authenticated: false });
-    });
-
-    test('Fails to authenticate an invalid authorization header', async () => {
-      const ctx = createContext({}, { request: { header: { authorization: 'invalid-header' } } });
-
-      const response = await apiTokenStrategy.authenticate(ctx);
-
-      expect(response).toStrictEqual({ authenticated: false });
-    });
-
-    test('Fails to authenticate an invalid bearer token', async () => {
-      const getBy = jest.fn(() => null);
-      const ctx = createContext(
-        {},
-        { request: { header: { authorization: 'bearer invalid-header' } } }
-      );
-
-      global.strapi = {
-        admin: {
-          services: {
-            'api-token': {
-              getBy,
-              hash,
-            },
-          },
-        },
-      };
-
-      const response = await apiTokenStrategy.authenticate(ctx);
-
-      expect(getBy).toHaveBeenCalledWith({ accessKey: 'api-token_tests-hashed-access-key' });
-      expect(response).toStrictEqual({ authenticated: false });
-    });
-
-    test('Expired token throws on authorize', async () => {
-      const pastDate = new Date(Date.now() - 1).toISOString();
-
-      const getBy = jest.fn(() => {
-        return {
-          ...apiToken,
-          expiresAt: pastDate,
-        };
-      });
-      const update = jest.fn(() => apiToken);
-      const ctx = createContext({}, { request });
-
-      global.strapi = {
-        admin: {
-          services: {
-            'api-token': {
-              getBy,
-              hash,
-              update,
-            },
-          },
-        },
-      };
-
-      const { authenticated, error } = await apiTokenStrategy.authenticate(ctx);
-
-      expect(authenticated).toBe(false);
-      expect(error).toBeInstanceOf(UnauthorizedError);
-      expect(error.message).toBe('Token expired');
-
-      expect(getBy).toHaveBeenCalledWith({ accessKey: 'api-token_tests-hashed-access-key' });
-    });
-  });
-
-  describe('Verify an access key', () => {
-    const readOnlyApiToken = {
-      id: 1,
-      name: 'api-token_tests-name',
-      description: 'api-token_tests-description',
-      type: 'read-only',
-    };
-
-    const fullAccessApiToken = {
-      ...readOnlyApiToken,
-      type: 'full-access',
-    };
-
-    const customApiToken = {
-      ...readOnlyApiToken,
-      type: 'custom',
-      permissions: ['api::model.model.update', 'api::model.model.read'],
-    };
-
-    const container = {
-      get: jest.fn(() => ({
-        errors: {
-          UnauthorizedError: jest.fn(() => new Error()),
-          ForbiddenError: jest.fn(() => new Error()),
-        },
-      })),
-    };
-
-    const strapiMock = {
-      container,
-      telemetry: {
-        send: jest.fn(),
-      },
-    };
-
-    // mock ability.can (since normally it only gets added to credentials in authenticate)
-    const ability = {
-      can: jest.fn((ability) => {
-        if (customApiToken.permissions.includes(ability)) return true;
-        return false;
-      }),
-    };
-
-    test('Verify read-only access', () => {
-      global.strapi = strapiMock;
-
-      expect(
-        apiTokenStrategy.verify(
-          { credentials: readOnlyApiToken },
-          { scope: ['api::model.model.find'] }
-        )
-      ).toBeUndefined();
-    });
-
-    test('Verify full-access access', () => {
-      global.strapi = strapiMock;
-
-      expect(
-        apiTokenStrategy.verify(
-          { credentials: fullAccessApiToken },
-          { scope: ['api::model.model.create'] }
-        )
-      ).toBeUndefined();
-    });
-
-    test('Verify custom access', async () => {
-      global.strapi = strapiMock;
-
-      expect(
-        apiTokenStrategy.verify(
-          { credentials: customApiToken, ability },
-          { scope: ['api::model.model.update'] }
-        )
-      ).toBeUndefined();
-    });
-
-    test('Verify with expiration in future', () => {
-      global.strapi = strapiMock;
-
-      expect(
-        apiTokenStrategy.verify(
-          {
-            credentials: {
-              ...readOnlyApiToken,
-              expiresAt: Date.now() + 99999,
-            },
-          },
-          { scope: ['api::model.model.find'] }
-        )
-      ).toBeUndefined();
-    });
-
-    test('Throws with expired token', () => {
-      global.strapi = strapiMock;
-
-      expect(() => {
-        apiTokenStrategy.verify(
-          {
-            credentials: {
-              ...readOnlyApiToken,
-              expiresAt: Date.now() - 1,
-            },
-          },
-          { scope: ['api::model.model.find'] }
-        );
-      }).toThrow(new UnauthorizedError('Token expired'));
-    });
-
-    test('Throws an error if trying to access a `full-access` action with a read only access key', () => {
-      global.strapi = strapiMock;
-
-      expect.assertions(1);
-
-      try {
-        apiTokenStrategy.verify(
-          { credentials: { readOnlyApiToken } },
-          { scope: ['api::model.model.create'] }
-        );
-      } catch (err) {
-        expect(err).toBeInstanceOf(Error);
-      }
-    });
-
-    test('Throws an error if trying to access an action with a custom access key without the permission', () => {
-      global.strapi = strapiMock;
-
-      expect.assertions(1);
-
-      try {
-        apiTokenStrategy.verify(
-          { credentials: { customApiToken, ability } },
-          { scope: ['api::model.model.create'] }
-        );
-      } catch (err) {
-        expect(err).toBeInstanceOf(Error);
-      }
-    });
-
-    test('Throws an error if the credentials are not passed in the auth object', () => {
-      global.strapi = strapiMock;
-
-      expect.assertions(1);
-
-      try {
-        apiTokenStrategy.verify({}, { scope: ['api::model.model.create'] });
-      } catch (err) {
-        expect(err).toBeInstanceOf(Error);
-      }
-    });
-
-    test('A `full-access` token is needed when no scope is passed', () => {
-      global.strapi = strapiMock;
-
-      expect(apiTokenStrategy.verify({ credentials: fullAccessApiToken }, {})).toBeUndefined();
-    });
-
-    test('Throws an error if no scope is passed with a `read-only` token', () => {
-      global.strapi = strapiMock;
-
-      expect.assertions(1);
-
-      try {
-        apiTokenStrategy.verify({ credentials: readOnlyApiToken }, {});
-      } catch (err) {
-        expect(err).toBeInstanceOf(Error);
-      }
-    });
-
-    test('Throws an error if no scope is passed with a `custom` token', () => {
-      global.strapi = strapiMock;
-
-      expect.assertions(1);
-
-      try {
-        apiTokenStrategy.verify({ credentials: customApiToken }, {});
-      } catch (err) {
-        expect(err).toBeInstanceOf(Error);
-      }
-    });
-  });
-});

package/server/strategies/admin.js

@@ -1,52 +0,0 @@
-'use strict';
-
-const { getService } = require('../utils');
-
-/** @type {import('.').AuthenticateFunction} */
-const authenticate = async (ctx) => {
-  const { authorization } = ctx.request.header;
-
-  if (!authorization) {
-    return { authenticated: false };
-  }
-
-  const parts = authorization.split(/\s+/);
-
-  if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {
-    return { authenticated: false };
-  }
-
-  const token = parts[1];
-  const { payload, isValid } = getService('token').decodeJwtToken(token);
-
-  if (!isValid) {
-    return { authenticated: false };
-  }
-
-  const user = await strapi
-    .query('admin::user')
-    .findOne({ where: { id: payload.id }, populate: ['roles'] });
-
-  if (!user || !(user.isActive === true)) {
-    return { authenticated: false };
-  }
-
-  const userAbility = await getService('permission').engine.generateUserAbility(user);
-
-  // TODO: use the ability from ctx.state.auth instead of
-  // ctx.state.userAbility, and remove the assign below
-  ctx.state.userAbility = userAbility;
-  ctx.state.user = user;
-
-  return {
-    authenticated: true,
-    credentials: user,
-    ability: userAbility,
-  };
-};
-
-/** @type {import('.').AuthStrategy} */
-module.exports = {
-  name: 'admin',
-  authenticate,
-};

package/server/strategies/api-token.js

@@ -1,140 +0,0 @@
-'use strict';
-
-const { castArray, isNil } = require('lodash/fp');
-const { differenceInHours, parseISO } = require('date-fns');
-const { UnauthorizedError, ForbiddenError } = require('@strapi/utils').errors;
-const constants = require('../services/constants');
-const { getService } = require('../utils');
-
-const isReadScope = (scope) => scope.endsWith('find') || scope.endsWith('findOne');
-
-const extractToken = (ctx) => {
-  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {
-    const parts = ctx.request.header.authorization.split(/\s+/);
-
-    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {
-      return null;
-    }
-
-    return parts[1];
-  }
-
-  return null;
-};
-
-/**
- * Authenticate the validity of the token
- *
- *  @type {import('.').AuthenticateFunction}
- */
-const authenticate = async (ctx) => {
-  const apiTokenService = getService('api-token');
-  const token = extractToken(ctx);
-
-  if (!token) {
-    return { authenticated: false };
-  }
-
-  const apiToken = await apiTokenService.getBy({
-    accessKey: apiTokenService.hash(token),
-  });
-
-  // token not found
-  if (!apiToken) {
-    return { authenticated: false };
-  }
-
-  const currentDate = new Date();
-
-  if (!isNil(apiToken.expiresAt)) {
-    const expirationDate = new Date(apiToken.expiresAt);
-    // token has expired
-    if (expirationDate < currentDate) {
-      return { authenticated: false, error: new UnauthorizedError('Token expired') };
-    }
-  }
-
-  // update lastUsedAt if the token has not been used in the last hour
-  const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(apiToken.lastUsedAt));
-  if (hoursSinceLastUsed >= 1) {
-    await strapi.query('admin::api-token').update({
-      where: { id: apiToken.id },
-      data: { lastUsedAt: currentDate },
-    });
-  }
-
-  if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {
-    const ability = await strapi.contentAPI.permissions.engine.generateAbility(
-      apiToken.permissions.map((action) => ({ action }))
-    );
-
-    return { authenticated: true, ability, credentials: apiToken };
-  }
-
-  return { authenticated: true, credentials: apiToken };
-};
-
-/**
- * Verify the token has the required abilities for the requested scope
- *
- *  @type {import('.').VerifyFunction}
- */
-const verify = (auth, config) => {
-  const { credentials: apiToken, ability } = auth;
-
-  if (!apiToken) {
-    throw new UnauthorizedError('Token not found');
-  }
-
-  const currentDate = new Date();
-
-  if (!isNil(apiToken.expiresAt)) {
-    const expirationDate = new Date(apiToken.expiresAt);
-    // token has expired
-    if (expirationDate < currentDate) {
-      throw new UnauthorizedError('Token expired');
-    }
-  }
-
-  // Full access
-  if (apiToken.type === constants.API_TOKEN_TYPE.FULL_ACCESS) {
-    return;
-  }
-
-  // Read only
-  if (apiToken.type === constants.API_TOKEN_TYPE.READ_ONLY) {
-    /**
-     * If you don't have `full-access` you can only access `find` and `findOne`
-     * scopes. If the route has no scope, then you can't get access to it.
-     */
-    const scopes = castArray(config.scope);
-
-    if (config.scope && scopes.every(isReadScope)) {
-      return;
-    }
-  }
-
-  // Custom
-  else if (apiToken.type === constants.API_TOKEN_TYPE.CUSTOM) {
-    if (!ability) {
-      throw new ForbiddenError();
-    }
-
-    const scopes = castArray(config.scope);
-
-    const isAllowed = scopes.every((scope) => ability.can(scope));
-
-    if (isAllowed) {
-      return;
-    }
-  }
-
-  throw new ForbiddenError();
-};
-
-/** @type {import('.').AuthStrategy} */
-module.exports = {
-  name: 'api-token',
-  authenticate,
-  verify,
-};

package/server/strategies/data-transfer.js

@@ -1,113 +0,0 @@
-'use strict';
-
-const { differenceInHours, parseISO } = require('date-fns');
-const {
-  errors: { UnauthorizedError, ForbiddenError },
-} = require('@strapi/utils');
-const { castArray, isNil } = require('lodash/fp');
-
-const { getService } = require('../utils');
-
-const extractToken = (ctx) => {
-  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {
-    const parts = ctx.request.header.authorization.split(/\s+/);
-
-    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {
-      return null;
-    }
-
-    return parts[1];
-  }
-
-  return null;
-};
-
-/**
- * Authenticate the validity of the token
- *
- *  @type {import('.').AuthenticateFunction}
- */
-const authenticate = async (ctx) => {
-  const { token: tokenService } = getService('transfer');
-  const token = extractToken(ctx);
-
-  if (!token) {
-    return { authenticated: false };
-  }
-
-  const transferToken = await tokenService.getBy({ accessKey: tokenService.hash(token) });
-
-  // Check if the token exists
-  if (!transferToken) {
-    return { authenticated: false };
-  }
-
-  // Check if the token has expired
-  const currentDate = new Date();
-
-  if (!isNil(transferToken.expiresAt)) {
-    const expirationDate = new Date(transferToken.expiresAt);
-
-    if (expirationDate < currentDate) {
-      return { authenticated: false, error: new UnauthorizedError('Token expired') };
-    }
-  }
-
-  // Update token metadata if the token has not been used in the last hour
-  const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(transferToken.lastUsedAt));
-  if (hoursSinceLastUsed >= 1) {
-    await strapi.query('admin::api-token').update({
-      where: { id: transferToken.id },
-      data: { lastUsedAt: currentDate },
-    });
-  }
-
-  // Generate an ability based on the token permissions
-  const ability = await getService('transfer').permission.engine.generateAbility(
-    transferToken.permissions.map((action) => ({ action }))
-  );
-
-  return { authenticated: true, ability, credentials: transferToken };
-};
-
-/**
- * Verify the token has the required abilities for the requested scope
- *
- *  @type {import('.').VerifyFunction}
- */
-const verify = async (auth, config = {}) => {
-  const { credentials: transferToken, ability } = auth;
-
-  if (!transferToken) {
-    throw new UnauthorizedError('Token not found');
-  }
-
-  const currentDate = new Date();
-
-  if (!isNil(transferToken.expiresAt)) {
-    const expirationDate = new Date(transferToken.expiresAt);
-    // token has expired
-    if (expirationDate < currentDate) {
-      throw new UnauthorizedError('Token expired');
-    }
-  }
-
-  if (!ability) {
-    throw new ForbiddenError();
-  }
-
-  const scopes = castArray(config.scope ?? []);
-
-  const isAllowed = scopes.every((scope) => ability.can(scope));
-
-  if (!isAllowed) {
-    throw new ForbiddenError();
-  }
-};
-
-/** @type {import('.').AuthStrategy} */
-module.exports = {
-  name: 'data-transfer',
-  authenticate,
-  verify,
-};

package/server/strategies/index.js

@@ -1,26 +0,0 @@
-'use strict';
-
-/**
- * @typedef {{authenticated: boolean, error?: string, credentials?: Record<any, any>}} AuthenticateResponse
- * @typedef {(ctx: Record<any, any>) => AuthenticateResponse | Promise<AuthenticateResponse>} AuthenticateFunction
- * @typedef {{strategy: AuthStrategy, credentials?: Record<any, any>}} VerifyInputAuth
- * @typedef {{scope: string, [key: any]: any}} VerifyInputConfig
- * @typedef {(auth: VerifyInputAuth, config: VerifyInputConfig) => void | Promise<void>} VerifyFunction
- */
-
-/**
- * @typedef AuthStrategy
- *
- * @property {string} name
- * @property {AuthenticateFunction} authenticate
- * @property {VerifyFunction} [verify]
- */
-
-/**
- * @type {Record<string, AuthStrategy>}
- */
-module.exports = {
-  admin: require('./admin'),
-  'data-transfer': require('./data-transfer'),
-  'api-token': require('./api-token'),
-};