@strapi/plugin-users-permissions 0.0.0-4fc90398602f

package/server/graphql/mutations/crud/role/create-role.js

@@ -0,0 +1,34 @@
+'use strict';
+
+const { toPlainObject } = require('lodash/fp');
+
+const usersPermissionsRoleUID = 'plugin::users-permissions.role';
+
+module.exports = ({ nexus, strapi }) => {
+  const { getContentTypeInputName } = strapi.plugin('graphql').service('utils').naming;
+  const { nonNull } = nexus;
+
+  const roleContentType = strapi.getModel(usersPermissionsRoleUID);
+
+  const roleInputName = getContentTypeInputName(roleContentType);
+
+  return {
+    type: 'UsersPermissionsCreateRolePayload',
+
+    args: {
+      data: nonNull(roleInputName),
+    },
+
+    description: 'Create a new role',
+
+    async resolve(parent, args, context) {
+      const { koaContext } = context;
+
+      koaContext.request.body = toPlainObject(args.data);
+
+      await strapi.plugin('users-permissions').controller('role').createRole(koaContext);
+
+      return { ok: true };
+    },
+  };
+};

package/server/graphql/mutations/crud/role/delete-role.js

@@ -0,0 +1,25 @@
+'use strict';
+
+module.exports = ({ nexus, strapi }) => {
+  const { nonNull } = nexus;
+
+  return {
+    type: 'UsersPermissionsDeleteRolePayload',
+
+    args: {
+      id: nonNull('ID'),
+    },
+
+    description: 'Delete an existing role',
+
+    async resolve(parent, args, context) {
+      const { koaContext } = context;
+
+      koaContext.params = { role: args.id };
+
+      await strapi.plugin('users-permissions').controller('role').deleteRole(koaContext);
+
+      return { ok: true };
+    },
+  };
+};

package/server/graphql/mutations/crud/role/update-role.js

@@ -0,0 +1,35 @@
+'use strict';
+
+const usersPermissionsRoleUID = 'plugin::users-permissions.role';
+
+module.exports = ({ nexus, strapi }) => {
+  const { getContentTypeInputName } = strapi.plugin('graphql').service('utils').naming;
+  const { nonNull } = nexus;
+
+  const roleContentType = strapi.getModel(usersPermissionsRoleUID);
+
+  const roleInputName = getContentTypeInputName(roleContentType);
+
+  return {
+    type: 'UsersPermissionsUpdateRolePayload',
+
+    args: {
+      id: nonNull('ID'),
+      data: nonNull(roleInputName),
+    },
+
+    description: 'Update an existing role',
+
+    async resolve(parent, args, context) {
+      const { koaContext } = context;
+
+      koaContext.params = { role: args.id };
+      koaContext.request.body = args.data;
+      koaContext.request.body.role = args.id;
+
+      await strapi.plugin('users-permissions').controller('role').updateRole(koaContext);
+
+      return { ok: true };
+    },
+  };
+};

package/server/graphql/mutations/crud/user/create-user.js

@@ -0,0 +1,45 @@
+'use strict';
+
+const { toPlainObject } = require('lodash/fp');
+
+const { checkBadRequest } = require('../../../utils');
+
+const usersPermissionsUserUID = 'plugin::users-permissions.user';
+
+module.exports = ({ nexus, strapi }) => {
+  const { nonNull } = nexus;
+  const { getContentTypeInputName, getEntityResponseName } = strapi
+    .plugin('graphql')
+    .service('utils').naming;
+
+  const userContentType = strapi.getModel(usersPermissionsUserUID);
+
+  const userInputName = getContentTypeInputName(userContentType);
+  const responseName = getEntityResponseName(userContentType);
+
+  return {
+    type: nonNull(responseName),
+
+    args: {
+      data: nonNull(userInputName),
+    },
+
+    description: 'Create a new user',
+
+    async resolve(parent, args, context) {
+      const { koaContext } = context;
+
+      koaContext.params = {};
+      koaContext.request.body = toPlainObject(args.data);
+
+      await strapi.plugin('users-permissions').controller('user').create(koaContext);
+
+      checkBadRequest(koaContext.body);
+
+      return {
+        value: koaContext.body,
+        info: { args, resourceUID: 'plugin::users-permissions.user' },
+      };
+    },
+  };
+};

package/server/graphql/mutations/crud/user/delete-user.js

@@ -0,0 +1,39 @@
+'use strict';
+
+const { checkBadRequest } = require('../../../utils');
+
+const usersPermissionsUserUID = 'plugin::users-permissions.user';
+
+module.exports = ({ nexus, strapi }) => {
+  const { nonNull } = nexus;
+  const { getEntityResponseName } = strapi.plugin('graphql').service('utils').naming;
+
+  const userContentType = strapi.getModel(usersPermissionsUserUID);
+
+  const responseName = getEntityResponseName(userContentType);
+
+  return {
+    type: nonNull(responseName),
+
+    args: {
+      id: nonNull('ID'),
+    },
+
+    description: 'Delete an existing user',
+
+    async resolve(parent, args, context) {
+      const { koaContext } = context;
+
+      koaContext.params = { id: args.id };
+
+      await strapi.plugin('users-permissions').controller('user').destroy(koaContext);
+
+      checkBadRequest(koaContext.body);
+
+      return {
+        value: koaContext.body,
+        info: { args, resourceUID: 'plugin::users-permissions.user' },
+      };
+    },
+  };
+};

package/server/graphql/mutations/crud/user/update-user.js

@@ -0,0 +1,46 @@
+'use strict';
+
+const { toPlainObject } = require('lodash/fp');
+
+const { checkBadRequest } = require('../../../utils');
+
+const usersPermissionsUserUID = 'plugin::users-permissions.user';
+
+module.exports = ({ nexus, strapi }) => {
+  const { nonNull } = nexus;
+  const { getContentTypeInputName, getEntityResponseName } = strapi
+    .plugin('graphql')
+    .service('utils').naming;
+
+  const userContentType = strapi.getModel(usersPermissionsUserUID);
+
+  const userInputName = getContentTypeInputName(userContentType);
+  const responseName = getEntityResponseName(userContentType);
+
+  return {
+    type: nonNull(responseName),
+
+    args: {
+      id: nonNull('ID'),
+      data: nonNull(userInputName),
+    },
+
+    description: 'Update an existing user',
+
+    async resolve(parent, args, context) {
+      const { koaContext } = context;
+
+      koaContext.params = { id: args.id };
+      koaContext.request.body = toPlainObject(args.data);
+
+      await strapi.plugin('users-permissions').controller('user').update(koaContext);
+
+      checkBadRequest(koaContext.body);
+
+      return {
+        value: koaContext.body,
+        info: { args, resourceUID: 'plugin::users-permissions.user' },
+      };
+    },
+  };
+};

package/server/graphql/mutations/index.js

@@ -0,0 +1,43 @@
+'use strict';
+
+const userUID = 'plugin::users-permissions.user';
+const roleUID = 'plugin::users-permissions.role';
+
+module.exports = (context) => {
+  const { nexus, strapi } = context;
+
+  const { naming } = strapi.plugin('graphql').service('utils');
+
+  const user = strapi.getModel(userUID);
+  const role = strapi.getModel(roleUID);
+
+  const mutations = {
+    // CRUD (user & role)
+    [naming.getCreateMutationTypeName(role)]: require('./crud/role/create-role'),
+    [naming.getUpdateMutationTypeName(role)]: require('./crud/role/update-role'),
+    [naming.getDeleteMutationTypeName(role)]: require('./crud/role/delete-role'),
+    [naming.getCreateMutationTypeName(user)]: require('./crud/user/create-user'),
+    [naming.getUpdateMutationTypeName(user)]: require('./crud/user/update-user'),
+    [naming.getDeleteMutationTypeName(user)]: require('./crud/user/delete-user'),
+
+    // Other mutations
+    login: require('./auth/login'),
+    register: require('./auth/register'),
+    forgotPassword: require('./auth/forgot-password'),
+    resetPassword: require('./auth/reset-password'),
+    changePassword: require('./auth/change-password'),
+    emailConfirmation: require('./auth/email-confirmation'),
+  };
+
+  return nexus.extendType({
+    type: 'Mutation',
+
+    definition(t) {
+      for (const [name, getConfig] of Object.entries(mutations)) {
+        const config = getConfig(context);
+
+        t.field(name, config);
+      }
+    },
+  });
+};

package/server/graphql/queries/index.js

@@ -0,0 +1,13 @@
+'use strict';
+
+const me = require('./me');
+
+module.exports = ({ nexus }) => {
+  return nexus.extendType({
+    type: 'Query',
+
+    definition(t) {
+      t.field('me', me({ nexus }));
+    },
+  });
+};

package/server/graphql/queries/me.js

@@ -0,0 +1,17 @@
+'use strict';
+
+module.exports = () => ({
+  type: 'UsersPermissionsMe',
+
+  args: {},
+
+  resolve(parent, args, context) {
+    const { user } = context.state;
+
+    if (!user) {
+      throw new Error('Authentication requested');
+    }
+
+    return user;
+  },
+});

package/server/graphql/resolvers-configs.js

@@ -0,0 +1,42 @@
+'use strict';
+
+const userUID = 'plugin::users-permissions.user';
+const roleUID = 'plugin::users-permissions.role';
+
+module.exports = ({ strapi }) => {
+  const { naming } = strapi.plugin('graphql').service('utils');
+
+  const user = strapi.getModel(userUID);
+  const role = strapi.getModel(roleUID);
+
+  const createRole = naming.getCreateMutationTypeName(role);
+  const updateRole = naming.getUpdateMutationTypeName(role);
+  const deleteRole = naming.getDeleteMutationTypeName(role);
+  const createUser = naming.getCreateMutationTypeName(user);
+  const updateUser = naming.getUpdateMutationTypeName(user);
+  const deleteUser = naming.getDeleteMutationTypeName(user);
+
+  return {
+    // Disabled auth for some operations
+    'Mutation.login': { auth: false },
+    'Mutation.register': { auth: false },
+    'Mutation.forgotPassword': { auth: false },
+    'Mutation.resetPassword': { auth: false },
+    'Mutation.emailConfirmation': { auth: false },
+    'Mutation.changePassword': {
+      auth: {
+        scope: 'plugin::users-permissions.auth.changePassword',
+      },
+    },
+
+    // Scoped auth for replaced CRUD operations
+    // Role
+    [`Mutation.${createRole}`]: { auth: { scope: [`${roleUID}.createRole`] } },
+    [`Mutation.${updateRole}`]: { auth: { scope: [`${roleUID}.updateRole`] } },
+    [`Mutation.${deleteRole}`]: { auth: { scope: [`${roleUID}.deleteRole`] } },
+    // User
+    [`Mutation.${createUser}`]: { auth: { scope: [`${userUID}.create`] } },
+    [`Mutation.${updateUser}`]: { auth: { scope: [`${userUID}.update`] } },
+    [`Mutation.${deleteUser}`]: { auth: { scope: [`${userUID}.destroy`] } },
+  };
+};

package/server/graphql/types/create-role-payload.js

@@ -0,0 +1,11 @@
+'use strict';
+
+module.exports = ({ nexus }) => {
+  return nexus.objectType({
+    name: 'UsersPermissionsCreateRolePayload',
+
+    definition(t) {
+      t.nonNull.boolean('ok');
+    },
+  });
+};

package/server/graphql/types/delete-role-payload.js

@@ -0,0 +1,11 @@
+'use strict';
+
+module.exports = ({ nexus }) => {
+  return nexus.objectType({
+    name: 'UsersPermissionsDeleteRolePayload',
+
+    definition(t) {
+      t.nonNull.boolean('ok');
+    },
+  });
+};

package/server/graphql/types/index.js

@@ -0,0 +1,21 @@
+'use strict';
+
+const typesFactories = [
+  require('./me'),
+  require('./me-role'),
+  require('./register-input'),
+  require('./login-input'),
+  require('./password-payload'),
+  require('./login-payload'),
+  require('./create-role-payload'),
+  require('./update-role-payload'),
+  require('./delete-role-payload'),
+];
+
+/**
+ * @param {object} context
+ * @param {object} context.nexus
+ * @param {object} context.strapi
+ * @return {any[]}
+ */
+module.exports = (context) => typesFactories.map((factory) => factory(context));

package/server/graphql/types/login-input.js

@@ -0,0 +1,13 @@
+'use strict';
+
+module.exports = ({ nexus }) => {
+  return nexus.inputObjectType({
+    name: 'UsersPermissionsLoginInput',
+
+    definition(t) {
+      t.nonNull.string('identifier');
+      t.nonNull.string('password');
+      t.nonNull.string('provider', { default: 'local' });
+    },
+  });
+};

package/server/graphql/types/login-payload.js

@@ -0,0 +1,12 @@
+'use strict';
+
+module.exports = ({ nexus }) => {
+  return nexus.objectType({
+    name: 'UsersPermissionsLoginPayload',
+
+    definition(t) {
+      t.string('jwt');
+      t.nonNull.field('user', { type: 'UsersPermissionsMe' });
+    },
+  });
+};

package/server/graphql/types/me-role.js

@@ -0,0 +1,14 @@
+'use strict';
+
+module.exports = ({ nexus }) => {
+  return nexus.objectType({
+    name: 'UsersPermissionsMeRole',
+
+    definition(t) {
+      t.nonNull.id('id');
+      t.nonNull.string('name');
+      t.string('description');
+      t.string('type');
+    },
+  });
+};

package/server/graphql/types/me.js

@@ -0,0 +1,16 @@
+'use strict';
+
+module.exports = ({ nexus }) => {
+  return nexus.objectType({
+    name: 'UsersPermissionsMe',
+
+    definition(t) {
+      t.nonNull.id('id');
+      t.nonNull.string('username');
+      t.string('email');
+      t.boolean('confirmed');
+      t.boolean('blocked');
+      t.field('role', { type: 'UsersPermissionsMeRole' });
+    },
+  });
+};

package/server/graphql/types/password-payload.js

@@ -0,0 +1,11 @@
+'use strict';
+
+module.exports = ({ nexus }) => {
+  return nexus.objectType({
+    name: 'UsersPermissionsPasswordPayload',
+
+    definition(t) {
+      t.nonNull.boolean('ok');
+    },
+  });
+};

package/server/graphql/types/register-input.js

@@ -0,0 +1,13 @@
+'use strict';
+
+module.exports = ({ nexus }) => {
+  return nexus.inputObjectType({
+    name: 'UsersPermissionsRegisterInput',
+
+    definition(t) {
+      t.nonNull.string('username');
+      t.nonNull.string('email');
+      t.nonNull.string('password');
+    },
+  });
+};

package/server/graphql/types/update-role-payload.js

@@ -0,0 +1,11 @@
+'use strict';
+
+module.exports = ({ nexus }) => {
+  return nexus.objectType({
+    name: 'UsersPermissionsUpdateRolePayload',
+
+    definition(t) {
+      t.nonNull.boolean('ok');
+    },
+  });
+};

package/server/graphql/utils.js

@@ -0,0 +1,27 @@
+'use strict';
+
+const { getOr } = require('lodash/fp');
+
+/**
+ * Throws an ApolloError if context body contains a bad request
+ * @param contextBody - body of the context object given to the resolver
+ * @throws ApolloError if the body is a bad request
+ */
+function checkBadRequest(contextBody) {
+  const statusCode = getOr(200, 'statusCode', contextBody);
+
+  if (statusCode !== 200) {
+    const errorMessage = getOr('Bad Request', 'error', contextBody);
+
+    const exception = new Error(errorMessage);
+
+    exception.code = statusCode || 400;
+    exception.data = contextBody;
+
+    throw exception;
+  }
+}
+
+module.exports = {
+  checkBadRequest,
+};

package/server/index.js

@@ -0,0 +1,21 @@
+'use strict';
+
+const register = require('./register');
+const bootstrap = require('./bootstrap');
+const contentTypes = require('./content-types');
+const middlewares = require('./middlewares');
+const services = require('./services');
+const routes = require('./routes');
+const controllers = require('./controllers');
+const config = require('./config');
+
+module.exports = () => ({
+  register,
+  bootstrap,
+  config,
+  routes,
+  controllers,
+  contentTypes,
+  middlewares,
+  services,
+});

package/server/middlewares/index.js

@@ -0,0 +1,7 @@
+'use strict';
+
+const rateLimit = require('./rateLimit');
+
+module.exports = {
+  rateLimit,
+};

package/server/middlewares/rateLimit.js

@@ -0,0 +1,27 @@
+'use strict';
+
+module.exports =
+  (config, { strapi }) =>
+  async (ctx, next) => {
+    const ratelimit = require('koa2-ratelimit').RateLimit;
+
+    const message = [
+      {
+        messages: [
+          {
+            id: 'Auth.form.error.ratelimit',
+            message: 'Too many attempts, please try again in a minute.',
+          },
+        ],
+      },
+    ];
+
+    return ratelimit.middleware({
+      interval: 1 * 60 * 1000,
+      max: 5,
+      prefixKey: `${ctx.request.path}:${ctx.request.ip}`,
+      message,
+      ...strapi.config.get('plugin.users-permissions.ratelimit'),
+      ...config,
+    })(ctx, next);
+  };

package/server/register.js

@@ -0,0 +1,23 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const authStrategy = require('./strategies/users-permissions');
+const sanitizers = require('./utils/sanitize/sanitizers');
+
+module.exports = ({ strapi }) => {
+  strapi.container.get('auth').register('content-api', authStrategy);
+  strapi.sanitizers.add('content-api.output', sanitizers.defaultSanitizeOutput);
+
+  if (strapi.plugin('graphql')) {
+    require('./graphql')({ strapi });
+  }
+
+  if (strapi.plugin('documentation')) {
+    const specPath = path.join(__dirname, '../documentation/content-api.yaml');
+    const spec = fs.readFileSync(specPath, 'utf8');
+
+    strapi.plugin('documentation').service('documentation').registerDoc(spec);
+  }
+};

package/server/routes/admin/index.js

@@ -0,0 +1,10 @@
+'use strict';
+
+const permissionsRoutes = require('./permissions');
+const settingsRoutes = require('./settings');
+const roleRoutes = require('./role');
+
+module.exports = {
+  type: 'admin',
+  routes: [...roleRoutes, ...settingsRoutes, ...permissionsRoutes],
+};

package/server/routes/admin/permissions.js

@@ -0,0 +1,20 @@
+'use strict';
+
+module.exports = [
+  {
+    method: 'GET',
+    path: '/permissions',
+    handler: 'permissions.getPermissions',
+  },
+  {
+    method: 'GET',
+    path: '/policies',
+    handler: 'permissions.getPolicies',
+  },
+
+  {
+    method: 'GET',
+    path: '/routes',
+    handler: 'permissions.getRoutes',
+  },
+];