@strapi/admin 4.3.2 → 4.3.5

package/server/domain/condition/index.js

@@ -49,7 +49,7 @@ const sanitizeConditionAttributes = pick(conditionFields);
  * @param condition
  * @return {string}
  */
-const computeConditionId = condition => {
+const computeConditionId = (condition) => {
   const { name, plugin } = condition;
 
   if (!plugin) {
@@ -68,7 +68,7 @@ const computeConditionId = condition => {
  * @param {CreateConditionPayload} attrs - Payload used to create a condition
  * @return {CreateConditionPayload}
  */
-const assignConditionId = attrs => set('id', computeConditionId(attrs), attrs);
+const assignConditionId = (attrs) => set('id', computeConditionId(attrs), attrs);
 
 /**
  * Transform the given attributes into a domain representation of a Condition

package/server/domain/condition/provider.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { providerFactory } = require('@strapi/utils');
-const domain = require('./');
+const domain = require('.');
 
 /**
  * @typedef ConditionProviderOverride

package/server/domain/permission/index.js

@@ -98,7 +98,7 @@ const deleteProperty = (property, permission) => omit(`properties.${property}`,
  * @param {Permission} attributes
  * @return {Permission}
  */
-const create = attributes => {
+const create = (attributes) => {
   return pipe(pick(permissionFields), merge(getDefaultPermission()))(attributes);
 };
 
@@ -114,7 +114,7 @@ const sanitizeConditions = curry((provider, permission) => {
   }
 
   return permission.conditions
-    .filter(condition => !provider.has(condition))
+    .filter((condition) => !provider.has(condition))
     .reduce((perm, condition) => removeCondition(condition, perm), permission);
 });
 
@@ -123,7 +123,7 @@ const sanitizeConditions = curry((provider, permission) => {
  * @param {object | object[]} payload - Can either be a single object of attributes or an array of those objects.
  * @return {Permission | Permission[]}
  */
-const toPermission = payload => (isArray(payload) ? map(create, payload) : create(payload));
+const toPermission = (payload) => (isArray(payload) ? map(create, payload) : create(payload));
 
 module.exports = {
   addCondition,

package/server/domain/user.js

@@ -15,8 +15,8 @@ function createUser(attributes) {
   };
 }
 
-const hasSuperAdminRole = user => {
-  return user.roles.filter(role => role.code === SUPER_ADMIN_CODE).length > 0;
+const hasSuperAdminRole = (user) => {
+  return user.roles.filter((role) => role.code === SUPER_ADMIN_CODE).length > 0;
 };
 
 module.exports = {

package/server/policies/hasPermissions.js

@@ -7,16 +7,16 @@ const { validateHasPermissionsInput } = require('../validation/policies/hasPermi
 const inputModifiers = [
   {
     check: _.isString,
-    transform: action => ({ action }),
+    transform: (action) => ({ action }),
   },
   {
     check: _.isArray,
-    transform: arr => ({ action: arr[0], subject: arr[1] }),
+    transform: (arr) => ({ action: arr[0], subject: arr[1] }),
   },
   {
     // Has to be after the isArray check since _.isObject also matches arrays
     check: _.isObject,
-    transform: perm => perm,
+    transform: (perm) => perm,
   },
 ];
 
@@ -27,8 +27,8 @@ module.exports = createPolicy({
     const { actions } = config;
     const { userAbility: ability } = ctx.state;
 
-    const permissions = actions.map(action =>
-      inputModifiers.find(modifier => modifier.check(action)).transform(action)
+    const permissions = actions.map((action) =>
+      inputModifiers.find((modifier) => modifier.check(action)).transform(action)
     );
 
     const isAuthorized = permissions.every(({ action, subject }) => ability.can(action, subject));

package/server/policies/isAuthenticatedAdmin.js

@@ -1,5 +1,5 @@
 'use strict';
 
-module.exports = policyCtx => {
+module.exports = (policyCtx) => {
   return Boolean(policyCtx.state.isAuthenticated);
 };

package/server/routes/serve-admin-panel.js

@@ -23,7 +23,7 @@ const registerAdminPanelRoute = ({ strapi }) => {
     }
 
     ctx.type = 'html';
-    ctx.body = fse.createReadStream(join(buildDir + '/index.html'));
+    ctx.body = fse.createReadStream(join(buildDir, 'index.html'));
   };
 
   strapi.server.routes([

package/server/routes/webhooks.js

@@ -72,7 +72,10 @@ module.exports = [
     path: '/webhooks/:id/trigger',
     handler: 'webhooks.triggerWebhook',
     config: {
-      policies: [],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        { name: 'admin::hasPermissions', config: { actions: ['admin::webhooks.update'] } },
+      ],
     },
   },
 ];

package/server/services/action.js

@@ -12,7 +12,7 @@ const { AUTHOR_CODE, PUBLISH_ACTION } = require('./constants');
  * @param {string|number} roleId
  * @returns {object[]}
  */
-const getAllowedActionsForRole = async roleId => {
+const getAllowedActionsForRole = async (roleId) => {
   const { actionProvider } = getService('permission');
 
   if (!isNil(roleId)) {

package/server/services/api-token.js

@@ -39,7 +39,7 @@ const exists = async (whereParams = {}) => {
  *
  * @returns {string}
  */
-const hash = accessKey => {
+const hash = (accessKey) => {
   return crypto
     .createHmac('sha512', strapi.config.get('admin.apiToken.salt'))
     .update(accessKey)
@@ -54,7 +54,7 @@ const hash = accessKey => {
  *
  * @returns {Promise<ApiToken>}
  */
-const create = async attributes => {
+const create = async (attributes) => {
   const accessKey = crypto.randomBytes(128).toString('hex');
 
   const apiToken = await strapi.query('admin::api-token').create({
@@ -106,7 +106,7 @@ const list = async () => {
  *
  * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
  */
-const revoke = async id => {
+const revoke = async (id) => {
   return strapi.query('admin::api-token').delete({ select: SELECT_FIELDS, where: { id } });
 };
 
@@ -115,7 +115,7 @@ const revoke = async id => {
  *
  * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
  */
-const getById = async id => {
+const getById = async (id) => {
   return getBy({ id });
 };
 
@@ -124,7 +124,7 @@ const getById = async id => {
  *
  * @returns {Promise<Omit<ApiToken, 'accessKey'>>}
  */
-const getByName = async name => {
+const getByName = async (name) => {
   return getBy({ name });
 };
 

package/server/services/auth.js

@@ -11,7 +11,7 @@ const { getService } = require('../utils');
  * @param {string} password - password to hash
  * @returns {string} hashed password
  */
-const hashPassword = password => bcrypt.hash(password, 10);
+const hashPassword = (password) => bcrypt.hash(password, 10);
 
 /**
  * Validate a password
@@ -81,7 +81,7 @@ const forgotPassword = async ({ email } = {}) => {
         user: _.pick(user, ['email', 'firstname', 'lastname', 'username']),
       }
     )
-    .catch(err => {
+    .catch((err) => {
       // log error server side but do not disclose it to the user to avoid leaking informations
       strapi.log.error(err);
     });

package/server/services/condition.js

@@ -3,7 +3,7 @@
 const { isString } = require('lodash/fp');
 const { getService } = require('../utils');
 
-const isValidCondition = condition => {
+const isValidCondition = (condition) => {
   const { conditionProvider } = getService('permission');
 
   return isString(condition) && conditionProvider.has(condition);

package/server/services/content-type.js

@@ -124,7 +124,9 @@ const getPermissionsWithNestedFields = (
   { nestingLevel, restrictedSubjects = [] } = {}
 ) => {
   return actions.reduce((permissions, action) => {
-    const validSubjects = action.subjects.filter(subject => !restrictedSubjects.includes(subject));
+    const validSubjects = action.subjects.filter(
+      (subject) => !restrictedSubjects.includes(subject)
+    );
 
     // Create a Permission for each subject (content-type uid) within the action
     for (const subject of validSubjects) {
@@ -158,7 +160,7 @@ const getPermissionsWithNestedFields = (
 const cleanPermissionFields = (permissions, { nestingLevel } = {}) => {
   const { actionProvider } = getService('permission');
 
-  return permissions.map(permission => {
+  return permissions.map((permission) => {
     const {
       action: actionId,
       subject,
@@ -191,7 +193,7 @@ const cleanPermissionFields = (permissions, { nestingLevel } = {}) => {
     const badNestedFields = uniq([...intersection(fields, possibleFields), ...requiredFields]);
 
     const newFields = badNestedFields.filter(
-      field => !badNestedFields.some(startsWith(`${field}.`))
+      (field) => !badNestedFields.some(startsWith(`${field}.`))
     );
 
     return permissionDomain.setProperty('fields', newFields, permission);

package/server/services/passport/local-strategy.js

@@ -3,7 +3,7 @@
 const { toLower } = require('lodash/fp');
 const { Strategy: LocalStrategy } = require('passport-local');
 
-const createLocalStrategy = strapi => {
+const createLocalStrategy = (strapi) => {
   return new LocalStrategy(
     {
       usernameField: 'email',
@@ -14,7 +14,7 @@ const createLocalStrategy = strapi => {
       return strapi.admin.services.auth
         .checkCredentials({ email: toLower(email), password })
         .then(([error, user, message]) => done(error, user, message))
-        .catch(error => done(error));
+        .catch((error) => done(error));
     }
   );
 };

package/server/services/passport.js

@@ -21,9 +21,7 @@ const registerAuthEvents = () => {
   const { events = {} } = strapi.config.get('admin.auth', {});
   const { authEventsMapper } = strapi.admin.services.passport;
 
-  const eventList = Object.entries(events)
-    .filter(keyIsValidEventName)
-    .filter(valueIsFunctionType);
+  const eventList = Object.entries(events).filter(keyIsValidEventName).filter(valueIsFunctionType);
 
   for (const [eventName, handler] of eventList) {
     strapi.eventHub.on(authEventsMapper[eventName], handler);
@@ -33,7 +31,7 @@ const registerAuthEvents = () => {
 const init = () => {
   strapi.admin.services.passport
     .getPassportStrategies()
-    .forEach(strategy => passport.use(strategy));
+    .forEach((strategy) => passport.use(strategy));
 
   registerAuthEvents();
 

package/server/services/permission/engine-hooks.js

@@ -18,7 +18,7 @@ const createEngineHooks = () => ({
  * @param {Permission} permission
  * @return {{readonly permission: Permission, addCondition(string): this}}
  */
-const createWillEvaluateContext = permission => ({
+const createWillEvaluateContext = (permission) => ({
   get permission() {
     return cloneDeep(permission);
   },

package/server/services/permission/engine.js

@@ -43,11 +43,11 @@ const allowedOperations = [
 ];
 const operations = pick(allowedOperations, sift);
 
-const conditionsMatcher = conditions => {
+const conditionsMatcher = (conditions) => {
   return sift.createQueryTester(conditions, { operations });
 };
 
-module.exports = conditionProvider => {
+module.exports = (conditionProvider) => {
   const state = {
     hooks: createEngineHooks(),
   };
@@ -112,7 +112,7 @@ module.exports = conditionProvider => {
       );
 
       const permissionWithSanitizedProperties = invalidProperties.reduce(
-        property => permissionDomain.deleteProperty(property, permission),
+        (property) => permissionDomain.deleteProperty(property, permission),
         permission
       );
 
@@ -174,13 +174,13 @@ module.exports = conditionProvider => {
       const resolveConditions = map(conditionProvider.get);
 
       // 2. Filter conditions, only keep those whose handler is a function
-      const filterValidConditions = filter(condition => isFunction(condition.handler));
+      const filterValidConditions = filter((condition) => isFunction(condition.handler));
 
       // 3. Evaluate the conditions handler and returns an object
       // containing both the original condition and its result
-      const evaluateConditions = conditions => {
+      const evaluateConditions = (conditions) => {
         return Promise.all(
-          conditions.map(async condition => ({
+          conditions.map(async (condition) => ({
             condition,
             result: await condition.handler(
               user,
@@ -237,7 +237,7 @@ module.exports = conditionProvider => {
      * @returns {function}
      */
     createRegisterFunction(can, permission, user) {
-      const registerToCasl = caslPermission => {
+      const registerToCasl = (caslPermission) => {
         const { action, subject, fields, condition } = caslPermission;
 
         can(
@@ -248,7 +248,7 @@ module.exports = conditionProvider => {
         );
       };
 
-      const runWillRegisterHook = async caslPermission => {
+      const runWillRegisterHook = async (caslPermission) => {
         const hookContext = createWillRegisterContext(caslPermission, {
           permission,
           user,
@@ -259,7 +259,7 @@ module.exports = conditionProvider => {
         return caslPermission;
       };
 
-      return async caslPermission => {
+      return async (caslPermission) => {
         await runWillRegisterHook(caslPermission);
         registerToCasl(caslPermission);
       };

package/server/services/permission/permissions-manager/query-builers.js

@@ -19,7 +19,7 @@ const operatorsMap = {
   $not: '$not',
 };
 
-const mapKey = key => {
+const mapKey = (key) => {
   if (_.isString(key) && key.startsWith('$') && key in operatorsMap) {
     return operatorsMap[key];
   }
@@ -27,19 +27,19 @@ const mapKey = key => {
 };
 
 const buildCaslQuery = (ability, action, model) => {
-  return rulesToQuery(ability, action, model, o => o.conditions);
+  return rulesToQuery(ability, action, model, (o) => o.conditions);
 };
 
-const buildStrapiQuery = caslQuery => {
+const buildStrapiQuery = (caslQuery) => {
   return unwrapDeep(caslQuery);
 };
 
-const unwrapDeep = obj => {
+const unwrapDeep = (obj) => {
   if (!_.isPlainObject(obj) && !_.isArray(obj)) {
     return obj;
   }
   if (_.isArray(obj)) {
-    return obj.map(v => unwrapDeep(v));
+    return obj.map((v) => unwrapDeep(v));
   }
 
   return _.reduce(

package/server/services/permission/permissions-manager/sanitize.js

@@ -19,12 +19,8 @@ const {
 
 const { contentTypes, traverseEntity, sanitize, pipeAsync } = require('@strapi/utils');
 
-const {
-  constants,
-  getNonVisibleAttributes,
-  getNonWritableAttributes,
-  getWritableAttributes,
-} = contentTypes;
+const { constants, getNonVisibleAttributes, getNonWritableAttributes, getWritableAttributes } =
+  contentTypes;
 const {
   ID_ATTRIBUTE,
   CREATED_AT_ATTRIBUTE,
@@ -73,20 +69,20 @@ module.exports = ({ action, ability, model }) => {
     );
   };
 
-  const wrapSanitize = createSanitizeFunction => {
+  const wrapSanitize = (createSanitizeFunction) => {
     const wrappedSanitize = async (data, options = {}) => {
       if (isArray(data)) {
-        return Promise.all(data.map(entity => wrappedSanitize(entity, options)));
+        return Promise.all(data.map((entity) => wrappedSanitize(entity, options)));
       }
 
       const { subject, action: actionOverride } = getDefaultOptions(data, options);
 
       const permittedFields = permittedFieldsOf(ability, actionOverride, subject, {
-        fieldsFrom: rule => rule.fields || [],
+        fieldsFrom: (rule) => rule.fields || [],
       });
 
       const hasAtLeastOneRegistered = some(
-        fields => !isNil(fields),
+        (fields) => !isNil(fields),
         flatMap(prop('fields'), ability.rulesFor(actionOverride, detectSubjectType(subject)))
       );
       const shouldIncludeAllFields = isEmpty(permittedFields) && !hasAtLeastOneRegistered;

package/server/services/permission/queries.js

@@ -25,7 +25,7 @@ const permissionDomain = require('../../domain/permission/index');
  * @param rolesIds ids of roles
  * @returns {Promise<array>}
  */
-const deleteByRolesIds = async rolesIds => {
+const deleteByRolesIds = async (rolesIds) => {
   const permissionsToDelete = await strapi.query('admin::permission').findMany({
     select: ['id'],
     where: {
@@ -43,7 +43,7 @@ const deleteByRolesIds = async rolesIds => {
  * @param ids ids of permissions
  * @returns {Promise<array>}
  */
-const deleteByIds = async ids => {
+const deleteByIds = async (ids) => {
   for (const id of ids) {
     await strapi.query('admin::permission').delete({ where: { id } });
   }
@@ -54,7 +54,7 @@ const deleteByIds = async ids => {
  * @param permissions
  * @returns {Promise<*[]|*>}
  */
-const createMany = async permissions => {
+const createMany = async (permissions) => {
   const createdPermissions = [];
   for (const permission of permissions) {
     const newPerm = await strapi.query('admin::permission').create({ data: permission });
@@ -94,11 +94,11 @@ const findMany = async (params = {}) => {
  * @param user - user
  * @returns {Promise<Permission[]>}
  */
-const findUserPermissions = async user => {
+const findUserPermissions = async (user) => {
   return findMany({ where: { role: { users: { id: user.id } } } });
 };
 
-const filterPermissionsToRemove = async permissions => {
+const filterPermissionsToRemove = async (permissions) => {
   const { actionProvider } = getService('permission');
 
   const permissionsToRemove = [];
@@ -108,7 +108,7 @@ const filterPermissionsToRemove = async permissions => {
     const { applyToProperties } = options;
 
     const invalidProperties = await Promise.all(
-      (applyToProperties || []).map(async property => {
+      (applyToProperties || []).map(async (property) => {
         const applies = await actionProvider.appliesToProperty(
           property,
           permission.action,
@@ -156,12 +156,11 @@ const cleanPermissionsInDatabase = async () => {
 
     // 2. Clean permissions' fields (add required ones, remove the non-existing ones)
     const remainingPermissions = permissions.filter(
-      permission => !permissionsIdToRemove.includes(permission.id)
+      (permission) => !permissionsIdToRemove.includes(permission.id)
     );
 
-    const permissionsWithCleanFields = contentTypeService.cleanPermissionFields(
-      remainingPermissions
-    );
+    const permissionsWithCleanFields =
+      contentTypeService.cleanPermissionFields(remainingPermissions);
 
     // Update only the ones that need to be updated
     const permissionsNeedingToBeUpdated = differenceWith(
@@ -172,7 +171,7 @@ const cleanPermissionsInDatabase = async () => {
       remainingPermissions
     );
 
-    const updatePromiseProvider = permission => {
+    const updatePromiseProvider = (permission) => {
       return update({ id: permission.id }, permission);
     };
 
@@ -228,11 +227,11 @@ const ensureBoundPermissionsInDatabase = async () => {
     if (missingActions.length > 0) {
       const permissions = pipe(
         // Create a permission skeleton from the action id
-        map(action => ({ action, subject: contentType.uid, role: editorRole.id })),
+        map((action) => ({ action, subject: contentType.uid, role: editorRole.id })),
         // Use the permission domain to create a clean permission from the given object
         map(permissionDomain.create),
         // Adds the fields property if the permission action is eligible
-        map(permission =>
+        map((permission) =>
           BOUND_ACTIONS_FOR_FIELDS.includes(permission.action)
             ? permissionDomain.setProperty('fields', fields, permission)
             : permission

package/server/services/permission/sections-builder/handlers.js

@@ -78,21 +78,23 @@ const contentTypesBase = ({ action, section }) => {
 /**
  * Initialize the subjects array of a section based on the action's subjects
  */
-const subjectsHandlerFor = kind => ({ action, section: contentTypesSection }) => {
-  const { subjects } = action;
-
-  const newSubjects = subjects
-    // Ignore already added subjects
-    .filter(isNotInSubjects(contentTypesSection.subjects))
-    // Transform UIDs into content-types
-    .map(resolveContentType)
-    // Only keep specific kind of content-types
-    .filter(isOfKind(kind))
-    // Transform the content-types into section's subjects
-    .map(toSubjectTemplate);
-
-  contentTypesSection.subjects.push(...newSubjects);
-};
+const subjectsHandlerFor =
+  (kind) =>
+  ({ action, section: contentTypesSection }) => {
+    const { subjects } = action;
+
+    const newSubjects = subjects
+      // Ignore already added subjects
+      .filter(isNotInSubjects(contentTypesSection.subjects))
+      // Transform UIDs into content-types
+      .map(resolveContentType)
+      // Only keep specific kind of content-types
+      .filter(isOfKind(kind))
+      // Transform the content-types into section's subjects
+      .map(toSubjectTemplate);
+
+    contentTypesSection.subjects.push(...newSubjects);
+  };
 
 const buildNode = (model, attributeName, attribute) => {
   if (!isVisibleAttribute(model, attributeName)) {
@@ -113,10 +115,10 @@ const buildNode = (model, attributeName, attribute) => {
   return node;
 };
 
-const buildDeepAttributesCollection = model => {
+const buildDeepAttributesCollection = (model) => {
   return Object.entries(model.attributes)
     .map(([attributeName, attribute]) => buildNode(model, attributeName, attribute))
-    .filter(node => node !== null);
+    .filter((node) => node !== null);
 };
 
 /**
@@ -129,8 +131,8 @@ const fieldsProperty = ({ action, section }) => {
   const { subjects } = action;
 
   section.subjects
-    .filter(subject => subjects.includes(subject.uid))
-    .forEach(subject => {
+    .filter((subject) => subjects.includes(subject.uid))
+    .forEach((subject) => {
       const { uid } = subject;
       const contentType = resolveContentType(uid);
 

package/server/services/permission/sections-builder/section.js

@@ -29,8 +29,8 @@ const createSection = ({
   };
 
   // Register initial hooks
-  handlers.forEach(handler => state.hooks.handlers.register(handler));
-  matchers.forEach(matcher => state.hooks.matchers.register(matcher));
+  handlers.forEach((handler) => state.hooks.handlers.register(handler));
+  matchers.forEach((matcher) => state.hooks.matchers.register(matcher));
 
   return {
     hooks: state.hooks,

package/server/services/permission/sections-builder/utils.js

@@ -2,19 +2,19 @@
 
 const { curry, matchesProperty, pick } = require('lodash/fp');
 
-const isOfKind = kind => matchesProperty('kind', kind);
+const isOfKind = (kind) => matchesProperty('kind', kind);
 
-const resolveContentType = uid => strapi.contentTypes[uid];
+const resolveContentType = (uid) => strapi.contentTypes[uid];
 
-const isNotInSubjects = subjects => uid => !subjects.find(subject => subject.uid === uid);
+const isNotInSubjects = (subjects) => (uid) => !subjects.find((subject) => subject.uid === uid);
 
 const hasProperty = curry((property, subject) => {
-  return !!subject.properties.find(prop => prop.value === property);
+  return !!subject.properties.find((prop) => prop.value === property);
 });
 
 const getValidOptions = pick(['applyToProperties']);
 
-const toSubjectTemplate = ct => ({ uid: ct.uid, label: ct.info.singularName, properties: [] });
+const toSubjectTemplate = (ct) => ({ uid: ct.uid, label: ct.info.singularName, properties: [] });
 
 module.exports = {
   isOfKind,