@strapi/admin 4.9.0-alpha.0 → 4.9.0-exp.90df253ba90fd6879eb56a720a1f80d04ff745b8

package/server/services/api-token.js

@@ -1,8 +1,7 @@
 'use strict';
 
 const crypto = require('crypto');
-const { isNil } = require('lodash/fp');
-const { omit, difference, isEmpty, map, isArray, uniq } = require('lodash/fp');
+const { omit, difference, isNil, isEmpty, map, isArray, uniq } = require('lodash/fp');
 const { ValidationError, NotFoundError } = require('@strapi/utils').errors;
 const constants = require('./constants');
 
@@ -78,7 +77,7 @@ const assertCustomTokenPermissionsValidity = (attributes) => {
 };
 
 /**
- * Assert that a token's permissions attribute is valid for its type
+ * Assert that a token's lifespan is valid
  *
  * @param {ApiToken} token
  */

package/server/services/constants.js

@@ -24,4 +24,14 @@ module.exports = {
     DAYS_30: 30 * DAY_IN_MS,
     DAYS_90: 90 * DAY_IN_MS,
   },
+  TRANSFER_TOKEN_TYPE: {
+    PUSH: 'push',
+    PULL: 'pull',
+  },
+  TRANSFER_TOKEN_LIFESPANS: {
+    UNLIMITED: null,
+    DAYS_7: 7 * DAY_IN_MS,
+    DAYS_30: 30 * DAY_IN_MS,
+    DAYS_90: 90 * DAY_IN_MS,
+  },
 };

package/server/services/index.js

@@ -13,5 +13,6 @@ module.exports = {
   auth: require('./auth'),
   action: require('./action'),
   'api-token': require('./api-token'),
+  transfer: require('./transfer'),
   'project-settings': require('./project-settings'),
 };

package/server/services/permission/permissions-manager/index.js

@@ -34,11 +34,15 @@ module.exports = ({ ability, action, model }) => ({
 
   addPermissionsQueryTo(query = {}, action) {
     const newQuery = cloneDeep(query);
-    const permissionQuery = this.getQuery(action);
-
-    newQuery.filters = isPlainObject(query.filters)
-      ? { $and: [query.filters, permissionQuery] }
-      : permissionQuery;
+    const permissionQuery = this.getQuery(action) ?? undefined;
+
+    if (isPlainObject(query.filters)) {
+      newQuery.filters = permissionQuery
+        ? { $and: [query.filters, permissionQuery] }
+        : query.filters;
+    } else {
+      newQuery.filters = permissionQuery;
+    }
 
     return newQuery;
   },

package/server/services/permission/permissions-manager/sanitize.js

@@ -15,12 +15,21 @@ const {
   intersection,
   pick,
   getOr,
+  isObject,
+  cloneDeep,
 } = require('lodash/fp');
 
-const { contentTypes, traverseEntity, sanitize, pipeAsync } = require('@strapi/utils');
+const { contentTypes, traverseEntity, sanitize, pipeAsync, traverse } = require('@strapi/utils');
+const { removePassword } = require('@strapi/utils/lib/sanitize/visitors');
+const { ADMIN_USER_ALLOWED_FIELDS } = require('../../../domain/user');
 
-const { constants, getNonVisibleAttributes, getNonWritableAttributes, getWritableAttributes } =
-  contentTypes;
+const {
+  constants,
+  isScalarAttribute,
+  getNonVisibleAttributes,
+  getNonWritableAttributes,
+  getWritableAttributes,
+} = contentTypes;
 const {
   ID_ATTRIBUTE,
   CREATED_AT_ATTRIBUTE,
@@ -37,6 +46,74 @@ module.exports = ({ action, ability, model }) => {
 
   const { allowedFields } = sanitize.visitors;
 
+  const createSanitizeQuery = (options = {}) => {
+    const { fields } = options;
+
+    // TODO: sanitize relations to admin users in all sanitizers
+    const permittedFields = fields.shouldIncludeAll ? null : getQueryFields(fields.permitted);
+
+    const sanitizeFilters = pipeAsync(
+      traverse.traverseQueryFilters(allowedFields(permittedFields), { schema }),
+      traverse.traverseQueryFilters(omitDisallowedAdminUserFields, { schema }),
+      traverse.traverseQueryFilters(removePassword, { schema }),
+      traverse.traverseQueryFilters(
+        ({ key, value }, { remove }) => {
+          if (isObject(value) && isEmpty(value)) {
+            remove(key);
+          }
+        },
+        { schema }
+      )
+    );
+
+    const sanitizeSort = pipeAsync(
+      traverse.traverseQuerySort(allowedFields(permittedFields), { schema }),
+      traverse.traverseQuerySort(omitDisallowedAdminUserFields, { schema }),
+      traverse.traverseQuerySort(removePassword, { schema }),
+      traverse.traverseQuerySort(
+        ({ key, attribute, value }, { remove }) => {
+          if (!isScalarAttribute(attribute) && isEmpty(value)) {
+            remove(key);
+          }
+        },
+        { schema }
+      )
+    );
+
+    const sanitizePopulate = pipeAsync(
+      traverse.traverseQueryPopulate(allowedFields(permittedFields), { schema }),
+      traverse.traverseQueryPopulate(omitDisallowedAdminUserFields, { schema }),
+      traverse.traverseQueryPopulate(removePassword, { schema })
+    );
+
+    const sanitizeFields = pipeAsync(
+      traverse.traverseQueryFields(allowedFields(permittedFields), { schema }),
+      traverse.traverseQueryFields(removePassword, { schema })
+    );
+
+    return async (query) => {
+      const sanitizedQuery = cloneDeep(query);
+
+      if (query.filters) {
+        Object.assign(sanitizedQuery, { filters: await sanitizeFilters(query.filters) });
+      }
+
+      if (query.sort) {
+        Object.assign(sanitizedQuery, { sort: await sanitizeSort(query.sort) });
+      }
+
+      if (query.populate) {
+        Object.assign(sanitizedQuery, { populate: await sanitizePopulate(query.populate) });
+      }
+
+      if (query.fields) {
+        Object.assign(sanitizedQuery, { fields: await sanitizeFields(query.fields) });
+      }
+
+      return sanitizedQuery;
+    };
+  };
+
   const createSanitizeOutput = (options = {}) => {
     const { fields } = options;
 
@@ -128,7 +205,7 @@ module.exports = ({ action, ability, model }) => {
    * Visitor used to only select needed fields from the admin users entities & avoid leaking sensitive information
    */
   const pickAllowedAdminUserFields = ({ attribute, key, value }, { set }) => {
-    const pickAllowedFields = pick(['id', 'firstname', 'lastname', 'username']);
+    const pickAllowedFields = pick(ADMIN_USER_ALLOWED_FIELDS);
 
     if (attribute.type === 'relation' && attribute.target === 'admin::user' && value) {
       if (Array.isArray(value)) {
@@ -139,6 +216,15 @@ module.exports = ({ action, ability, model }) => {
     }
   };
 
+  /**
+   * Visitor used to omit disallowed fields from the admin users entities & avoid leaking sensitive information
+   */
+  const omitDisallowedAdminUserFields = ({ key, attribute, schema }, { remove }) => {
+    if (schema.uid === 'admin::user' && attribute && !ADMIN_USER_ALLOWED_FIELDS.includes(key)) {
+      remove(key);
+    }
+  };
+
   const getInputFields = (fields = []) => {
     const nonVisibleAttributes = getNonVisibleAttributes(schema);
     const writableAttributes = getWritableAttributes(schema);
@@ -168,8 +254,19 @@ module.exports = ({ action, ability, model }) => {
     ]);
   };
 
+  const getQueryFields = (fields = []) => {
+    return uniq([
+      ...fields,
+      ...STATIC_FIELDS,
+      ...COMPONENT_FIELDS,
+      CREATED_AT_ATTRIBUTE,
+      UPDATED_AT_ATTRIBUTE,
+    ]);
+  };
+
   return {
     sanitizeOutput: wrapSanitize(createSanitizeOutput),
     sanitizeInput: wrapSanitize(createSanitizeInput),
+    sanitizeQuery: wrapSanitize(createSanitizeQuery),
   };
 };

package/server/services/permission/queries.js

@@ -1,22 +1,7 @@
 'use strict';
 
-const {
-  flatMap,
-  reject,
-  isNil,
-  isArray,
-  prop,
-  xor,
-  eq,
-  uniq,
-  map,
-  difference,
-  differenceWith,
-  pipe,
-} = require('lodash/fp');
+const { isNil, isArray, prop, xor, eq, map, differenceWith } = require('lodash/fp');
 const pmap = require('p-map');
-const { EDITOR_CODE } = require('../constants');
-const { getBoundActionsBySubject, BOUND_ACTIONS_FOR_FIELDS } = require('../../domain/role');
 const { getService } = require('../../utils');
 const permissionDomain = require('../../domain/permission/index');
 
@@ -195,63 +180,6 @@ const cleanPermissionsInDatabase = async () => {
   }
 };
 
-const ensureBoundPermissionsInDatabase = async () => {
-  if (strapi.EE) {
-    return;
-  }
-
-  const contentTypes = Object.values(strapi.contentTypes);
-  const editorRole = await strapi.query('admin::role').findOne({
-    where: { code: EDITOR_CODE },
-  });
-
-  if (isNil(editorRole)) {
-    return;
-  }
-
-  for (const contentType of contentTypes) {
-    const boundActions = getBoundActionsBySubject(editorRole, contentType.uid);
-
-    const permissions = await findMany({
-      where: {
-        subject: contentType.uid,
-        action: boundActions,
-        role: { id: editorRole.id },
-      },
-    });
-
-    if (permissions.length === 0) {
-      return;
-    }
-
-    const fields = pipe(
-      flatMap(permissionDomain.getProperty('fields')),
-      reject(isNil),
-      uniq
-    )(permissions);
-
-    // Handle the scenario where permissions are missing
-    const missingActions = difference(map('action', permissions), boundActions);
-
-    if (missingActions.length > 0) {
-      const permissions = pipe(
-        // Create a permission skeleton from the action id
-        map((action) => ({ action, subject: contentType.uid, role: editorRole.id })),
-        // Use the permission domain to create a clean permission from the given object
-        map(permissionDomain.create),
-        // Adds the fields property if the permission action is eligible
-        map((permission) =>
-          BOUND_ACTIONS_FOR_FIELDS.includes(permission.action)
-            ? permissionDomain.setProperty('fields', fields, permission)
-            : permission
-        )
-      )(missingActions);
-
-      await createMany(permissions);
-    }
-  }
-};
-
 module.exports = {
   createMany,
   findMany,
@@ -259,5 +187,4 @@ module.exports = {
   deleteByIds,
   findUserPermissions,
   cleanPermissionsInDatabase,
-  ensureBoundPermissionsInDatabase,
 };

package/server/services/transfer/index.js

@@ -0,0 +1,7 @@
+'use strict';
+
+module.exports = {
+  permission: require('./permission'),
+  token: require('./token'),
+  utils: require('./utils'),
+};

package/server/services/transfer/permission.js

@@ -0,0 +1,22 @@
+'use strict';
+
+const permissions = require('@strapi/permissions');
+const { providerFactory } = require('@strapi/utils');
+
+const DEFAULT_TRANSFER_ACTIONS = ['push', 'pull'];
+
+const providers = {
+  action: providerFactory(),
+  condition: providerFactory(),
+};
+
+DEFAULT_TRANSFER_ACTIONS.forEach((action) => {
+  providers.action.register(action, { action });
+});
+
+const engine = permissions.engine.new({ providers });
+
+module.exports = {
+  engine,
+  providers,
+};