@strapi/admin 4.26.0 → 4.26.2

package/dist/server/index.js

@@ -7,7 +7,7 @@ const path = require("path");
 const fse = require("fs-extra");
 const koaStatic = require("koa-static");
 const dateFns = require("date-fns");
-const _$1 = require("lodash");
+const _$2 = require("lodash");
 const bcrypt = require("bcryptjs");
 const deepEqual = require("fast-deep-equal");
 const passport$1 = require("koa-passport");
@@ -31,7 +31,7 @@ const utils__default = /* @__PURE__ */ _interopDefault(utils$1);
 const path__default = /* @__PURE__ */ _interopDefault(path);
 const fse__default = /* @__PURE__ */ _interopDefault(fse);
 const koaStatic__default = /* @__PURE__ */ _interopDefault(koaStatic);
-const ___default = /* @__PURE__ */ _interopDefault(_$1);
+const ___default = /* @__PURE__ */ _interopDefault(_$2);
 const bcrypt__default = /* @__PURE__ */ _interopDefault(bcrypt);
 const deepEqual__default = /* @__PURE__ */ _interopDefault(deepEqual);
 const passport__default = /* @__PURE__ */ _interopDefault(passport$1);
@@ -1426,7 +1426,7 @@ const getDefaultActionAttributes = () => ({
     applyToProperties: null
   }
 });
-const actionFields = [
+const actionFields$1 = [
   "section",
   "displayName",
   "category",
@@ -1437,7 +1437,7 @@ const actionFields = [
   "actionId",
   "aliases"
 ];
-const sanitizeActionAttributes = fp.pick(actionFields);
+const sanitizeActionAttributes = fp.pick(actionFields$1);
 const computeActionId = (attributes) => {
   const { pluginName, uid } = attributes;
   if (!pluginName) {
@@ -1471,7 +1471,7 @@ const create$6 = fp.pipe(
   fp.merge(getDefaultActionAttributes())
 );
 const actionDomain = {
-  actionFields,
+  actionFields: actionFields$1,
   appliesToProperty,
   appliesToSubject,
   assignActionId,
@@ -1493,8 +1493,7 @@ const checkFieldsAreCorrectlyNested = (fields) => {
     failed = fields.slice(indexA + 1).some(
       (fieldB) => fieldB.startsWith(`${fields[indexA]}.`) || fields[indexA].startsWith(`${fieldB}.`)
     );
-    if (failed)
-      break;
+    if (failed) break;
   }
   return !failed;
 };
@@ -1507,6 +1506,7 @@ const checkFieldsDontHaveDuplicates = (fields) => {
   }
   return ___default.default.uniq(fields).length === fields.length;
 };
+const { actionFields } = actionDomain;
 const getActionFromProvider = (actionId) => {
   return getService("permission").actionProvider.get(actionId);
 };
@@ -1519,7 +1519,7 @@ const roles = utils$1.yup.array(utils$1.yup.strapiID()).min(1);
 const isAPluginName = utils$1.yup.string().test("is-a-plugin-name", "is not a plugin name", function(value) {
   return [void 0, "admin", ...Object.keys(strapi.plugins)].includes(value) ? true : this.createError({ path: this.path, message: `${this.path} is not an existing plugin` });
 });
-const arrayOfConditionNames = utils$1.yup.array().of(utils$1.yup.string()).test("is-an-array-of-conditions", "is not a plugin name", function(value) {
+utils$1.yup.array().of(utils$1.yup.string()).test("is-an-array-of-conditions", "is not a plugin name", function(value) {
   const ids = strapi.admin.services.permission.conditionProvider.keys();
   return ___default.default.isUndefined(value) || ___default.default.difference(value, ids).length === 0 ? true : this.createError({ path: this.path, message: `contains conditions that don't exist` });
 });
@@ -1624,8 +1624,6 @@ const validators = {
   password,
   roles,
   isAPluginName,
-  arrayOfConditionNames,
-  permission: permission$3,
   updatePermissions
 };
 const { SUPER_ADMIN_CODE: SUPER_ADMIN_CODE$2 } = constants$3;
@@ -1705,8 +1703,7 @@ const resetPasswordByEmail = async (email2, password$1) => {
 };
 const isLastSuperAdminUser = async (userId) => {
   const user2 = await findOne$1(userId);
-  if (!user2)
-    return false;
+  if (!user2) return false;
   const superAdminRole = await getService("role").getSuperAdminWithUsersCount();
   return superAdminRole.usersCount === 1 && hasSuperAdminRole$1(user2);
 };
@@ -2236,9 +2233,6 @@ const createLocalStrategy = (strapi2, middleware) => {
     },
     (email2, password2, done) => {
       return getService("auth").checkCredentials({ email: fp.toLower(email2), password: password2 }).then(async ([error, user2, message]) => {
-        if (middleware) {
-          return middleware([error, user2, message], done);
-        }
         return done(error, user2, message);
       }).catch((error) => done(error));
     }
@@ -2545,44 +2539,57 @@ const createSanitizeHelpers = ({ action: action2, ability: ability$1, model }) =
   const createSanitizeQuery = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
-    const sanitizeFilters = utils$1.pipeAsync(
-      utils$1.traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQueryFilters(omitDisallowedAdminUserFields, { schema }),
-      utils$1.traverse.traverseQueryFilters(omitHiddenFields, { schema }),
-      utils$1.traverse.traverseQueryFilters(removePassword, { schema }),
-      utils$1.traverse.traverseQueryFilters(
-        ({ key, value }, { remove }) => {
-          if (fp.isObject(value) && fp.isEmpty(value)) {
-            remove(key);
-          }
-        },
-        { schema }
-      )
+    const createSanitizeFilters = (ctx) => utils$1.pipeAsync(
+      utils$1.traverse.traverseQueryFilters(removeDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQueryFilters(omitDisallowedAdminUserFields, ctx),
+      utils$1.traverse.traverseQueryFilters(omitHiddenFields, ctx),
+      utils$1.traverse.traverseQueryFilters(removePassword, ctx),
+      utils$1.traverse.traverseQueryFilters(({ key, value }, { remove }) => {
+        if (fp.isObject(value) && fp.isEmpty(value)) {
+          remove(key);
+        }
+      }, ctx)
     );
-    const sanitizeSort = utils$1.pipeAsync(
-      utils$1.traverse.traverseQuerySort(removeDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQuerySort(omitDisallowedAdminUserFields, { schema }),
-      utils$1.traverse.traverseQuerySort(omitHiddenFields, { schema }),
-      utils$1.traverse.traverseQuerySort(removePassword, { schema }),
-      utils$1.traverse.traverseQuerySort(
-        ({ key, attribute, value }, { remove }) => {
-          if (!isScalarAttribute$1(attribute) && fp.isEmpty(value)) {
-            remove(key);
-          }
-        },
-        { schema }
-      )
+    const createSanitizeSort = (ctx) => utils$1.pipeAsync(
+      utils$1.traverse.traverseQuerySort(removeDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQuerySort(omitDisallowedAdminUserFields, ctx),
+      utils$1.traverse.traverseQuerySort(omitHiddenFields, ctx),
+      utils$1.traverse.traverseQuerySort(removePassword, ctx),
+      utils$1.traverse.traverseQuerySort(({ key, attribute, value }, { remove }) => {
+        if (!isScalarAttribute$1(attribute) && fp.isEmpty(value)) {
+          remove(key);
+        }
+      }, ctx)
+    );
+    const createSanitizeFields = (ctx) => utils$1.pipeAsync(
+      utils$1.traverse.traverseQueryFields(removeDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQueryFields(omitHiddenFields, ctx),
+      utils$1.traverse.traverseQueryFields(removePassword, ctx)
     );
+    const sanitizeFilters = createSanitizeFilters({ schema });
+    const sanitizeSort = createSanitizeSort({ schema });
+    const sanitizeFields = createSanitizeFields({ schema });
+    const sanitizeNestedPopulate = async ({ key, value, schema: schema2, attribute }, { set }) => {
+      if (attribute) {
+        return;
+      }
+      const nestedCtx = { schema: schema2 };
+      if (key === "sort") {
+        set(key, await createSanitizeSort(nestedCtx)(value));
+      }
+      if (key === "filters") {
+        set(key, await createSanitizeFilters(nestedCtx)(value));
+      }
+      if (key === "fields") {
+        set(key, await createSanitizeFields(nestedCtx)(value));
+      }
+    };
     const sanitizePopulate = utils$1.pipeAsync(
       utils$1.traverse.traverseQueryPopulate(removeDisallowedFields(permittedFields), { schema }),
       utils$1.traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, { schema }),
       utils$1.traverse.traverseQueryPopulate(omitHiddenFields, { schema }),
-      utils$1.traverse.traverseQueryPopulate(removePassword, { schema })
-    );
-    const sanitizeFields = utils$1.pipeAsync(
-      utils$1.traverse.traverseQueryFields(removeDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQueryFields(omitHiddenFields, { schema }),
-      utils$1.traverse.traverseQueryFields(removePassword, { schema })
+      utils$1.traverse.traverseQueryPopulate(removePassword, { schema }),
+      utils$1.traverse.traverseQueryPopulate(sanitizeNestedPopulate, { schema })
     );
     return async (query) => {
       const sanitizedQuery = fp.cloneDeep(query);
@@ -2743,35 +2750,53 @@ const createValidateHelpers = ({ action: action2, ability: ability$1, model }) =
   const createValidateQuery = (options = {}) => {
     const { fields } = options;
     const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
-    const validateFilters = utils$1.pipeAsync(
-      utils$1.traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQueryFilters(throwDisallowedAdminUserFields, { schema }),
-      utils$1.traverse.traverseQueryFilters(throwPassword, { schema }),
-      utils$1.traverse.traverseQueryFilters(
-        ({ key, value }) => {
-          if (fp.isObject(value) && fp.isEmpty(value)) {
-            throwInvalidParam({ key });
-          }
-        },
-        { schema }
-      )
+    const createValidateFilters = (ctx) => utils$1.pipeAsync(
+      utils$1.traverse.traverseQueryFilters(throwDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQueryFilters(throwDisallowedAdminUserFields, ctx),
+      utils$1.traverse.traverseQueryFilters(throwPassword, ctx),
+      utils$1.traverse.traverseQueryFilters(({ key, value }) => {
+        if (fp.isObject(value) && fp.isEmpty(value)) {
+          throwInvalidParam({ key });
+        }
+      }, ctx)
     );
-    const validateSort = utils$1.pipeAsync(
-      utils$1.traverse.traverseQuerySort(throwDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQuerySort(throwDisallowedAdminUserFields, { schema }),
-      utils$1.traverse.traverseQuerySort(throwPassword, { schema }),
-      utils$1.traverse.traverseQuerySort(
-        ({ key, attribute, value }) => {
-          if (!isScalarAttribute(attribute) && fp.isEmpty(value)) {
-            throwInvalidParam({ key });
-          }
-        },
-        { schema }
-      )
+    const createValidateSort = (ctx) => utils$1.pipeAsync(
+      utils$1.traverse.traverseQuerySort(throwDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQuerySort(throwDisallowedAdminUserFields, ctx),
+      utils$1.traverse.traverseQuerySort(throwPassword, ctx),
+      utils$1.traverse.traverseQuerySort(({ key, attribute, value }) => {
+        if (!isScalarAttribute(attribute) && fp.isEmpty(value)) {
+          throwInvalidParam({ key });
+        }
+      }, ctx)
+    );
+    const createValidateFields = (ctx) => utils$1.pipeAsync(
+      utils$1.traverse.traverseQueryFields(throwDisallowedFields(permittedFields), ctx),
+      utils$1.traverse.traverseQueryFields(throwPassword, ctx)
     );
-    const validateFields = utils$1.pipeAsync(
-      utils$1.traverse.traverseQueryFields(throwDisallowedFields(permittedFields), { schema }),
-      utils$1.traverse.traverseQueryFields(throwPassword, { schema })
+    const validateFilters = createValidateFilters({ schema });
+    const validateSort = createValidateSort({ schema });
+    const validateFields = createValidateFields({ schema });
+    const validateNestedPopulate = async ({ key, value, schema: schema2, attribute }) => {
+      if (attribute) {
+        return;
+      }
+      const nestedCtx = { schema: schema2 };
+      if (key === "sort") {
+        await createValidateSort(nestedCtx)(value);
+      }
+      if (key === "filters") {
+        await createValidateFilters(nestedCtx)(value);
+      }
+      if (key === "fields") {
+        await createValidateFields(nestedCtx)(value);
+      }
+    };
+    const validatePopulate = utils$1.pipeAsync(
+      utils$1.traverse.traverseQueryPopulate(throwDisallowedFields(permittedFields), { schema }),
+      utils$1.traverse.traverseQueryPopulate(throwDisallowedAdminUserFields, { schema }),
+      utils$1.traverse.traverseQueryPopulate(throwPassword, { schema }),
+      utils$1.traverse.traverseQueryPopulate(validateNestedPopulate, { schema })
     );
     return async (query) => {
       if (query.filters) {
@@ -2783,6 +2808,9 @@ const createValidateHelpers = ({ action: action2, ability: ability$1, model }) =
       if (query.fields) {
         await validateFields(query.fields);
       }
+      if (query.populate) {
+        await validatePopulate(query.populate);
+      }
       return true;
     };
   };
@@ -3346,8 +3374,7 @@ const getNestedFields = (model, {
   return ___default.default.reduce(
     model.attributes,
     (fields, attr, key) => {
-      if (nonAuthorizableFields.includes(key))
-        return fields;
+      if (nonAuthorizableFields.includes(key)) return fields;
       const fieldPath = prefix ? `${prefix}.${key}` : key;
       const shouldBeIncluded = !requiredOnly || attr.required === true;
       const insideExistingFields = existingFields && existingFields.some(fp.startsWith(fieldPath));
@@ -3383,8 +3410,7 @@ const getNestedFieldsWithIntermediate = (model, { prefix = "", nestingLevel = 15
   return ___default.default.reduce(
     model.attributes,
     (fields, attr, key) => {
-      if (nonAuthorizableFields.includes(key))
-        return fields;
+      if (nonAuthorizableFields.includes(key)) return fields;
       const fieldPath = prefix ? `${prefix}.${key}` : key;
       fields.push(fieldPath);
       if (attr.type === "component") {
@@ -3756,8 +3782,7 @@ const list = async () => {
     populate: POPULATE_FIELDS,
     orderBy: { name: "ASC" }
   });
-  if (!tokens)
-    return tokens;
+  if (!tokens) return tokens;
   return tokens.map((token2) => flattenTokenPermissions(token2));
 };
 const generateRandomAccessKey = () => crypto__default.default.randomBytes(128).toString("hex");
@@ -4043,7 +4068,7 @@ const getProjectSettings = async () => {
     if (!projectSettings2[inputName]) {
       return;
     }
-    projectSettings2[inputName] = _$1.pick(projectSettings2[inputName], [
+    projectSettings2[inputName] = _$2.pick(projectSettings2[inputName], [
       "name",
       "url",
       "width",
@@ -4081,7 +4106,7 @@ const deleteOldFiles = async ({ previousSettings, newSettings }) => {
 const updateProjectSettings$1 = async (newSettings) => {
   const store = strapi.store({ type: "core", name: "admin" });
   const previousSettings = await store.get({ key: "project-settings" });
-  const files = _$1.pick(newSettings, PROJECT_SETTINGS_FILE_INPUTS);
+  const files = _$2.pick(newSettings, PROJECT_SETTINGS_FILE_INPUTS);
   await uploadFiles(files);
   PROJECT_SETTINGS_FILE_INPUTS.forEach((inputName) => {
     if (newSettings[inputName] !== void 0 && !(typeof newSettings[inputName] === "object")) {
@@ -4092,7 +4117,7 @@ const updateProjectSettings$1 = async (newSettings) => {
       newSettings[inputName] = previousSettings[inputName];
       return;
     }
-    newSettings[inputName] = _$1.pick(newSettings[inputName], [
+    newSettings[inputName] = _$2.pick(newSettings[inputName], [
       "name",
       "hash",
       "url",
@@ -4376,6 +4401,12 @@ const apiToken$1 = {
     ctx.send({ data: layout });
   }
 };
+function mergeValidatedBody(input, validatedPayload) {
+  if (validatedPayload !== null && typeof validatedPayload === "object" && !Array.isArray(validatedPayload)) {
+    return { ...input, ...validatedPayload };
+  }
+  return { ...input };
+}
 const userCreationSchema = utils$1.yup.object().shape({
   email: validators.email.required(),
   firstname: validators.firstname.required(),
@@ -4408,9 +4439,33 @@ const usersDeleteSchema = utils$1.yup.object().shape({
   ids: utils$1.yup.array().of(utils$1.yup.strapiID()).min(1).required()
 }).noUnknown();
 const validateUserCreationInput = utils$1.validateYupSchema(userCreationSchema);
-const validateProfileUpdateInput = utils$1.validateYupSchema(profileUpdateSchema);
-const validateUserUpdateInput = utils$1.validateYupSchema(userUpdateSchema);
+const normalizeUpdateInput = (input) => {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    return input;
+  }
+  const data = { ...input };
+  if (typeof data.email === "string") {
+    data.email = data.email.toLowerCase();
+  }
+  if (typeof data.firstname === "string") {
+    data.firstname = data.firstname.trim();
+  }
+  return data;
+};
+const runProfileUpdateValidation = utils$1.validateYupSchema(profileUpdateSchema);
+const runUserUpdateValidation = utils$1.validateYupSchema(userUpdateSchema);
+const validateProfileUpdateInput = async (input) => {
+  const data = normalizeUpdateInput(input);
+  const validated = await runProfileUpdateValidation(data);
+  return mergeValidatedBody(data, validated);
+};
+const validateUserUpdateInput = async (input) => {
+  const data = normalizeUpdateInput(input);
+  const validated = await runUserUpdateValidation(data);
+  return mergeValidatedBody(data, validated);
+};
 const validateUsersDeleteInput = utils$1.validateYupSchema(usersDeleteSchema);
+const _$1 = require("lodash");
 const authenticatedUser = {
   async getMe(ctx) {
     const userInfo = getService("user").sanitizeUser(ctx.state.user);
@@ -4420,10 +4475,10 @@ const authenticatedUser = {
   },
   async updateMe(ctx) {
     const input = ctx.request.body;
-    await validateProfileUpdateInput(input);
+    const data = await validateProfileUpdateInput(input);
     const userService = getService("user");
     const authServer = getService("auth");
-    const { currentPassword, ...userInfo } = input;
+    const { currentPassword, ...userInfo } = data;
     if (currentPassword && userInfo.password) {
       const isValid = await authServer.validatePassword(currentPassword, ctx.state.user.password);
       if (!isValid) {
@@ -4432,6 +4487,17 @@ const authenticatedUser = {
         });
       }
     }
+    if (_$1.has(userInfo, "email")) {
+      const uniqueEmailCheck = await userService.exists({
+        id: { $ne: ctx.state.user.id },
+        email: userInfo.email
+      });
+      if (uniqueEmailCheck) {
+        return ctx.badRequest("ValidationError", {
+          email: ["Email already taken"]
+        });
+      }
+    }
     const updatedUser = await userService.updateById(ctx.state.user.id, userInfo);
     ctx.body = {
       data: userService.sanitizeUser(updatedUser)
@@ -4978,17 +5044,17 @@ const user = {
   async update(ctx) {
     const { id } = ctx.params;
     const { body: input } = ctx.request;
-    await validateUserUpdateInput(input);
-    if (_.has(input, "email")) {
+    const data = await validateUserUpdateInput(input);
+    if (_.has(data, "email")) {
       const uniqueEmailCheck = await getService("user").exists({
         id: { $ne: id },
-        email: input.email
+        email: data.email
       });
       if (uniqueEmailCheck) {
         throw new ApplicationError("A user with this email address already exists");
       }
     }
-    const updatedUser = await getService("user").updateById(id, input);
+    const updatedUser = await getService("user").updateById(id, data);
     if (!updatedUser) {
       return ctx.notFound("User does not exist");
     }