@strapi/plugin-users-permissions 0.0.0-00a3f69152eb918683ed5c05bfed9c45495c0a87

package/server/services/user.js

@@ -0,0 +1,140 @@
+'use strict';
+
+/**
+ * User.js service
+ *
+ * @description: A set of functions similar to controller's actions to avoid code duplication.
+ */
+
+const crypto = require('crypto');
+const bcrypt = require('bcryptjs');
+const urlJoin = require('url-join');
+
+const { getAbsoluteAdminUrl, getAbsoluteServerUrl, sanitize } = require('@strapi/utils');
+const { getService } = require('../utils');
+
+module.exports = ({ strapi }) => ({
+  /**
+   * Promise to count users
+   *
+   * @return {Promise}
+   */
+
+  count(params) {
+    return strapi.query('plugin::users-permissions.user').count({ where: params });
+  },
+
+  /**
+   * Promise to search count users
+   *
+   * @return {Promise}
+   */
+
+  /**
+   * Promise to add a/an user.
+   * @return {Promise}
+   */
+  async add(values) {
+    return strapi.entityService.create('plugin::users-permissions.user', {
+      data: values,
+      populate: ['role'],
+    });
+  },
+
+  /**
+   * Promise to edit a/an user.
+   * @param {string} userId
+   * @param {object} params
+   * @return {Promise}
+   */
+  async edit(userId, params = {}) {
+    return strapi.entityService.update('plugin::users-permissions.user', userId, {
+      data: params,
+      populate: ['role'],
+    });
+  },
+
+  /**
+   * Promise to fetch a/an user.
+   * @return {Promise}
+   */
+  fetch(id, params) {
+    return strapi.entityService.findOne('plugin::users-permissions.user', id, params);
+  },
+
+  /**
+   * Promise to fetch authenticated user.
+   * @return {Promise}
+   */
+  fetchAuthenticatedUser(id) {
+    return strapi
+      .query('plugin::users-permissions.user')
+      .findOne({ where: { id }, populate: ['role'] });
+  },
+
+  /**
+   * Promise to fetch all users.
+   * @return {Promise}
+   */
+  fetchAll(params) {
+    return strapi.entityService.findMany('plugin::users-permissions.user', params);
+  },
+
+  /**
+   * Promise to remove a/an user.
+   * @return {Promise}
+   */
+  async remove(params) {
+    return strapi.query('plugin::users-permissions.user').delete({ where: params });
+  },
+
+  validatePassword(password, hash) {
+    return bcrypt.compare(password, hash);
+  },
+
+  async sendConfirmationEmail(user) {
+    const userPermissionService = getService('users-permissions');
+    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });
+    const userSchema = strapi.getModel('plugin::users-permissions.user');
+
+    const settings = await pluginStore
+      .get({ key: 'email' })
+      .then((storeEmail) => storeEmail.email_confirmation.options);
+
+    // Sanitize the template's user information
+    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(userSchema, user);
+
+    const confirmationToken = crypto.randomBytes(20).toString('hex');
+
+    await this.edit(user.id, { confirmationToken });
+
+    const apiPrefix = strapi.config.get('api.rest.prefix');
+    settings.message = await userPermissionService.template(settings.message, {
+      URL: urlJoin(getAbsoluteServerUrl(strapi.config), apiPrefix, '/auth/email-confirmation'),
+      SERVER_URL: getAbsoluteServerUrl(strapi.config),
+      ADMIN_URL: getAbsoluteAdminUrl(strapi.config),
+      USER: sanitizedUserInfo,
+      CODE: confirmationToken,
+    });
+
+    settings.object = await userPermissionService.template(settings.object, {
+      USER: sanitizedUserInfo,
+    });
+
+    // Send an email to the user.
+    await strapi
+      .plugin('email')
+      .service('email')
+      .send({
+        to: user.email,
+        from:
+          settings.from.email && settings.from.name
+            ? `${settings.from.name} <${settings.from.email}>`
+            : undefined,
+        replyTo: settings.response_email,
+        subject: settings.object,
+        text: settings.message,
+        html: settings.message,
+      });
+  },
+});

package/server/services/users-permissions.js

@@ -0,0 +1,236 @@
+'use strict';
+
+const _ = require('lodash');
+const { filter, map, pipe, prop } = require('lodash/fp');
+const urlJoin = require('url-join');
+
+const { getService } = require('../utils');
+
+const DEFAULT_PERMISSIONS = [
+  { action: 'plugin::users-permissions.auth.callback', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.connect', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.forgotPassword', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.resetPassword', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.register', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.emailConfirmation', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.sendEmailConfirmation', roleType: 'public' },
+  { action: 'plugin::users-permissions.user.me', roleType: 'authenticated' },
+  { action: 'plugin::users-permissions.auth.changePassword', roleType: 'authenticated' },
+];
+
+const transformRoutePrefixFor = (pluginName) => (route) => {
+  const prefix = route.config && route.config.prefix;
+  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;
+
+  return {
+    ...route,
+    path,
+  };
+};
+
+module.exports = ({ strapi }) => ({
+  getActions({ defaultEnable = false } = {}) {
+    const actionMap = {};
+
+    const isContentApi = (action) => {
+      if (!_.has(action, Symbol.for('__type__'))) {
+        return false;
+      }
+
+      return action[Symbol.for('__type__')].includes('content-api');
+    };
+
+    _.forEach(strapi.api, (api, apiName) => {
+      const controllers = _.reduce(
+        api.controllers,
+        (acc, controller, controllerName) => {
+          const contentApiActions = _.pickBy(controller, isContentApi);
+
+          if (_.isEmpty(contentApiActions)) {
+            return acc;
+          }
+
+          acc[controllerName] = _.mapValues(contentApiActions, () => {
+            return {
+              enabled: defaultEnable,
+              policy: '',
+            };
+          });
+
+          return acc;
+        },
+        {}
+      );
+
+      if (!_.isEmpty(controllers)) {
+        actionMap[`api::${apiName}`] = { controllers };
+      }
+    });
+
+    _.forEach(strapi.plugins, (plugin, pluginName) => {
+      const controllers = _.reduce(
+        plugin.controllers,
+        (acc, controller, controllerName) => {
+          const contentApiActions = _.pickBy(controller, isContentApi);
+
+          if (_.isEmpty(contentApiActions)) {
+            return acc;
+          }
+
+          acc[controllerName] = _.mapValues(contentApiActions, () => {
+            return {
+              enabled: defaultEnable,
+              policy: '',
+            };
+          });
+
+          return acc;
+        },
+        {}
+      );
+
+      if (!_.isEmpty(controllers)) {
+        actionMap[`plugin::${pluginName}`] = { controllers };
+      }
+    });
+
+    return actionMap;
+  },
+
+  async getRoutes() {
+    const routesMap = {};
+
+    _.forEach(strapi.api, (api, apiName) => {
+      const routes = _.flatMap(api.routes, (route) => {
+        if (_.has(route, 'routes')) {
+          return route.routes;
+        }
+
+        return route;
+      }).filter((route) => route.info.type === 'content-api');
+
+      if (routes.length === 0) {
+        return;
+      }
+
+      const apiPrefix = strapi.config.get('api.rest.prefix');
+      routesMap[`api::${apiName}`] = routes.map((route) => ({
+        ...route,
+        path: urlJoin(apiPrefix, route.path),
+      }));
+    });
+
+    _.forEach(strapi.plugins, (plugin, pluginName) => {
+      const transformPrefix = transformRoutePrefixFor(pluginName);
+
+      const routes = _.flatMap(plugin.routes, (route) => {
+        if (_.has(route, 'routes')) {
+          return route.routes.map(transformPrefix);
+        }
+
+        return transformPrefix(route);
+      }).filter((route) => route.info.type === 'content-api');
+
+      if (routes.length === 0) {
+        return;
+      }
+
+      const apiPrefix = strapi.config.get('api.rest.prefix');
+      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({
+        ...route,
+        path: urlJoin(apiPrefix, route.path),
+      }));
+    });
+
+    return routesMap;
+  },
+
+  async syncPermissions() {
+    const roles = await strapi.query('plugin::users-permissions.role').findMany();
+    const dbPermissions = await strapi.query('plugin::users-permissions.permission').findMany();
+
+    const permissionsFoundInDB = _.uniq(_.map(dbPermissions, 'action'));
+
+    const appActions = _.flatMap(strapi.api, (api, apiName) => {
+      return _.flatMap(api.controllers, (controller, controllerName) => {
+        return _.keys(controller).map((actionName) => {
+          return `api::${apiName}.${controllerName}.${actionName}`;
+        });
+      });
+    });
+
+    const pluginsActions = _.flatMap(strapi.plugins, (plugin, pluginName) => {
+      return _.flatMap(plugin.controllers, (controller, controllerName) => {
+        return _.keys(controller).map((actionName) => {
+          return `plugin::${pluginName}.${controllerName}.${actionName}`;
+        });
+      });
+    });
+
+    const allActions = [...appActions, ...pluginsActions];
+
+    const toDelete = _.difference(permissionsFoundInDB, allActions);
+
+    await Promise.all(
+      toDelete.map((action) => {
+        return strapi.query('plugin::users-permissions.permission').delete({ where: { action } });
+      })
+    );
+
+    if (permissionsFoundInDB.length === 0) {
+      // create default permissions
+      for (const role of roles) {
+        const toCreate = pipe(
+          filter(({ roleType }) => roleType === role.type || roleType === null),
+          map(prop('action'))
+        )(DEFAULT_PERMISSIONS);
+
+        await Promise.all(
+          toCreate.map((action) => {
+            return strapi.query('plugin::users-permissions.permission').create({
+              data: {
+                action,
+                role: role.id,
+              },
+            });
+          })
+        );
+      }
+    }
+  },
+
+  async initialize() {
+    const roleCount = await strapi.query('plugin::users-permissions.role').count();
+
+    if (roleCount === 0) {
+      await strapi.query('plugin::users-permissions.role').create({
+        data: {
+          name: 'Authenticated',
+          description: 'Default role given to authenticated user.',
+          type: 'authenticated',
+        },
+      });
+
+      await strapi.query('plugin::users-permissions.role').create({
+        data: {
+          name: 'Public',
+          description: 'Default role given to unauthenticated user.',
+          type: 'public',
+        },
+      });
+    }
+
+    return getService('users-permissions').syncPermissions();
+  },
+
+  async updateUserRole(user, role) {
+    return strapi
+      .query('plugin::users-permissions.user')
+      .update({ where: { id: user.id }, data: { role } });
+  },
+
+  template(layout, data) {
+    const compiledObject = _.template(layout);
+    return compiledObject(data);
+  },
+});

package/server/strategies/users-permissions.js

@@ -0,0 +1,114 @@
+'use strict';
+
+const { castArray, map, every, pipe } = require('lodash/fp');
+const { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;
+
+const { getService } = require('../utils');
+
+const getAdvancedSettings = () => {
+  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });
+};
+
+const authenticate = async (ctx) => {
+  try {
+    const token = await getService('jwt').getToken(ctx);
+
+    if (token) {
+      const { id } = token;
+
+      // Invalid token
+      if (id === undefined) {
+        return { authenticated: false };
+      }
+
+      const user = await getService('user').fetchAuthenticatedUser(id);
+
+      // No user associated to the token
+      if (!user) {
+        return { error: 'Invalid credentials' };
+      }
+
+      const advancedSettings = await getAdvancedSettings();
+
+      // User not confirmed
+      if (advancedSettings.email_confirmation && !user.confirmed) {
+        return { error: 'Invalid credentials' };
+      }
+
+      // User blocked
+      if (user.blocked) {
+        return { error: 'Invalid credentials' };
+      }
+
+      // Fetch user's permissions
+      const permissions = await Promise.resolve(user.role.id)
+        .then(getService('permission').findRolePermissions)
+        .then(map(getService('permission').toContentAPIPermission));
+
+      // Generate an ability (content API engine) based on the given permissions
+      const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);
+
+      ctx.state.user = user;
+
+      return {
+        authenticated: true,
+        credentials: user,
+        ability,
+      };
+    }
+
+    const publicPermissions = await getService('permission')
+      .findPublicPermissions()
+      .then(map(getService('permission').toContentAPIPermission));
+
+    if (publicPermissions.length === 0) {
+      return { authenticated: false };
+    }
+
+    const ability = await strapi.contentAPI.permissions.engine.generateAbility(publicPermissions);
+
+    return {
+      authenticated: true,
+      credentials: null,
+      ability,
+    };
+  } catch (err) {
+    return { authenticated: false };
+  }
+};
+
+const verify = async (auth, config) => {
+  const { credentials: user, ability } = auth;
+
+  if (!config.scope) {
+    if (!user) {
+      // A non authenticated user cannot access routes that do not have a scope
+      throw new UnauthorizedError();
+    } else {
+      // An authenticated user can access non scoped routes
+      return;
+    }
+  }
+
+  // If no ability have been generated, then consider auth is missing
+  if (!ability) {
+    throw new UnauthorizedError();
+  }
+
+  const isAllowed = pipe(
+    // Make sure we're dealing with an array
+    castArray,
+    // Transform the scope array into an action array
+    every((scope) => ability.can(scope))
+  )(config.scope);
+
+  if (!isAllowed) {
+    throw new ForbiddenError();
+  }
+};
+
+module.exports = {
+  name: 'users-permissions',
+  authenticate,
+  verify,
+};

package/server/utils/index.d.ts

@@ -0,0 +1,18 @@
+import * as usersPermissions from '../services/users-permissions';
+import * as user from '../services/user';
+import * as role from '../services/role';
+import * as jwt from '../services/jwt';
+import * as providers from '../services/providers';
+import * as permission from '../services/permission';
+
+type S = {
+  ['users-permissions']: typeof usersPermissions;
+  ['role']: typeof role;
+  user: typeof user;
+  jwt: typeof jwt;
+  providers: typeof providers;
+  ['providers-registry']: typeof providers;
+  permission: typeof permission;
+};
+
+export function getService<T extends keyof S>(name: T): ReturnType<S[T]>;

package/server/utils/index.js

@@ -0,0 +1,12 @@
+'use strict';
+
+const sanitize = require('./sanitize');
+
+const getService = (name) => {
+  return strapi.plugin('users-permissions').service(name);
+};
+
+module.exports = {
+  getService,
+  sanitize,
+};

package/server/utils/sanitize/index.js

@@ -0,0 +1,9 @@
+'use strict';
+
+const visitors = require('./visitors');
+const sanitizers = require('./sanitizers');
+
+module.exports = {
+  sanitizers,
+  visitors,
+};

package/server/utils/sanitize/sanitizers.js

@@ -0,0 +1,19 @@
+'use strict';
+
+const { curry } = require('lodash/fp');
+const { traverseEntity, pipeAsync } = require('@strapi/utils');
+
+const { removeUserRelationFromRoleEntities } = require('./visitors');
+
+const sanitizeUserRelationFromRoleEntities = curry((schema, entity) => {
+  return traverseEntity(removeUserRelationFromRoleEntities, { schema }, entity);
+});
+
+const defaultSanitizeOutput = curry((schema, entity) => {
+  return pipeAsync(sanitizeUserRelationFromRoleEntities(schema))(entity);
+});
+
+module.exports = {
+  sanitizeUserRelationFromRoleEntities,
+  defaultSanitizeOutput,
+};

package/server/utils/sanitize/visitors/index.js

@@ -0,0 +1,5 @@
+'use strict';
+
+module.exports = {
+  removeUserRelationFromRoleEntities: require('./remove-user-relation-from-role-entities'),
+};

package/server/utils/sanitize/visitors/remove-user-relation-from-role-entities.js

@@ -0,0 +1,11 @@
+'use strict';
+
+module.exports = ({ schema, key, attribute }, { remove }) => {
+  if (
+    attribute.type === 'relation' &&
+    attribute.target === 'plugin::users-permissions.user' &&
+    schema.uid === 'plugin::users-permissions.role'
+  ) {
+    remove(key);
+  }
+};

package/strapi-admin.js

@@ -0,0 +1,3 @@
+'use strict';
+
+module.exports = require('./admin/src').default;

package/strapi-server.js

@@ -0,0 +1,3 @@
+'use strict';
+
+module.exports = require('./server');