@strapi/plugin-users-permissions 0.0.0-experimental.62ce06180fe9a772eaeb3d43d238b26644f39f7c → 0.0.0-experimental.6340da17068c3bed7fb006e7bcc554c71129e282

package/server/routes/content-api/validation.js

@@ -0,0 +1,280 @@
+'use strict';
+
+const { AbstractRouteValidator } = require('@strapi/utils');
+const z = require('zod/v4');
+
+// A single role relation entry, referenced by numeric `id` (legacy) or by
+// `documentId` (the v5 default), but must carry at least one of them. The
+// detailed rules (min one role on create, cannot remove the last role on
+// update) stay in the Yup controller validator.
+const roleRelationEntry = z
+  .object({
+    id: z.union([z.number(), z.string()]).optional(),
+    documentId: z.string().optional(),
+  })
+  .refine((entry) => entry.id != null || entry.documentId != null, {
+    message: 'Relation entry must include an id or documentId',
+  });
+
+// The `role` relation input: shorthand scalar (numeric id or documentId) or the
+// longhand connect/disconnect object, matching every other v5 relation. The
+// object form must carry at least one of connect/disconnect (an empty object is
+// a no-op and almost certainly a mistake).
+const roleRelationInput = z.union([
+  z.number(),
+  z.string(),
+  z
+    .object({
+      connect: z.array(roleRelationEntry).optional(),
+      disconnect: z.array(roleRelationEntry).optional(),
+    })
+    .refine((input) => input.connect != null || input.disconnect != null, {
+      message: 'Relation input must include connect or disconnect',
+    }),
+]);
+
+class UsersPermissionsRouteValidator extends AbstractRouteValidator {
+  constructor(strapi) {
+    super();
+    this._strapi = strapi;
+  }
+
+  get userSchema() {
+    return z.object({
+      id: z.number(),
+      documentId: z.string(),
+      username: z.string(),
+      email: z.string(),
+      provider: z.string(),
+      confirmed: z.boolean(),
+      blocked: z.boolean(),
+      role: z
+        .union([
+          z.number(),
+          z.object({
+            id: z.number(),
+            name: z.string(),
+            description: z.string().nullable(),
+            type: z.string(),
+            createdAt: z.string(),
+            updatedAt: z.string(),
+          }),
+        ])
+        .optional(),
+      createdAt: z.string(),
+      updatedAt: z.string(),
+      publishedAt: z.string(),
+    });
+  }
+
+  get roleSchema() {
+    return z.object({
+      id: z.number(),
+      documentId: z.string(),
+      name: z.string(),
+      description: z.string().nullable(),
+      type: z.string(),
+      createdAt: z.string(),
+      updatedAt: z.string(),
+      publishedAt: z.string(),
+      nb_users: z.number().optional(),
+      permissions: z
+        .record(
+          z.string(), // plugin name
+          z.object({
+            controllers: z.record(
+              z.string(), // controller name
+              z.record(
+                z.string(), // action name
+                z.object({
+                  enabled: z.boolean(),
+                  policy: z.string(),
+                })
+              )
+            ),
+          })
+        )
+        .optional(),
+      users: z.array(z.unknown()).optional(),
+    });
+  }
+
+  get permissionSchema() {
+    return z.object({
+      id: z.number(),
+      action: z.string(),
+      role: z.object({
+        id: z.number(),
+        name: z.string(),
+        description: z.string().nullable(),
+        type: z.string(),
+      }),
+      createdAt: z.string(),
+      updatedAt: z.string(),
+    });
+  }
+
+  get authResponseSchema() {
+    return z.object({
+      jwt: z.string(),
+      refreshToken: z.string().optional(),
+      user: this.userSchema,
+    });
+  }
+
+  get authResponseWithoutJwtSchema() {
+    return z.object({
+      user: this.userSchema,
+    });
+  }
+
+  get authRegisterResponseSchema() {
+    return z.union([this.authResponseSchema, this.authResponseWithoutJwtSchema]);
+  }
+
+  get forgotPasswordResponseSchema() {
+    return z.object({
+      ok: z.boolean(),
+    });
+  }
+
+  get sendEmailConfirmationResponseSchema() {
+    return z.object({
+      email: z.string(),
+      sent: z.boolean(),
+    });
+  }
+
+  get rolesResponseSchema() {
+    return z.object({
+      roles: z.array(this.roleSchema),
+    });
+  }
+
+  get roleResponseSchema() {
+    return z.object({
+      role: this.roleSchema,
+    });
+  }
+
+  get roleSuccessResponseSchema() {
+    return z.object({
+      ok: z.boolean(),
+    });
+  }
+
+  get permissionsResponseSchema() {
+    return z.object({
+      permissions: z.record(
+        z.string(), // plugin name
+        z.object({
+          controllers: z.record(
+            z.string(), // controller name
+            z.record(
+              z.string(), // action name
+              z.object({
+                enabled: z.boolean(),
+                policy: z.string(),
+              })
+            )
+          ),
+        })
+      ),
+    });
+  }
+
+  get loginBodySchema() {
+    return z.object({
+      identifier: z.string(),
+      password: z.string(),
+    });
+  }
+
+  get registerBodySchema() {
+    return z.object({
+      username: z.string(),
+      email: z.email(),
+      password: z.string(),
+    });
+  }
+
+  get forgotPasswordBodySchema() {
+    return z.object({
+      email: z.email(),
+    });
+  }
+
+  get resetPasswordBodySchema() {
+    return z.object({
+      code: z.string(),
+      password: z.string(),
+      passwordConfirmation: z.string(),
+    });
+  }
+
+  get changePasswordBodySchema() {
+    return z.object({
+      currentPassword: z.string(),
+      password: z.string(),
+      passwordConfirmation: z.string(),
+    });
+  }
+
+  get sendEmailConfirmationBodySchema() {
+    return z.object({
+      email: z.email(),
+    });
+  }
+
+  get createUserBodySchema() {
+    return z.object({
+      username: z.string(),
+      email: z.email(),
+      password: z.string(),
+      role: roleRelationInput.optional(),
+    });
+  }
+
+  get updateUserBodySchema() {
+    return z.object({
+      username: z.string().optional(),
+      email: z.email().optional(),
+      password: z.string().optional(),
+      role: roleRelationInput.optional(),
+    });
+  }
+
+  get createRoleBodySchema() {
+    return z.object({
+      name: z.string(),
+      description: z.string().optional(),
+      type: z.string(),
+      permissions: z.record(z.string(), z.unknown()).optional(),
+    });
+  }
+
+  get updateRoleBodySchema() {
+    return z.object({
+      name: z.string().optional(),
+      description: z.string().optional(),
+      type: z.string().optional(),
+      permissions: z.record(z.string(), z.unknown()).optional(),
+    });
+  }
+
+  get userIdParam() {
+    return z.string();
+  }
+
+  get roleIdParam() {
+    return z.string();
+  }
+
+  get providerParam() {
+    return z.string();
+  }
+}
+
+module.exports = {
+  UsersPermissionsRouteValidator,
+};

package/server/services/constants.js

@@ -0,0 +1,9 @@
+'use strict';
+
+module.exports = {
+  DEFAULT_ACCESS_TOKEN_LIFESPAN: 10 * 60, // 10 minutes
+  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN: 30 * 24 * 60 * 60, // 30 days
+  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN: 14 * 24 * 60 * 60, // 14 days
+  DEFAULT_MAX_SESSION_LIFESPAN: 1 * 24 * 60 * 60, // 1 day
+  DEFAULT_IDLE_SESSION_LIFESPAN: 2 * 60 * 60, // 2 hours
+};

package/server/services/jwt.js

@@ -29,6 +29,32 @@ module.exports = ({ strapi }) => ({
   },
 
   issue(payload, jwtOptions = {}) {
+    const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+
+    if (mode === 'refresh') {
+      const userId = String(payload.id ?? payload.userId ?? '');
+      if (!userId) {
+        throw new Error('Cannot issue token: missing user id');
+      }
+
+      const issueRefreshToken = async () => {
+        const refresh = await strapi
+          .sessionManager('users-permissions')
+          .generateRefreshToken(userId, undefined, { type: 'refresh' });
+
+        const access = await strapi
+          .sessionManager('users-permissions')
+          .generateAccessToken(refresh.token);
+        if ('error' in access) {
+          throw new Error('Failed to generate access token');
+        }
+
+        return access.token;
+      };
+
+      return issueRefreshToken();
+    }
+
     _.defaults(jwtOptions, strapi.config.get('plugin::users-permissions.jwt'));
     return jwt.sign(
       _.clone(payload.toJSON ? payload.toJSON() : payload),
@@ -37,12 +63,35 @@ module.exports = ({ strapi }) => ({
     );
   },
 
-  verify(token) {
+  async verify(token) {
+    const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+
+    if (mode === 'refresh') {
+      // Accept only access tokens minted by the SessionManager for UP
+      const result = strapi.sessionManager('users-permissions').validateAccessToken(token);
+      if (!result.isValid || result.payload.type !== 'access') {
+        throw new Error('Invalid token.');
+      }
+
+      const user = await strapi.db
+        .query('plugin::users-permissions.user')
+        .findOne({ where: { id: Number(result.payload.userId) || result.payload.userId } });
+      if (!user) {
+        throw new Error('Invalid token.');
+      }
+
+      // Surface the sessionId so the strategy can flag the "current" session.
+      return { id: user.id, sessionId: result.payload.sessionId };
+    }
+
     return new Promise((resolve, reject) => {
+      const jwtConfig = strapi.config.get('plugin::users-permissions.jwt', {});
+      const algorithms = [jwtConfig?.algorithm || 'HS256'];
+
       jwt.verify(
         token,
         strapi.config.get('plugin::users-permissions.jwtSecret'),
-        {},
+        { algorithms },
         (err, tokenPayload = {}) => {
           if (err) {
             return reject(new Error('Invalid token.'));