@strapi/admin 4.9.0-alpha.0 → 4.9.0-exp.90df253ba90fd6879eb56a720a1f80d04ff745b8

package/server/content-types/transfer-token.js

@@ -0,0 +1,66 @@
+'use strict';
+
+module.exports = {
+  collectionName: 'strapi_transfer_tokens',
+  info: {
+    name: 'Transfer Token',
+    singularName: 'transfer-token',
+    pluralName: 'transfer-tokens',
+    displayName: 'Transfer Token',
+    description: '',
+  },
+  options: {},
+  pluginOptions: {
+    'content-manager': {
+      visible: false,
+    },
+    'content-type-builder': {
+      visible: false,
+    },
+  },
+  attributes: {
+    name: {
+      type: 'string',
+      minLength: 1,
+      configurable: false,
+      required: true,
+      unique: true,
+    },
+    description: {
+      type: 'string',
+      minLength: 1,
+      configurable: false,
+      required: false,
+      default: '',
+    },
+    accessKey: {
+      type: 'string',
+      minLength: 1,
+      configurable: false,
+      required: true,
+    },
+    lastUsedAt: {
+      type: 'datetime',
+      configurable: false,
+      required: false,
+    },
+    permissions: {
+      type: 'relation',
+      target: 'admin::transfer-token-permission',
+      relation: 'oneToMany',
+      mappedBy: 'token',
+      configurable: false,
+      required: false,
+    },
+    expiresAt: {
+      type: 'datetime',
+      configurable: false,
+      required: false,
+    },
+    lifespan: {
+      type: 'biginteger',
+      configurable: false,
+      required: false,
+    },
+  },
+};

package/server/controllers/api-token.js

@@ -1,9 +1,10 @@
 'use strict';
 
-const { stringEquals } = require('@strapi/utils/lib');
-const { ApplicationError } = require('@strapi/utils').errors;
-const { trim } = require('lodash/fp');
-const has = require('lodash/has');
+const {
+  stringEquals,
+  errors: { ApplicationError },
+} = require('@strapi/utils');
+const { trim, has } = require('lodash/fp');
 const { getService } = require('../utils');
 const {
   validateApiTokenCreationInput,
@@ -93,11 +94,11 @@ module.exports = {
      * - having a space at the end or start of the value.
      * - having only spaces as value;
      */
-    if (has(attributes, 'name')) {
+    if (has('name', attributes)) {
       attributes.name = trim(body.name);
     }
 
-    if (has(attributes, 'description') || attributes.description === null) {
+    if (has('description', attributes) || attributes.description === null) {
       attributes.description = trim(body.description);
     }
 
@@ -108,7 +109,7 @@ module.exports = {
       return ctx.notFound('API Token not found');
     }
 
-    if (has(attributes, 'name')) {
+    if (has('name', attributes)) {
       const nameAlreadyTaken = await apiTokenService.getByName(attributes.name);
 
       /**

package/server/controllers/index.js

@@ -7,6 +7,7 @@ module.exports = {
   authentication: require('./authentication'),
   permission: require('./permission'),
   role: require('./role'),
+  transfer: require('./transfer'),
   user: require('./user'),
   webhooks: require('./webhooks'),
   'content-api': require('./content-api'),

package/server/controllers/permission.js

@@ -29,11 +29,9 @@ module.exports = {
    * @param {KoaContext} ctx - koa context
    */
   async getAll(ctx) {
-    const { role: roleId } = ctx.query;
+    const { sectionsBuilder, actionProvider, conditionProvider } = getService('permission');
 
-    const { sectionsBuilder, conditionProvider } = getService('permission');
-
-    const actions = await getService('action').getAllowedActionsForRole(roleId);
+    const actions = actionProvider.values();
     const conditions = conditionProvider.values();
     const sections = await sectionsBuilder.build(actions);
 

package/server/controllers/role.js

@@ -1,12 +1,32 @@
 'use strict';
 
 const { ApplicationError } = require('@strapi/utils').errors;
-const { validateRoleUpdateInput } = require('../validation/role');
+const {
+  validateRoleUpdateInput,
+  validateRoleCreateInput,
+  validateRoleDeleteInput,
+  validateRolesDeleteInput,
+} = require('../validation/role');
 const { validatedUpdatePermissionsInput } = require('../validation/permission');
-const { EDITOR_CODE, AUTHOR_CODE, SUPER_ADMIN_CODE } = require('../services/constants');
+const { SUPER_ADMIN_CODE } = require('../services/constants');
 const { getService } = require('../utils');
 
 module.exports = {
+  /**
+   * Create a new role
+   * @param {KoaContext} ctx - koa context
+   */
+  async create(ctx) {
+    await validateRoleCreateInput(ctx.request.body);
+
+    const roleService = getService('role');
+
+    const role = await roleService.create(ctx.request.body);
+    const sanitizedRole = roleService.sanitizeRole(role);
+
+    ctx.created({ data: sanitizedRole });
+  },
+
   /**
    * Returns on role by id
    * @param {KoaContext} ctx - koa context
@@ -99,10 +119,10 @@ module.exports = {
     const { id } = ctx.params;
     const { body: input } = ctx.request;
 
-    const { findOne, assignPermissions } = getService('role');
-    const { sanitizePermission, actionProvider } = getService('permission');
+    const roleService = getService('role');
+    const permissionService = getService('permission');
 
-    const role = await findOne({ id });
+    const role = await roleService.findOne({ id });
 
     if (!role) {
       return ctx.notFound('role.notFound');
@@ -112,30 +132,57 @@ module.exports = {
       throw new ApplicationError("Super admin permissions can't be edited.");
     }
 
-    await validatedUpdatePermissionsInput(input, role);
+    await validatedUpdatePermissionsInput(input);
 
-    let permissionsToAssign;
+    if (!role) {
+      return ctx.notFound('role.notFound');
+    }
 
-    if ([EDITOR_CODE, AUTHOR_CODE].includes(role.code)) {
-      permissionsToAssign = input.permissions.map((permission) => {
-        const action = actionProvider.get(permission.action);
+    const permissions = await roleService.assignPermissions(role.id, input.permissions);
 
-        if (action.section !== 'contentTypes') {
-          return permission;
-        }
+    const sanitizedPermissions = permissions.map(permissionService.sanitizePermission);
 
-        const conditions = role.code === AUTHOR_CODE ? ['admin::is-creator'] : [];
+    ctx.body = {
+      data: sanitizedPermissions,
+    };
+  },
 
-        return { ...permission, conditions };
-      });
-    } else {
-      permissionsToAssign = input.permissions;
-    }
+  /**
+   * Delete a role
+   * @param {KoaContext} ctx - koa context
+   */
+  async deleteOne(ctx) {
+    const { id } = ctx.params;
 
-    const permissions = await assignPermissions(role.id, permissionsToAssign);
+    await validateRoleDeleteInput(id);
 
-    ctx.body = {
-      data: permissions.map(sanitizePermission),
-    };
+    const roleService = getService('role');
+
+    const roles = await roleService.deleteByIds([id]);
+
+    const sanitizedRole = roles.map((role) => roleService.sanitizeRole(role))[0] || null;
+
+    return ctx.deleted({
+      data: sanitizedRole,
+    });
+  },
+
+  /**
+   * delete several roles
+   * @param {KoaContext} ctx - koa context
+   */
+  async deleteMany(ctx) {
+    const { body } = ctx.request;
+
+    await validateRolesDeleteInput(body);
+
+    const roleService = getService('role');
+
+    const roles = await roleService.deleteByIds(body.ids);
+    const sanitizedRoles = roles.map(roleService.sanitizeRole);
+
+    return ctx.deleted({
+      data: sanitizedRoles,
+    });
   },
 };

package/server/controllers/transfer/index.js

@@ -0,0 +1,13 @@
+'use strict';
+
+const { mapKeys } = require('lodash/fp');
+
+const runner = require('./runner');
+const token = require('./token');
+
+const prefixActionsName = (prefix, dict) => mapKeys((key) => `${prefix}-${key}`, dict);
+
+module.exports = {
+  ...prefixActionsName('runner', runner),
+  ...prefixActionsName('token', token),
+};

package/server/controllers/transfer/runner.js

@@ -0,0 +1,28 @@
+'use strict';
+
+const { createPushController, createPullController } =
+  require('@strapi/data-transfer').strapi.remote.handlers;
+const {
+  errors: { UnauthorizedError },
+} = require('@strapi/utils');
+
+const dataTransferAuthStrategy = require('../../strategies/data-transfer');
+
+/**
+ * @param {import('koa').Context} ctx
+ * @param {string} [scope]
+ */
+const verify = async (ctx, scope) => {
+  const { auth } = ctx.state;
+
+  if (!auth) {
+    throw new UnauthorizedError();
+  }
+
+  await dataTransferAuthStrategy.verify(auth, { scope });
+};
+
+module.exports = {
+  push: createPushController({ verify }),
+  pull: createPullController({ verify }),
+};

package/server/controllers/transfer/token.js

@@ -0,0 +1,131 @@
+'use strict';
+
+const { trim, has } = require('lodash/fp');
+const {
+  errors: { ApplicationError },
+  stringEquals,
+} = require('@strapi/utils');
+
+const {
+  token: { validateTransferTokenCreationInput, validateTransferTokenUpdateInput },
+} = require('../../validation/transfer');
+const { getService } = require('../../utils');
+
+module.exports = {
+  async list(ctx) {
+    const transferService = getService('transfer');
+    const transferTokens = await transferService.token.list();
+
+    ctx.body = { data: transferTokens };
+  },
+
+  async getById(ctx) {
+    const { id } = ctx.params;
+    const tokenService = getService('transfer').token;
+
+    const transferToken = await tokenService.getById(id);
+
+    if (!transferToken) {
+      ctx.notFound('Transfer token not found');
+      return;
+    }
+
+    ctx.body = { data: transferToken };
+  },
+
+  async create(ctx) {
+    const { body } = ctx.request;
+    const { token: tokenService } = getService('transfer');
+
+    /**
+     * We trim fields to avoid having issues with either:
+     * - having a space at the end or start of the value
+     * - having only spaces as value (so that an empty field can be caught in validation)
+     */
+    const attributes = {
+      name: trim(body.name),
+      description: trim(body.description),
+      permissions: body.permissions,
+      lifespan: body.lifespan,
+    };
+
+    await validateTransferTokenCreationInput(attributes);
+
+    const alreadyExists = await tokenService.exists({ name: attributes.name });
+    if (alreadyExists) {
+      throw new ApplicationError('Name already taken');
+    }
+
+    const transferTokens = await tokenService.create(attributes);
+
+    ctx.created({ data: transferTokens });
+  },
+
+  async update(ctx) {
+    const { body } = ctx.request;
+    const { id } = ctx.params;
+    const { token: tokenService } = getService('transfer');
+
+    const attributes = body;
+    /**
+     * We trim fields to avoid having issues with either:
+     * - having a space at the end or start of the value
+     * - having only spaces as value (so that an empty field can be caught in validation)
+     */
+    if (has('name', attributes)) {
+      attributes.name = trim(body.name);
+    }
+
+    if (has('description', attributes) || attributes.description === null) {
+      attributes.description = trim(body.description);
+    }
+
+    await validateTransferTokenUpdateInput(attributes);
+
+    const apiTokenExists = await tokenService.getById(id);
+    if (!apiTokenExists) {
+      return ctx.notFound('Transfer token not found');
+    }
+
+    if (has('name', attributes)) {
+      const nameAlreadyTaken = await tokenService.getByName(attributes.name);
+
+      /**
+       * We cast the ids as string as the one coming from the ctx isn't cast
+       * as a Number in case it is supposed to be an integer. It remains
+       * as a string. This way we avoid issues with integers in the db.
+       */
+      if (!!nameAlreadyTaken && !stringEquals(nameAlreadyTaken.id, id)) {
+        throw new ApplicationError('Name already taken');
+      }
+    }
+
+    const apiToken = await tokenService.update(id, attributes);
+
+    ctx.body = { data: apiToken };
+  },
+
+  async revoke(ctx) {
+    const { id } = ctx.params;
+    const { token: tokenService } = getService('transfer');
+
+    const transferToken = await tokenService.revoke(id);
+
+    ctx.deleted({ data: transferToken });
+  },
+
+  async regenerate(ctx) {
+    const { id } = ctx.params;
+    const { token: tokenService } = getService('transfer');
+
+    const exists = await tokenService.getById(id);
+    if (!exists) {
+      ctx.notFound('Transfer token not found');
+      return;
+    }
+
+    const accessToken = await tokenService.regenerate(id);
+
+    ctx.created({ data: accessToken });
+  },
+};

package/server/controllers/user.js

@@ -48,7 +48,13 @@ module.exports = {
   async find(ctx) {
     const userService = getService('user');
 
-    const { results, pagination } = await userService.findPage(ctx.query);
+    const permissionsManager = strapi.admin.services.permission.createPermissionsManager({
+      ability: ctx.state.userAbility,
+      model: 'admin::user',
+    });
+    const sanitizedQuery = await permissionsManager.sanitizeQuery(ctx.query);
+
+    const { results, pagination } = await userService.findPage(sanitizedQuery);
 
     ctx.body = {
       data: {

package/server/domain/user.js

@@ -19,7 +19,10 @@ const hasSuperAdminRole = (user) => {
   return user.roles.filter((role) => role.code === SUPER_ADMIN_CODE).length > 0;
 };
 
+const ADMIN_USER_ALLOWED_FIELDS = ['id', 'firstname', 'lastname', 'username'];
+
 module.exports = {
   createUser,
   hasSuperAdminRole,
+  ADMIN_USER_ALLOWED_FIELDS,
 };

package/server/middlewares/data-transfer.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const { getService } = require('../utils');
+
+module.exports = () => async (ctx, next) => {
+  const transferUtils = getService('transfer').utils;
+
+  const { hasValidTokenSalt, isDataTransferEnabled, isDisabledFromEnv } = transferUtils;
+
+  if (isDataTransferEnabled()) {
+    return next();
+  }
+
+  if (!hasValidTokenSalt()) {
+    return ctx.notImplemented(
+      'The server configuration for data transfer is invalid. Please contact your server administrator.'
+    );
+  }
+
+  if (isDisabledFromEnv()) {
+    return ctx.notFound();
+  }
+
+  // This should never happen as long as we're handling individual scenarios above
+  throw new Error('Unexpected error while trying to access a data transfer route');
+};

package/server/middlewares/index.js

@@ -4,4 +4,5 @@ const rateLimit = require('./rateLimit');
 
 module.exports = {
   rateLimit,
+  'data-transfer': require('./data-transfer'),
 };

package/server/register.js

@@ -1,9 +1,9 @@
 'use strict';
 
-// const { register: registerDataTransferRoute } = require('@strapi/data-transfer/lib/strapi');
-
 const registerAdminPanelRoute = require('./routes/serve-admin-panel');
+
 const adminAuthStrategy = require('./strategies/admin');
+
 const apiTokenAuthStrategy = require('./strategies/api-token');
 
 module.exports = ({ strapi }) => {
@@ -16,11 +16,4 @@ module.exports = ({ strapi }) => {
   if (strapi.config.serveAdminPanel) {
     registerAdminPanelRoute({ strapi });
   }
-
-  // if (
-  //   process.env.STRAPI_EXPERIMENTAL === 'true' &&
-  //   process.env.STRAPI_DISABLE_REMOTE_DATA_TRANSFER !== 'true'
-  // ) {
-  //   registerDataTransferRoute(strapi);
-  // }
 };

package/server/routes/index.js

@@ -8,6 +8,7 @@ const roles = require('./roles');
 const webhooks = require('./webhooks');
 const apiTokens = require('./api-tokens');
 const contentApi = require('./content-api');
+const transfer = require('./transfer');
 
 module.exports = [
   ...admin,
@@ -18,4 +19,5 @@ module.exports = [
   ...webhooks,
   ...apiTokens,
   ...contentApi,
+  ...transfer,
 ];

package/server/routes/roles.js

@@ -45,6 +45,22 @@ module.exports = [
       ],
     },
   },
+  {
+    method: 'POST',
+    path: '/roles',
+    handler: 'role.create',
+    config: {
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        {
+          name: 'admin::hasPermissions',
+          config: {
+            actions: ['admin::roles.create'],
+          },
+        },
+      ],
+    },
+  },
   {
     method: 'PUT',
     path: '/roles/:id',
@@ -56,4 +72,36 @@ module.exports = [
       ],
     },
   },
+  {
+    method: 'DELETE',
+    path: '/roles/:id',
+    handler: 'role.deleteOne',
+    config: {
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        {
+          name: 'admin::hasPermissions',
+          config: {
+            actions: ['admin::roles.delete'],
+          },
+        },
+      ],
+    },
+  },
+  {
+    method: 'POST',
+    path: '/roles/batch-delete',
+    handler: 'role.deleteMany',
+    config: {
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        {
+          name: 'admin::hasPermissions',
+          config: {
+            actions: ['admin::roles.delete'],
+          },
+        },
+      ],
+    },
+  },
 ];

package/server/routes/transfer.js

@@ -0,0 +1,102 @@
+'use strict';
+
+const dataTransferAuthStrategy = require('../strategies/data-transfer');
+
+module.exports = [
+  // Transfer Push
+  {
+    method: 'GET',
+    path: '/transfer/runner/push',
+    handler: 'transfer.runner-push',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      auth: { strategies: [dataTransferAuthStrategy], scope: ['push'] },
+    },
+  },
+  // Transfer Pull
+  {
+    method: 'GET',
+    path: '/transfer/runner/pull',
+    handler: 'transfer.runner-pull',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      auth: { strategies: [dataTransferAuthStrategy], scope: ['pull'] },
+    },
+  },
+  // Transfer Tokens
+  {
+    method: 'POST',
+    path: '/transfer/tokens',
+    handler: 'transfer.token-create',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        { name: 'admin::hasPermissions', config: { actions: ['admin::transfer.tokens.create'] } },
+      ],
+    },
+  },
+  {
+    method: 'GET',
+    path: '/transfer/tokens',
+    handler: 'transfer.token-list',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        { name: 'admin::hasPermissions', config: { actions: ['admin::transfer.tokens.read'] } },
+      ],
+    },
+  },
+  {
+    method: 'DELETE',
+    path: '/transfer/tokens/:id',
+    handler: 'transfer.token-revoke',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        { name: 'admin::hasPermissions', config: { actions: ['admin::transfer.tokens.delete'] } },
+      ],
+    },
+  },
+  {
+    method: 'GET',
+    path: '/transfer/tokens/:id',
+    handler: 'transfer.token-getById',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        { name: 'admin::hasPermissions', config: { actions: ['admin::transfer.tokens.read'] } },
+      ],
+    },
+  },
+  {
+    method: 'PUT',
+    path: '/transfer/tokens/:id',
+    handler: 'transfer.token-update',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        { name: 'admin::hasPermissions', config: { actions: ['admin::transfer.tokens.update'] } },
+      ],
+    },
+  },
+  {
+    method: 'POST',
+    path: '/transfer/tokens/:id/regenerate',
+    handler: 'transfer.token-regenerate',
+    config: {
+      middlewares: ['admin::data-transfer'],
+      policies: [
+        'admin::isAuthenticatedAdmin',
+        {
+          name: 'admin::hasPermissions',
+          config: { actions: ['admin::transfer.tokens.regenerate'] },
+        },
+      ],
+    },
+  },
+];