@strapi/admin 4.9.0-alpha.0 → 4.9.0-beta.1

package/ee/server/controllers/user.js

@@ -1,17 +1,41 @@
 'use strict';
 
-const { get } = require('lodash');
-const { pick } = require('lodash/fp');
-const { ApplicationError } = require('@strapi/utils').errors;
+// eslint-disable-next-line node/no-extraneous-require
+const ee = require('@strapi/strapi/lib/utils/ee');
+const _ = require('lodash');
+const { pick, isNil } = require('lodash/fp');
+const { ApplicationError, ForbiddenError } = require('@strapi/utils').errors;
 const { validateUserCreationInput } = require('../validation/user');
+const { validateUserUpdateInput } = require('../../../server/validation/user');
 const { getService } = require('../../../server/utils');
 
 const pickUserCreationAttributes = pick(['firstname', 'lastname', 'email', 'roles']);
 
+const hasAdminSeatsAvaialble = async () => {
+  if (!strapi.EE) {
+    return true;
+  }
+
+  const permittedSeats = ee.seats;
+  if (isNil(permittedSeats)) {
+    return true;
+  }
+
+  const userCount = await strapi.service('admin::user').getCurrentActiveUserCount();
+
+  if (userCount < permittedSeats) {
+    return true;
+  }
+};
+
 module.exports = {
   async create(ctx) {
+    if (!(await hasAdminSeatsAvaialble())) {
+      throw new ForbiddenError('License seat limit reached. You cannot create a new user');
+    }
+
     const { body } = ctx.request;
-    const cleanData = { ...body, email: get(body, `email`, ``).toLowerCase() };
+    const cleanData = { ...body, email: _.get(body, `email`, ``).toLowerCase() };
 
     await validateUserCreationInput(cleanData);
 
@@ -37,4 +61,38 @@ module.exports = {
 
     ctx.created({ data: userInfo });
   },
+
+  async update(ctx) {
+    const { id } = ctx.params;
+    const { body: input } = ctx.request;
+
+    await validateUserUpdateInput(input);
+
+    if (_.has(input, 'email')) {
+      const uniqueEmailCheck = await getService('user').exists({
+        id: { $ne: id },
+        email: input.email,
+      });
+
+      if (uniqueEmailCheck) {
+        throw new ApplicationError('A user with this email address already exists');
+      }
+    }
+
+    const user = await getService('user').findOne(id, null);
+
+    if (!(await hasAdminSeatsAvaialble()) && !user.isActive && input.isActive) {
+      throw new ForbiddenError('License seat limit reached. You cannot active this user');
+    }
+
+    const updatedUser = await getService('user').updateById(id, input);
+
+    if (!updatedUser) {
+      return ctx.notFound('User does not exist');
+    }
+
+    ctx.body = {
+      data: getService('user').sanitizeUser(updatedUser),
+    };
+  },
 };

package/ee/server/index.js

@@ -2,7 +2,6 @@
 
 module.exports = {
   register: require('./register'),
-  contentTypes: require('./content-types'),
   bootstrap: require('./bootstrap'),
   destroy: require('./destroy'),
   routes: require('./routes'),

package/ee/server/routes/index.js

@@ -11,55 +11,6 @@ const enableFeatureMiddleware = (featureName) => (ctx, next) => {
 };
 
 module.exports = [
-  {
-    method: 'POST',
-    path: '/roles',
-    handler: 'role.create',
-    config: {
-      policies: [
-        'admin::isAuthenticatedAdmin',
-        {
-          name: 'admin::hasPermissions',
-          config: {
-            actions: ['admin::roles.create'],
-          },
-        },
-      ],
-    },
-  },
-  {
-    method: 'DELETE',
-    path: '/roles/:id',
-    handler: 'role.deleteOne',
-    config: {
-      policies: [
-        'admin::isAuthenticatedAdmin',
-        {
-          name: 'admin::hasPermissions',
-          config: {
-            actions: ['admin::roles.delete'],
-          },
-        },
-      ],
-    },
-  },
-  {
-    method: 'POST',
-    path: '/roles/batch-delete',
-    handler: 'role.deleteMany',
-    config: {
-      policies: [
-        'admin::isAuthenticatedAdmin',
-        {
-          name: 'admin::hasPermissions',
-          config: {
-            actions: ['admin::roles.delete'],
-          },
-        },
-      ],
-    },
-  },
-
   // SSO
   {
     method: 'GET',
@@ -149,87 +100,23 @@ module.exports = [
     },
   },
 
-  // Review workflow
-  {
-    method: 'GET',
-    path: '/review-workflows/workflows',
-    handler: 'workflows.find',
-    config: {
-      middlewares: [enableFeatureMiddleware('review-workflows')],
-      policies: [
-        'admin::isAuthenticatedAdmin',
-        {
-          name: 'admin::hasPermissions',
-          config: {
-            actions: ['admin::review-workflows.read'],
-          },
-        },
-      ],
-    },
-  },
-  {
-    method: 'GET',
-    path: '/review-workflows/workflows/:id',
-    handler: 'workflows.findById',
-    config: {
-      middlewares: [enableFeatureMiddleware('review-workflows')],
-      policies: [
-        'admin::isAuthenticatedAdmin',
-        {
-          name: 'admin::hasPermissions',
-          config: {
-            actions: ['admin::review-workflows.read'],
-          },
-        },
-      ],
-    },
-  },
-  {
-    method: 'GET',
-    path: '/review-workflows/workflows/:workflow_id/stages',
-    handler: 'stages.find',
-    config: {
-      middlewares: [enableFeatureMiddleware('review-workflows')],
-      policies: [
-        'admin::isAuthenticatedAdmin',
-        {
-          name: 'admin::hasPermissions',
-          config: {
-            actions: ['admin::review-workflows.read'],
-          },
-        },
-      ],
-    },
-  },
-  {
-    method: 'PUT',
-    path: '/review-workflows/workflows/:workflow_id/stages',
-    handler: 'stages.replace',
-    config: {
-      middlewares: [enableFeatureMiddleware('review-workflows')],
-      policies: [
-        'admin::isAuthenticatedAdmin',
-        {
-          name: 'admin::hasPermissions',
-          config: {
-            actions: ['admin::review-workflows.read'],
-          },
-        },
-      ],
-    },
-  },
+  // License limit infos
   {
     method: 'GET',
-    path: '/review-workflows/workflows/:workflow_id/stages/:id',
-    handler: 'stages.findById',
+    path: '/license-limit-information',
+    handler: 'admin.licenseLimitInformation',
     config: {
-      middlewares: [enableFeatureMiddleware('review-workflows')],
       policies: [
         'admin::isAuthenticatedAdmin',
         {
           name: 'admin::hasPermissions',
           config: {
-            actions: ['admin::review-workflows.read'],
+            actions: [
+              'admin::users.create',
+              'admin::users.read',
+              'admin::users.update',
+              'admin::users.delete',
+            ],
           },
         },
       ],

package/ee/server/services/audit-logs.js

@@ -37,11 +37,21 @@ const defaultEvents = [
   'permission.delete',
 ];
 
-const getSanitizedUser = (user) => ({
-  id: user.id,
-  email: user.email,
-  fullname: `${user.firstname} ${user.lastname}`,
-});
+const getSanitizedUser = (user) => {
+  let displayName = user.email;
+
+  if (user.username) {
+    displayName = user.username;
+  } else if (user.firstname && user.lastname) {
+    displayName = `${user.firstname} ${user.lastname}`;
+  }
+
+  return {
+    id: user.id,
+    email: user.email,
+    displayName,
+  };
+};
 
 const getEventMap = (defaultEvents) => {
   const getDefaultPayload = (...args) => args[0];

package/ee/server/services/index.js

@@ -3,7 +3,6 @@
 module.exports = {
   passport: require('./passport'),
   role: require('./role'),
-  workflows: require('./review-workflows/workflows'),
-  stages: require('./review-workflows/stages'),
-  'review-workflows': require('./review-workflows/review-workflows'),
+  user: require('./user'),
+  'seat-enforcement': require('./seat-enforcement'),
 };

package/ee/server/services/seat-enforcement.js

@@ -0,0 +1,114 @@
+'use strict';
+
+// eslint-disable-next-line node/no-extraneous-require
+const ee = require('@strapi/strapi/lib/utils/ee');
+const { take, drop, map, prop, pick, reverse, isNil } = require('lodash/fp');
+const { getService } = require('../../../server/utils');
+const { SUPER_ADMIN_CODE } = require('../../../server/services/constants');
+
+/**
+ * Keeps the list of users disabled by the seat enforcement service
+ */
+const getDisabledUserList = async () => {
+  return strapi.store.get({ type: 'ee', key: 'disabled_users' });
+};
+
+const enableMaximumUserCount = async (numberOfUsersToEnable) => {
+  const disabledUsers = await getDisabledUserList();
+  const orderedDisabledUsers = reverse(disabledUsers);
+
+  const usersToEnable = take(numberOfUsersToEnable, orderedDisabledUsers);
+
+  await strapi.db.query('admin::user').updateMany({
+    where: { id: map(prop('id'), usersToEnable) },
+    data: { isActive: true },
+  });
+
+  const remainingDisabledUsers = drop(numberOfUsersToEnable, orderedDisabledUsers);
+
+  await strapi.store.set({
+    type: 'ee',
+    key: 'disabled_users',
+    value: remainingDisabledUsers,
+  });
+};
+
+const disableUsersAboveLicenseLimit = async (numberOfUsersToDisable) => {
+  const currentlyDisabledUsers = (await getDisabledUserList()) ?? [];
+
+  const usersToDisable = [];
+  const nonSuperAdminUsersToDisable = await strapi.db.query('admin::user').findMany({
+    where: {
+      isActive: true,
+      roles: {
+        code: { $ne: SUPER_ADMIN_CODE },
+      },
+    },
+    orderBy: { createdAt: 'DESC' },
+    limit: numberOfUsersToDisable,
+  });
+
+  usersToDisable.push(...nonSuperAdminUsersToDisable);
+
+  if (nonSuperAdminUsersToDisable.length < numberOfUsersToDisable) {
+    const superAdminUsersToDisable = await strapi.db.query('admin::user').findMany({
+      where: {
+        isActive: true,
+        roles: { code: SUPER_ADMIN_CODE },
+      },
+      orderBy: { createdAt: 'DESC' },
+      limit: numberOfUsersToDisable - nonSuperAdminUsersToDisable.length,
+    });
+
+    usersToDisable.push(...superAdminUsersToDisable);
+  }
+
+  await strapi.db.query('admin::user').updateMany({
+    where: { id: map(prop('id'), usersToDisable) },
+    data: { isActive: false },
+  });
+
+  await strapi.store.set({
+    type: 'ee',
+    key: 'disabled_users',
+    value: currentlyDisabledUsers.concat(map(pick(['id', 'isActive']), usersToDisable)),
+  });
+};
+
+const syncDisabledUserRecords = async () => {
+  const disabledUsers = await strapi.store.get({ type: 'ee', key: 'disabled_users' });
+
+  if (!disabledUsers) {
+    return;
+  }
+
+  await strapi.db.query('admin::user').updateMany({
+    where: { id: map(prop('id'), disabledUsers) },
+    data: { isActive: false },
+  });
+};
+
+const seatEnforcementWorkflow = async () => {
+  const adminSeats = ee.seats;
+  if (isNil(adminSeats)) {
+    return;
+  }
+
+  // TODO: we need to make sure an admin can decide to disable specific user and reactivate others
+  await syncDisabledUserRecords();
+
+  const currentActiveUserCount = await getService('user').getCurrentActiveUserCount();
+
+  const adminSeatsLeft = adminSeats - currentActiveUserCount;
+
+  if (adminSeatsLeft > 0) {
+    await enableMaximumUserCount(adminSeatsLeft);
+  } else if (adminSeatsLeft < 0) {
+    await disableUsersAboveLicenseLimit(-adminSeatsLeft);
+  }
+};
+
+module.exports = {
+  seatEnforcementWorkflow,
+  getDisabledUserList,
+};

package/ee/server/services/user.js

@@ -0,0 +1,234 @@
+'use strict';
+
+const _ = require('lodash');
+const { pipe, map, castArray, toNumber } = require('lodash/fp');
+const { stringIncludes } = require('@strapi/utils');
+const { ValidationError } = require('@strapi/utils').errors;
+const { hasSuperAdminRole } = require('../../../server/domain/user');
+const { getService } = require('../../../server/utils');
+const { SUPER_ADMIN_CODE } = require('../../../server/services/constants');
+
+/** Checks if ee disabled users list needs to be updated
+ * @param {string} id
+ * @param {object} input
+ */
+const updateEEDisabledUsersList = async (id, input) => {
+  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();
+
+  if (!disabledUsers) {
+    return;
+  }
+
+  const user = disabledUsers.find((user) => user.id === Number(id));
+  if (!user) {
+    return;
+  }
+
+  if (user.isActive !== input.isActive) {
+    const newDisabledUsersList = disabledUsers.filter((user) => user.id !== Number(id));
+    await strapi.store.set({
+      type: 'ee',
+      key: 'disabled_users',
+      value: newDisabledUsersList,
+    });
+  }
+};
+
+const castNumberArray = pipe(castArray, map(toNumber));
+
+const removeFromEEDisabledUsersList = async (ids) => {
+  let idsToCheck;
+  if (typeof ids === 'object') {
+    idsToCheck = castNumberArray(ids);
+  } else {
+    idsToCheck = [Number(ids)];
+  }
+
+  const disabledUsers = await getService('seat-enforcement').getDisabledUserList();
+
+  if (!disabledUsers) {
+    return;
+  }
+
+  const newDisabledUsersList = disabledUsers.filter((user) => !idsToCheck.includes(user.id));
+  await strapi.store.set({
+    type: 'ee',
+    key: 'disabled_users',
+    value: newDisabledUsersList,
+  });
+};
+
+/**
+ * Update a user in database
+ * @param id query params to find the user to update
+ * @param attributes A partial user object
+ * @returns {Promise<user>}
+ */
+const updateById = async (id, attributes) => {
+  // Check at least one super admin remains
+  if (_.has(attributes, 'roles')) {
+    const lastAdminUser = await isLastSuperAdminUser(id);
+    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();
+    const willRemoveSuperAdminRole = !stringIncludes(attributes.roles, superAdminRole.id);
+
+    if (lastAdminUser && willRemoveSuperAdminRole) {
+      throw new ValidationError('You must have at least one user with super admin role.');
+    }
+  }
+
+  // cannot disable last super admin
+  if (attributes.isActive === false) {
+    const lastAdminUser = await isLastSuperAdminUser(id);
+    if (lastAdminUser) {
+      throw new ValidationError('You must have at least one user with super admin role.');
+    }
+  }
+
+  // hash password if a new one is sent
+  if (_.has(attributes, 'password')) {
+    const hashedPassword = await getService('auth').hashPassword(attributes.password);
+
+    const updatedUser = await strapi.query('admin::user').update({
+      where: { id },
+      data: {
+        ...attributes,
+        password: hashedPassword,
+      },
+      populate: ['roles'],
+    });
+
+    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });
+
+    return updatedUser;
+  }
+
+  const updatedUser = await strapi.query('admin::user').update({
+    where: { id },
+    data: attributes,
+    populate: ['roles'],
+  });
+
+  await updateEEDisabledUsersList(id, attributes);
+
+  if (updatedUser) {
+    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });
+  }
+
+  return updatedUser;
+};
+
+/** Delete a user
+ * @param id id of the user to delete
+ * @returns {Promise<user>}
+ */
+const deleteById = async (id) => {
+  // Check at least one super admin remains
+  const userToDelete = await strapi.query('admin::user').findOne({
+    where: { id },
+    populate: ['roles'],
+  });
+
+  if (!userToDelete) {
+    return null;
+  }
+
+  if (userToDelete) {
+    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE)) {
+      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();
+      if (superAdminRole.usersCount === 1) {
+        throw new ValidationError('You must have at least one user with super admin role.');
+      }
+    }
+  }
+
+  const deletedUser = await strapi
+    .query('admin::user')
+    .delete({ where: { id }, populate: ['roles'] });
+
+  await removeFromEEDisabledUsersList(id);
+
+  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });
+
+  return deletedUser;
+};
+
+/** Delete a user
+ * @param ids ids of the users to delete
+ * @returns {Promise<user>}
+ */
+const deleteByIds = async (ids) => {
+  // Check at least one super admin remains
+  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();
+  const nbOfSuperAdminToDelete = await strapi.query('admin::user').count({
+    where: {
+      id: ids,
+      roles: { id: superAdminRole.id },
+    },
+  });
+
+  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {
+    throw new ValidationError('You must have at least one user with super admin role.');
+  }
+
+  const deletedUsers = [];
+  for (const id of ids) {
+    const deletedUser = await strapi.query('admin::user').delete({
+      where: { id },
+      populate: ['roles'],
+    });
+
+    deletedUsers.push(deletedUser);
+  }
+
+  await removeFromEEDisabledUsersList(ids);
+
+  strapi.eventHub.emit('user.delete', {
+    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),
+  });
+
+  return deletedUsers;
+};
+
+const sanitizeUserRoles = (role) => _.pick(role, ['id', 'name', 'description', 'code']);
+
+/**
+ * Check if a user is the last super admin
+ * @param {int|string} userId user's id to look for
+ */
+const isLastSuperAdminUser = async (userId) => {
+  const user = await findOne(userId);
+  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();
+
+  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);
+};
+
+/**
+ * Remove private user fields
+ * @param {Object} user - user to sanitize
+ */
+const sanitizeUser = (user) => {
+  return {
+    ..._.omit(user, ['password', 'resetPasswordToken', 'registrationToken', 'roles']),
+    roles: user.roles && user.roles.map(sanitizeUserRoles),
+  };
+};
+
+/**
+ * Find one user
+ */
+const findOne = async (id, populate = ['roles']) => {
+  return strapi.entityService.findOne('admin::user', id, { populate });
+};
+
+const getCurrentActiveUserCount = async () => {
+  return strapi.db.query('admin::user').count({ where: { isActive: true } });
+};
+
+module.exports = {
+  updateEEDisabledUsersList,
+  removeFromEEDisabledUsersList,
+  getCurrentActiveUserCount,
+  deleteByIds,
+  deleteById,
+  updateById,
+};

package/ee/server/utils/persisted-tables.js

@@ -0,0 +1,49 @@
+'use strict';
+
+/**
+ * Finds all tables in the database that start with a prefix
+ * @param {string} prefix
+ * @returns {Array}
+ */
+const findTablesThatStartWithPrefix = async (prefix) => {
+  const tables = await strapi.db.dialect.schemaInspector.getTables();
+  return tables.filter((tableName) => tableName.startsWith(prefix));
+};
+
+/**
+ * Get all reserved table names from the core store
+ * @returns {Array}
+ */
+const getPersistedTables = async () =>
+  (await strapi.store.get({
+    type: 'core',
+    key: 'persisted_tables',
+  })) ?? [];
+
+/**
+ * Add all table names that start with a prefix to the reserved tables in
+ * core store
+ * @param {string} tableNamePrefix
+ */
+
+const persistTablesWithPrefix = async (tableNamePrefix) => {
+  const persistedTables = await getPersistedTables();
+  const tableNames = await findTablesThatStartWithPrefix(tableNamePrefix);
+  const notReservedTableNames = tableNames.filter((name) => !persistedTables.includes(name));
+
+  if (!notReservedTableNames.length) {
+    return;
+  }
+
+  persistedTables.push(...notReservedTableNames);
+  await strapi.store.set({
+    type: 'core',
+    key: 'persisted_tables',
+    value: persistedTables,
+  });
+};
+
+module.exports = {
+  persistTablesWithPrefix,
+  findTablesThatStartWithPrefix,
+};