@strapi/plugin-users-permissions 0.0.0-4fc90398602f

package/server/services/providers-registry.js

@@ -0,0 +1,292 @@
+'use strict';
+
+const { strict: assert } = require('assert');
+const jwt = require('jsonwebtoken');
+
+const getInitialProviders = ({ purest }) => ({
+  async discord({ accessToken }) {
+    const discord = purest({ provider: 'discord' });
+    return discord
+      .get('users/@me')
+      .auth(accessToken)
+      .request()
+      .then(({ body }) => {
+        // Combine username and discriminator because discord username is not unique
+        const username = `${body.username}#${body.discriminator}`;
+        return {
+          username,
+          email: body.email,
+        };
+      });
+  },
+  async cognito({ query }) {
+    // get the id_token
+    const idToken = query.id_token;
+    // decode the jwt token
+    const tokenPayload = jwt.decode(idToken);
+    if (!tokenPayload) {
+      throw new Error('unable to decode jwt token');
+    } else {
+      return {
+        username: tokenPayload['cognito:username'],
+        email: tokenPayload.email,
+      };
+    }
+  },
+  async facebook({ accessToken }) {
+    const facebook = purest({ provider: 'facebook' });
+
+    return facebook
+      .get('me')
+      .auth(accessToken)
+      .qs({ fields: 'name,email' })
+      .request()
+      .then(({ body }) => ({
+        username: body.name,
+        email: body.email,
+      }));
+  },
+  async google({ accessToken }) {
+    const google = purest({ provider: 'google' });
+
+    return google
+      .query('oauth')
+      .get('tokeninfo')
+      .qs({ accessToken })
+      .request()
+      .then(({ body }) => ({
+        username: body.email.split('@')[0],
+        email: body.email,
+      }));
+  },
+  async github({ accessToken }) {
+    const github = purest({
+      provider: 'github',
+      defaults: {
+        headers: {
+          'user-agent': 'strapi',
+        },
+      },
+    });
+
+    const { body: userBody } = await github.get('user').auth(accessToken).request();
+
+    // This is the public email on the github profile
+    if (userBody.email) {
+      return {
+        username: userBody.login,
+        email: userBody.email,
+      };
+    }
+    // Get the email with Github's user/emails API
+    const { body: emailBody } = await github.get('user/emails').auth(accessToken).request();
+
+    return {
+      username: userBody.login,
+      email: Array.isArray(emailBody)
+        ? emailBody.find((email) => email.primary === true).email
+        : null,
+    };
+  },
+  async microsoft({ accessToken }) {
+    const microsoft = purest({ provider: 'microsoft' });
+
+    return microsoft
+      .get('me')
+      .auth(accessToken)
+      .request()
+      .then(({ body }) => ({
+        username: body.userPrincipalName,
+        email: body.userPrincipalName,
+      }));
+  },
+  async twitter({ accessToken, query, providers }) {
+    const twitter = purest({
+      provider: 'twitter',
+      defaults: {
+        oauth: {
+          consumer_key: providers.twitter.key,
+          consumer_secret: providers.twitter.secret,
+        },
+      },
+    });
+
+    return twitter
+      .get('account/verify_credentials')
+      .auth(accessToken, query.access_secret)
+      .qs({ screen_name: query['raw[screen_name]'], include_email: 'true' })
+      .request()
+      .then(({ body }) => ({
+        username: body.screen_name,
+        email: body.email,
+      }));
+  },
+  async instagram({ accessToken }) {
+    const instagram = purest({ provider: 'instagram' });
+
+    return instagram
+      .get('me')
+      .auth(accessToken)
+      .qs({ fields: 'id,username' })
+      .request()
+      .then(({ body }) => ({
+        username: body.username,
+        email: `${body.username}@strapi.io`, // dummy email as Instagram does not provide user email
+      }));
+  },
+  async vk({ accessToken, query }) {
+    const vk = purest({ provider: 'vk' });
+
+    return vk
+      .get('users.get')
+      .auth(accessToken)
+      .qs({ id: query.raw.user_id, v: '5.122' })
+      .request()
+      .then(({ body }) => ({
+        username: `${body.response[0].last_name} ${body.response[0].first_name}`,
+        email: query.raw.email,
+      }));
+  },
+  async twitch({ accessToken, providers }) {
+    const twitch = purest({
+      provider: 'twitch',
+      config: {
+        twitch: {
+          default: {
+            origin: 'https://api.twitch.tv',
+            path: 'helix/{path}',
+            headers: {
+              Authorization: 'Bearer {auth}',
+              'Client-Id': '{auth}',
+            },
+          },
+        },
+      },
+    });
+
+    return twitch
+      .get('users')
+      .auth(accessToken, providers.twitch.key)
+      .request()
+      .then(({ body }) => ({
+        username: body.data[0].login,
+        email: body.data[0].email,
+      }));
+  },
+  async linkedin({ accessToken }) {
+    const linkedIn = purest({ provider: 'linkedin' });
+    const {
+      body: { localizedFirstName },
+    } = await linkedIn.get('me').auth(accessToken).request();
+    const {
+      body: { elements },
+    } = await linkedIn
+      .get('emailAddress?q=members&projection=(elements*(handle~))')
+      .auth(accessToken)
+      .request();
+
+    const email = elements[0]['handle~'];
+
+    return {
+      username: localizedFirstName,
+      email: email.emailAddress,
+    };
+  },
+  async reddit({ accessToken }) {
+    const reddit = purest({
+      provider: 'reddit',
+      config: {
+        reddit: {
+          default: {
+            origin: 'https://oauth.reddit.com',
+            path: 'api/{version}/{path}',
+            version: 'v1',
+            headers: {
+              Authorization: 'Bearer {auth}',
+              'user-agent': 'strapi',
+            },
+          },
+        },
+      },
+    });
+
+    return reddit
+      .get('me')
+      .auth(accessToken)
+      .request()
+      .then(({ body }) => ({
+        username: body.name,
+        email: `${body.name}@strapi.io`, // dummy email as Reddit does not provide user email
+      }));
+  },
+  async auth0({ accessToken, providers }) {
+    const auth0 = purest({ provider: 'auth0' });
+
+    return auth0
+      .get('userinfo')
+      .subdomain(providers.auth0.subdomain)
+      .auth(accessToken)
+      .request()
+      .then(({ body }) => {
+        const username = body.username || body.nickname || body.name || body.email.split('@')[0];
+        const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
+
+        return {
+          username,
+          email,
+        };
+      });
+  },
+  async cas({ accessToken, providers }) {
+    const cas = purest({ provider: 'cas' });
+
+    return cas
+      .get('oidc/profile')
+      .subdomain(providers.cas.subdomain)
+      .auth(accessToken)
+      .request()
+      .then(({ body }) => {
+        // CAS attribute may be in body.attributes or "FLAT", depending on CAS config
+        const username = body.attributes
+          ? body.attributes.strapiusername || body.id || body.sub
+          : body.strapiusername || body.id || body.sub;
+        const email = body.attributes
+          ? body.attributes.strapiemail || body.attributes.email
+          : body.strapiemail || body.email;
+        if (!username || !email) {
+          strapi.log.warn(
+            `CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`
+          );
+        }
+        return {
+          username,
+          email,
+        };
+      });
+  },
+});
+
+module.exports = () => {
+  const purest = require('purest');
+
+  const providersCallbacks = getInitialProviders({ purest });
+
+  return {
+    register(providerName, provider) {
+      assert(typeof providerName === 'string', 'Provider name must be a string');
+      assert(typeof provider === 'function', 'Provider callback must be a function');
+
+      providersCallbacks[providerName] = provider({ purest });
+    },
+
+    async run({ provider, accessToken, query, providers }) {
+      if (!providersCallbacks[provider]) {
+        throw new Error('Unknown provider.');
+      }
+
+      const providerCb = providersCallbacks[provider];
+
+      return providerCb({ accessToken, query, providers });
+    },
+  };
+};

package/server/services/providers.js

@@ -0,0 +1,115 @@
+'use strict';
+
+/**
+ * Module dependencies.
+ */
+
+// Public node modules.
+const _ = require('lodash');
+const urlJoin = require('url-join');
+
+const { getAbsoluteServerUrl } = require('@strapi/utils');
+const { getService } = require('../utils');
+
+module.exports = ({ strapi }) => {
+  /**
+   * Helper to get profiles
+   *
+   * @param {String}   provider
+   */
+
+  const getProfile = async (provider, query) => {
+    const accessToken = query.access_token || query.code || query.oauth_token;
+
+    const providers = await strapi
+      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })
+      .get();
+
+    return getService('providers-registry').run({
+      provider,
+      query,
+      accessToken,
+      providers,
+    });
+  };
+
+  /**
+   * Connect thanks to a third-party provider.
+   *
+   *
+   * @param {String}    provider
+   * @param {String}    accessToken
+   *
+   * @return  {*}
+   */
+
+  const connect = async (provider, query) => {
+    const accessToken = query.access_token || query.code || query.oauth_token;
+
+    if (!accessToken) {
+      throw new Error('No access_token.');
+    }
+
+    // Get the profile.
+    const profile = await getProfile(provider, query);
+
+    const email = _.toLower(profile.email);
+
+    // We need at least the mail.
+    if (!email) {
+      throw new Error('Email was not available.');
+    }
+
+    const users = await strapi.query('plugin::users-permissions.user').findMany({
+      where: { email },
+    });
+
+    const advancedSettings = await strapi
+      .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })
+      .get();
+
+    const user = _.find(users, { provider });
+
+    if (_.isEmpty(user) && !advancedSettings.allow_register) {
+      throw new Error('Register action is actually not available.');
+    }
+
+    if (!_.isEmpty(user)) {
+      return user;
+    }
+
+    if (users.length > 1 && advancedSettings.unique_email) {
+      throw new Error('Email is already taken.');
+    }
+
+    // Retrieve default role.
+    const defaultRole = await strapi
+      .query('plugin::users-permissions.role')
+      .findOne({ where: { type: advancedSettings.default_role } });
+
+    // Create the new user.
+    const newUser = {
+      ...profile,
+      email, // overwrite with lowercased email
+      provider,
+      role: defaultRole.id,
+      confirmed: true,
+    };
+
+    const createdUser = await strapi
+      .query('plugin::users-permissions.user')
+      .create({ data: newUser });
+
+    return createdUser;
+  };
+
+  const buildRedirectUri = (provider = '') => {
+    const apiPrefix = strapi.config.get('api.rest.prefix');
+    return urlJoin(getAbsoluteServerUrl(strapi.config), apiPrefix, 'connect', provider, 'callback');
+  };
+
+  return {
+    connect,
+    buildRedirectUri,
+  };
+};

package/server/services/role.js

@@ -0,0 +1,177 @@
+'use strict';
+
+const _ = require('lodash');
+const { NotFoundError } = require('@strapi/utils').errors;
+const { getService } = require('../utils');
+
+module.exports = ({ strapi }) => ({
+  async createRole(params) {
+    if (!params.type) {
+      params.type = _.snakeCase(_.deburr(_.toLower(params.name)));
+    }
+
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .create({ data: _.omit(params, ['users', 'permissions']) });
+
+    const createPromises = _.flatMap(params.permissions, (type, typeName) => {
+      return _.flatMap(type.controllers, (controller, controllerName) => {
+        return _.reduce(
+          controller,
+          (acc, action, actionName) => {
+            const { enabled /* policy */ } = action;
+
+            if (enabled) {
+              const actionID = `${typeName}.${controllerName}.${actionName}`;
+
+              acc.push(
+                strapi
+                  .query('plugin::users-permissions.permission')
+                  .create({ data: { action: actionID, role: role.id } })
+              );
+            }
+
+            return acc;
+          },
+          []
+        );
+      });
+    });
+
+    await Promise.all(createPromises);
+  },
+
+  async findOne(roleID) {
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .findOne({ where: { id: roleID }, populate: ['permissions'] });
+
+    if (!role) {
+      throw new NotFoundError('Role not found');
+    }
+
+    const allActions = getService('users-permissions').getActions();
+
+    // Group by `type`.
+    role.permissions.forEach((permission) => {
+      const [type, controller, action] = permission.action.split('.');
+
+      _.set(allActions, `${type}.controllers.${controller}.${action}`, {
+        enabled: true,
+        policy: '',
+      });
+    });
+
+    return {
+      ...role,
+      permissions: allActions,
+    };
+  },
+
+  async find() {
+    const roles = await strapi.query('plugin::users-permissions.role').findMany({ sort: ['name'] });
+
+    for (const role of roles) {
+      role.nb_users = await strapi
+        .query('plugin::users-permissions.user')
+        .count({ where: { role: { id: role.id } } });
+    }
+
+    return roles;
+  },
+
+  async updateRole(roleID, data) {
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .findOne({ where: { id: roleID }, populate: ['permissions'] });
+
+    if (!role) {
+      throw new NotFoundError('Role not found');
+    }
+
+    await strapi.query('plugin::users-permissions.role').update({
+      where: { id: roleID },
+      data: _.pick(data, ['name', 'description']),
+    });
+
+    const { permissions } = data;
+
+    const newActions = _.flatMap(permissions, (type, typeName) => {
+      return _.flatMap(type.controllers, (controller, controllerName) => {
+        return _.reduce(
+          controller,
+          (acc, action, actionName) => {
+            const { enabled /* policy */ } = action;
+
+            if (enabled) {
+              acc.push(`${typeName}.${controllerName}.${actionName}`);
+            }
+
+            return acc;
+          },
+          []
+        );
+      });
+    });
+
+    const oldActions = role.permissions.map(({ action }) => action);
+
+    const toDelete = role.permissions.reduce((acc, permission) => {
+      if (!newActions.includes(permission.action)) {
+        acc.push(permission);
+      }
+      return acc;
+    }, []);
+
+    const toCreate = newActions
+      .filter((action) => !oldActions.includes(action))
+      .map((action) => ({ action, role: role.id }));
+
+    await Promise.all(
+      toDelete.map((permission) =>
+        strapi
+          .query('plugin::users-permissions.permission')
+          .delete({ where: { id: permission.id } })
+      )
+    );
+
+    await Promise.all(
+      toCreate.map((permissionInfo) =>
+        strapi.query('plugin::users-permissions.permission').create({ data: permissionInfo })
+      )
+    );
+  },
+
+  async deleteRole(roleID, publicRoleID) {
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .findOne({ where: { id: roleID }, populate: ['users', 'permissions'] });
+
+    if (!role) {
+      throw new NotFoundError('Role not found');
+    }
+
+    // Move users to guest role.
+    await Promise.all(
+      role.users.map((user) => {
+        return strapi.query('plugin::users-permissions.user').update({
+          where: { id: user.id },
+          data: { role: publicRoleID },
+        });
+      })
+    );
+
+    // Remove permissions related to this role.
+    // TODO: use delete many
+    await Promise.all(
+      role.permissions.map((permission) => {
+        return strapi.query('plugin::users-permissions.permission').delete({
+          where: { id: permission.id },
+        });
+      })
+    );
+
+    // Delete the role.
+    await strapi.query('plugin::users-permissions.role').delete({ where: { id: roleID } });
+  },
+});