@strapi/admin 4.9.0-alpha.0 → 4.9.0-beta.2

package/server/controllers/transfer/token.js

@@ -0,0 +1,131 @@
+'use strict';
+
+const { trim, has } = require('lodash/fp');
+const {
+  errors: { ApplicationError },
+  stringEquals,
+} = require('@strapi/utils');
+
+const {
+  token: { validateTransferTokenCreationInput, validateTransferTokenUpdateInput },
+} = require('../../validation/transfer');
+const { getService } = require('../../utils');
+
+module.exports = {
+  async list(ctx) {
+    const transferService = getService('transfer');
+    const transferTokens = await transferService.token.list();
+
+    ctx.body = { data: transferTokens };
+  },
+
+  async getById(ctx) {
+    const { id } = ctx.params;
+    const tokenService = getService('transfer').token;
+
+    const transferToken = await tokenService.getById(id);
+
+    if (!transferToken) {
+      ctx.notFound('Transfer token not found');
+      return;
+    }
+
+    ctx.body = { data: transferToken };
+  },
+
+  async create(ctx) {
+    const { body } = ctx.request;
+    const { token: tokenService } = getService('transfer');
+
+    /**
+     * We trim fields to avoid having issues with either:
+     * - having a space at the end or start of the value
+     * - having only spaces as value (so that an empty field can be caught in validation)
+     */
+    const attributes = {
+      name: trim(body.name),
+      description: trim(body.description),
+      permissions: body.permissions,
+      lifespan: body.lifespan,
+    };
+
+    await validateTransferTokenCreationInput(attributes);
+
+    const alreadyExists = await tokenService.exists({ name: attributes.name });
+    if (alreadyExists) {
+      throw new ApplicationError('Name already taken');
+    }
+
+    const transferTokens = await tokenService.create(attributes);
+
+    ctx.created({ data: transferTokens });
+  },
+
+  async update(ctx) {
+    const { body } = ctx.request;
+    const { id } = ctx.params;
+    const { token: tokenService } = getService('transfer');
+
+    const attributes = body;
+    /**
+     * We trim fields to avoid having issues with either:
+     * - having a space at the end or start of the value
+     * - having only spaces as value (so that an empty field can be caught in validation)
+     */
+    if (has('name', attributes)) {
+      attributes.name = trim(body.name);
+    }
+
+    if (has('description', attributes) || attributes.description === null) {
+      attributes.description = trim(body.description);
+    }
+
+    await validateTransferTokenUpdateInput(attributes);
+
+    const apiTokenExists = await tokenService.getById(id);
+    if (!apiTokenExists) {
+      return ctx.notFound('Transfer token not found');
+    }
+
+    if (has('name', attributes)) {
+      const nameAlreadyTaken = await tokenService.getByName(attributes.name);
+
+      /**
+       * We cast the ids as string as the one coming from the ctx isn't cast
+       * as a Number in case it is supposed to be an integer. It remains
+       * as a string. This way we avoid issues with integers in the db.
+       */
+      if (!!nameAlreadyTaken && !stringEquals(nameAlreadyTaken.id, id)) {
+        throw new ApplicationError('Name already taken');
+      }
+    }
+
+    const apiToken = await tokenService.update(id, attributes);
+
+    ctx.body = { data: apiToken };
+  },
+
+  async revoke(ctx) {
+    const { id } = ctx.params;
+    const { token: tokenService } = getService('transfer');
+
+    const transferToken = await tokenService.revoke(id);
+
+    ctx.deleted({ data: transferToken });
+  },
+
+  async regenerate(ctx) {
+    const { id } = ctx.params;
+    const { token: tokenService } = getService('transfer');
+
+    const exists = await tokenService.getById(id);
+    if (!exists) {
+      ctx.notFound('Transfer token not found');
+      return;
+    }
+
+    const accessToken = await tokenService.regenerate(id);
+
+    ctx.created({ data: accessToken });
+  },
+};

package/server/controllers/user.js

@@ -48,7 +48,13 @@ module.exports = {
   async find(ctx) {
     const userService = getService('user');
 
-    const { results, pagination } = await userService.findPage(ctx.query);
+    const permissionsManager = strapi.admin.services.permission.createPermissionsManager({
+      ability: ctx.state.userAbility,
+      model: 'admin::user',
+    });
+    const sanitizedQuery = await permissionsManager.sanitizeQuery(ctx.query);
+
+    const { results, pagination } = await userService.findPage(sanitizedQuery);
 
     ctx.body = {
       data: {

package/server/domain/user.js

@@ -19,7 +19,10 @@ const hasSuperAdminRole = (user) => {
   return user.roles.filter((role) => role.code === SUPER_ADMIN_CODE).length > 0;
 };
 
+const ADMIN_USER_ALLOWED_FIELDS = ['id', 'firstname', 'lastname', 'username'];
+
 module.exports = {
   createUser,
   hasSuperAdminRole,
+  ADMIN_USER_ALLOWED_FIELDS,
 };

package/server/middlewares/data-transfer.js

@@ -0,0 +1,29 @@
+'use strict';
+
+const { getService } = require('../utils');
+
+module.exports = () => async (ctx, next) => {
+  const transferUtils = getService('transfer').utils;
+
+  const { hasValidTokenSalt, isDataTransferEnabled, isDisabledFromEnv } = transferUtils;
+
+  if (isDataTransferEnabled()) {
+    return next();
+  }
+
+  if (!hasValidTokenSalt()) {
+    return ctx.notImplemented(
+      'The server configuration for data transfer is invalid. Please contact your server administrator.',
+      {
+        code: 'INVALID_TOKEN_SALT',
+      }
+    );
+  }
+
+  if (isDisabledFromEnv()) {
+    return ctx.notFound();
+  }
+
+  // This should never happen as long as we're handling individual scenarios above
+  throw new Error('Unexpected error while trying to access a data transfer route');
+};

package/server/middlewares/index.js

@@ -4,4 +4,5 @@ const rateLimit = require('./rateLimit');
 
 module.exports = {
   rateLimit,
+  'data-transfer': require('./data-transfer'),
 };

package/server/register.js

@@ -1,9 +1,9 @@
 'use strict';
 
-// const { register: registerDataTransferRoute } = require('@strapi/data-transfer/lib/strapi');
-
 const registerAdminPanelRoute = require('./routes/serve-admin-panel');
+
 const adminAuthStrategy = require('./strategies/admin');
+
 const apiTokenAuthStrategy = require('./strategies/api-token');
 
 module.exports = ({ strapi }) => {
@@ -16,11 +16,4 @@ module.exports = ({ strapi }) => {
   if (strapi.config.serveAdminPanel) {
     registerAdminPanelRoute({ strapi });
   }
-
-  // if (
-  //   process.env.STRAPI_EXPERIMENTAL === 'true' &&
-  //   process.env.STRAPI_DISABLE_REMOTE_DATA_TRANSFER !== 'true'
-  // ) {
-  //   registerDataTransferRoute(strapi);
-  // }
 };

package/server/routes/index.js

@@ -8,6 +8,7 @@ const roles = require('./roles');
 const webhooks = require('./webhooks');
 const apiTokens = require('./api-tokens');
 const contentApi = require('./content-api');
+const transfer = require('./transfer');
 
 module.exports = [
   ...admin,
@@ -18,4 +19,5 @@ module.exports = [
   ...webhooks,
   ...apiTokens,
   ...contentApi,
+  ...transfer,
 ];

package/server/routes/roles.js

@@ -45,6 +45,22 @@ module.exports = [
       ],
     },
   },
+  {
+    method: 'POST',
+    path: '/roles',
+    handler: 'role.create',
+    config: {
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        {
+          name: 'admin::hasPermissions',
+          config: {
+            actions: ['admin::roles.create'],
+          },
+        },
+      ],
+    },
+  },
   {
     method: 'PUT',
     path: '/roles/:id',
@@ -56,4 +72,36 @@ module.exports = [
       ],
     },
   },
+  {
+    method: 'DELETE',
+    path: '/roles/:id',
+    handler: 'role.deleteOne',
+    config: {
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        {
+          name: 'admin::hasPermissions',
+          config: {
+            actions: ['admin::roles.delete'],
+          },
+        },
+      ],
+    },
+  },
+  {
+    method: 'POST',
+    path: '/roles/batch-delete',
+    handler: 'role.deleteMany',
+    config: {
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        {
+          name: 'admin::hasPermissions',
+          config: {
+            actions: ['admin::roles.delete'],
+          },
+        },
+      ],
+    },
+  },
 ];

package/server/routes/transfer.js

@@ -0,0 +1,102 @@
+'use strict';
+
+const dataTransferAuthStrategy = require('../strategies/data-transfer');
+
+module.exports = [
+  // Transfer Push
+  {
+    method: 'GET',
+    path: '/transfer/runner/push',
+    handler: 'transfer.runner-push',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      auth: { strategies: [dataTransferAuthStrategy], scope: ['push'] },
+    },
+  },
+  // Transfer Pull
+  {
+    method: 'GET',
+    path: '/transfer/runner/pull',
+    handler: 'transfer.runner-pull',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      auth: { strategies: [dataTransferAuthStrategy], scope: ['pull'] },
+    },
+  },
+  // Transfer Tokens
+  {
+    method: 'POST',
+    path: '/transfer/tokens',
+    handler: 'transfer.token-create',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        { name: 'admin::hasPermissions', config: { actions: ['admin::transfer.tokens.create'] } },
+      ],
+    },
+  },
+  {
+    method: 'GET',
+    path: '/transfer/tokens',
+    handler: 'transfer.token-list',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        { name: 'admin::hasPermissions', config: { actions: ['admin::transfer.tokens.read'] } },
+      ],
+    },
+  },
+  {
+    method: 'DELETE',
+    path: '/transfer/tokens/:id',
+    handler: 'transfer.token-revoke',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        { name: 'admin::hasPermissions', config: { actions: ['admin::transfer.tokens.delete'] } },
+      ],
+    },
+  },
+  {
+    method: 'GET',
+    path: '/transfer/tokens/:id',
+    handler: 'transfer.token-getById',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        { name: 'admin::hasPermissions', config: { actions: ['admin::transfer.tokens.read'] } },
+      ],
+    },
+  },
+  {
+    method: 'PUT',
+    path: '/transfer/tokens/:id',
+    handler: 'transfer.token-update',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        { name: 'admin::hasPermissions', config: { actions: ['admin::transfer.tokens.update'] } },
+      ],
+    },
+  },
+  {
+    method: 'POST',
+    path: '/transfer/tokens/:id/regenerate',
+    handler: 'transfer.token-regenerate',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        {
+          name: 'admin::hasPermissions',
+          config: { actions: ['admin::transfer.tokens.regenerate'] },
+        },
+      ],
+    },
+  },
+];

package/server/services/api-token.js

@@ -1,8 +1,7 @@
 'use strict';
 
 const crypto = require('crypto');
-const { isNil } = require('lodash/fp');
-const { omit, difference, isEmpty, map, isArray, uniq } = require('lodash/fp');
+const { omit, difference, isNil, isEmpty, map, isArray, uniq } = require('lodash/fp');
 const { ValidationError, NotFoundError } = require('@strapi/utils').errors;
 const constants = require('./constants');
 
@@ -78,7 +77,7 @@ const assertCustomTokenPermissionsValidity = (attributes) => {
 };
 
 /**
- * Assert that a token's permissions attribute is valid for its type
+ * Assert that a token's lifespan is valid
  *
  * @param {ApiToken} token
  */

package/server/services/constants.js

@@ -24,4 +24,14 @@ module.exports = {
     DAYS_30: 30 * DAY_IN_MS,
     DAYS_90: 90 * DAY_IN_MS,
   },
+  TRANSFER_TOKEN_TYPE: {
+    PUSH: 'push',
+    PULL: 'pull',
+  },
+  TRANSFER_TOKEN_LIFESPANS: {
+    UNLIMITED: null,
+    DAYS_7: 7 * DAY_IN_MS,
+    DAYS_30: 30 * DAY_IN_MS,
+    DAYS_90: 90 * DAY_IN_MS,
+  },
 };

package/server/services/index.js

@@ -13,5 +13,6 @@ module.exports = {
   auth: require('./auth'),
   action: require('./action'),
   'api-token': require('./api-token'),
+  transfer: require('./transfer'),
   'project-settings': require('./project-settings'),
 };

package/server/services/permission/permissions-manager/index.js

@@ -34,11 +34,15 @@ module.exports = ({ ability, action, model }) => ({
 
   addPermissionsQueryTo(query = {}, action) {
     const newQuery = cloneDeep(query);
-    const permissionQuery = this.getQuery(action);
-
-    newQuery.filters = isPlainObject(query.filters)
-      ? { $and: [query.filters, permissionQuery] }
-      : permissionQuery;
+    const permissionQuery = this.getQuery(action) ?? undefined;
+
+    if (isPlainObject(query.filters)) {
+      newQuery.filters = permissionQuery
+        ? { $and: [query.filters, permissionQuery] }
+        : query.filters;
+    } else {
+      newQuery.filters = permissionQuery;
+    }
 
     return newQuery;
   },

package/server/services/permission/permissions-manager/sanitize.js

@@ -15,16 +15,26 @@ const {
   intersection,
   pick,
   getOr,
+  isObject,
+  cloneDeep,
 } = require('lodash/fp');
 
-const { contentTypes, traverseEntity, sanitize, pipeAsync } = require('@strapi/utils');
+const { contentTypes, traverseEntity, sanitize, pipeAsync, traverse } = require('@strapi/utils');
+const { removePassword } = require('@strapi/utils/lib/sanitize/visitors');
+const { ADMIN_USER_ALLOWED_FIELDS } = require('../../../domain/user');
 
-const { constants, getNonVisibleAttributes, getNonWritableAttributes, getWritableAttributes } =
-  contentTypes;
+const {
+  constants,
+  isScalarAttribute,
+  getNonVisibleAttributes,
+  getNonWritableAttributes,
+  getWritableAttributes,
+} = contentTypes;
 const {
   ID_ATTRIBUTE,
   CREATED_AT_ATTRIBUTE,
   UPDATED_AT_ATTRIBUTE,
+  PUBLISHED_AT_ATTRIBUTE,
   CREATED_BY_ATTRIBUTE,
   UPDATED_BY_ATTRIBUTE,
 } = constants;
@@ -37,6 +47,74 @@ module.exports = ({ action, ability, model }) => {
 
   const { allowedFields } = sanitize.visitors;
 
+  const createSanitizeQuery = (options = {}) => {
+    const { fields } = options;
+
+    // TODO: sanitize relations to admin users in all sanitizers
+    const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
+
+    const sanitizeFilters = pipeAsync(
+      traverse.traverseQueryFilters(allowedFields(permittedFields), { schema }),
+      traverse.traverseQueryFilters(omitDisallowedAdminUserFields, { schema }),
+      traverse.traverseQueryFilters(removePassword, { schema }),
+      traverse.traverseQueryFilters(
+        ({ key, value }, { remove }) => {
+          if (isObject(value) && isEmpty(value)) {
+            remove(key);
+          }
+        },
+        { schema }
+      )
+    );
+
+    const sanitizeSort = pipeAsync(
+      traverse.traverseQuerySort(allowedFields(permittedFields), { schema }),
+      traverse.traverseQuerySort(omitDisallowedAdminUserFields, { schema }),
+      traverse.traverseQuerySort(removePassword, { schema }),
+      traverse.traverseQuerySort(
+        ({ key, attribute, value }, { remove }) => {
+          if (!isScalarAttribute(attribute) && isEmpty(value)) {
+            remove(key);
+          }
+        },
+        { schema }
+      )
+    );
+
+    const sanitizePopulate = pipeAsync(
+      traverse.traverseQueryPopulate(allowedFields(permittedFields), { schema }),
+      traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, { schema }),
+      traverse.traverseQueryPopulate(removePassword, { schema })
+    );
+
+    const sanitizeFields = pipeAsync(
+      traverse.traverseQueryFields(allowedFields(permittedFields), { schema }),
+      traverse.traverseQueryFields(removePassword, { schema })
+    );
+
+    return async (query) => {
+      const sanitizedQuery = cloneDeep(query);
+
+      if (query.filters) {
+        Object.assign(sanitizedQuery, { filters: await sanitizeFilters(query.filters) });
+      }
+
+      if (query.sort) {
+        Object.assign(sanitizedQuery, { sort: await sanitizeSort(query.sort) });
+      }
+
+      if (query.populate) {
+        Object.assign(sanitizedQuery, { populate: await sanitizePopulate(query.populate) });
+      }
+
+      if (query.fields) {
+        Object.assign(sanitizedQuery, { fields: await sanitizeFields(query.fields) });
+      }
+
+      return sanitizedQuery;
+    };
+  };
+
   const createSanitizeOutput = (options = {}) => {
     const { fields } = options;
 
@@ -128,7 +206,7 @@ module.exports = ({ action, ability, model }) => {
    * Visitor used to only select needed fields from the admin users entities & avoid leaking sensitive information
    */
   const pickAllowedAdminUserFields = ({ attribute, key, value }, { set }) => {
-    const pickAllowedFields = pick(['id', 'firstname', 'lastname', 'username']);
+    const pickAllowedFields = pick(ADMIN_USER_ALLOWED_FIELDS);
 
     if (attribute.type === 'relation' && attribute.target === 'admin::user' && value) {
       if (Array.isArray(value)) {
@@ -139,6 +217,15 @@ module.exports = ({ action, ability, model }) => {
     }
   };
 
+  /**
+   * Visitor used to omit disallowed fields from the admin users entities & avoid leaking sensitive information
+   */
+  const omitDisallowedAdminUserFields = ({ key, attribute, schema }, { remove }) => {
+    if (schema.uid === 'admin::user' && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {
+      remove(key);
+    }
+  };
+
   const getInputFields = (fields = []) => {
     const nonVisibleAttributes = getNonVisibleAttributes(schema);
     const writableAttributes = getWritableAttributes(schema);
@@ -168,8 +255,20 @@ module.exports = ({ action, ability, model }) => {
     ]);
   };
 
+  const getQueryFields = (fields = []) => {
+    return uniq([
+      ...fields,
+      ...STATIC_FIELDS,
+      ...COMPONENT_FIELDS,
+      CREATED_AT_ATTRIBUTE,
+      UPDATED_AT_ATTRIBUTE,
+      PUBLISHED_AT_ATTRIBUTE,
+    ]);
+  };
+
   return {
     sanitizeOutput: wrapSanitize(createSanitizeOutput),
     sanitizeInput: wrapSanitize(createSanitizeInput),
+    sanitizeQuery: wrapSanitize(createSanitizeQuery),
   };
 };