@strapi/plugin-users-permissions 0.0.0-experimental.62ebf57bb35846666febb5ee2078fe02fe990f57 → 0.0.0-experimental.6340da17068c3bed7fb006e7bcc554c71129e282

package/server/services/providers.js

@@ -8,8 +8,7 @@
 const _ = require('lodash');
 const urlJoin = require('url-join');
 
-const { getAbsoluteServerUrl } = require('@strapi/utils');
-const { getService } = require('../utils');
+const { getService, findValidUsername } = require('../utils');
 
 module.exports = ({ strapi }) => {
   /**
@@ -60,7 +59,7 @@ module.exports = ({ strapi }) => {
       throw new Error('Email was not available.');
     }
 
-    const users = await strapi.query('plugin::users-permissions.user').findMany({
+    const users = await strapi.db.query('plugin::users-permissions.user').findMany({
       where: { email },
     });
 
@@ -83,20 +82,25 @@ module.exports = ({ strapi }) => {
     }
 
     // Retrieve default role.
-    const defaultRole = await strapi
+    const defaultRole = await strapi.db
       .query('plugin::users-permissions.role')
       .findOne({ where: { type: advancedSettings.default_role } });
 
+    // Username: prefer profile, else email prefix; findValidUsername ensures valid + unique
+    const base = (profile.username && profile.username.trim()) || email.split('@')[0];
+    const username = await findValidUsername(base);
+
     // Create the new user.
     const newUser = {
       ...profile,
+      username, // use the generated or provided username
       email, // overwrite with lowercased email
       provider,
       role: defaultRole.id,
       confirmed: true,
     };
 
-    const createdUser = await strapi
+    const createdUser = await strapi.db
       .query('plugin::users-permissions.user')
       .create({ data: newUser });
 
@@ -105,7 +109,13 @@ module.exports = ({ strapi }) => {
 
   const buildRedirectUri = (provider = '') => {
     const apiPrefix = strapi.config.get('api.rest.prefix');
-    return urlJoin(getAbsoluteServerUrl(strapi.config), apiPrefix, 'connect', provider, 'callback');
+    return urlJoin(
+      strapi.config.get('server.absoluteUrl'),
+      apiPrefix,
+      'connect',
+      provider,
+      'callback'
+    );
   };
 
   return {

package/server/services/role.js

@@ -10,7 +10,7 @@ module.exports = ({ strapi }) => ({
       params.type = _.snakeCase(_.deburr(_.toLower(params.name)));
     }
 
-    const role = await strapi
+    const role = await strapi.db
       .query('plugin::users-permissions.role')
       .create({ data: _.omit(params, ['users', 'permissions']) });
 
@@ -25,7 +25,7 @@ module.exports = ({ strapi }) => ({
               const actionID = `${typeName}.${controllerName}.${actionName}`;
 
               acc.push(
-                strapi
+                strapi.db
                   .query('plugin::users-permissions.permission')
                   .create({ data: { action: actionID, role: role.id } })
               );
@@ -42,7 +42,7 @@ module.exports = ({ strapi }) => ({
   },
 
   async findOne(roleID) {
-    const role = await strapi
+    const role = await strapi.db
       .query('plugin::users-permissions.role')
       .findOne({ where: { id: roleID }, populate: ['permissions'] });
 
@@ -69,10 +69,12 @@ module.exports = ({ strapi }) => ({
   },
 
   async find() {
-    const roles = await strapi.query('plugin::users-permissions.role').findMany({ sort: ['name'] });
+    const roles = await strapi.db
+      .query('plugin::users-permissions.role')
+      .findMany({ sort: ['name'] });
 
     for (const role of roles) {
-      role.nb_users = await strapi
+      role.nb_users = await strapi.db
         .query('plugin::users-permissions.user')
         .count({ where: { role: { id: role.id } } });
     }
@@ -81,7 +83,7 @@ module.exports = ({ strapi }) => ({
   },
 
   async updateRole(roleID, data) {
-    const role = await strapi
+    const role = await strapi.db
       .query('plugin::users-permissions.role')
       .findOne({ where: { id: roleID }, populate: ['permissions'] });
 
@@ -89,7 +91,7 @@ module.exports = ({ strapi }) => ({
       throw new NotFoundError('Role not found');
     }
 
-    await strapi.query('plugin::users-permissions.role').update({
+    await strapi.db.query('plugin::users-permissions.role').update({
       where: { id: roleID },
       data: _.pick(data, ['name', 'description']),
     });
@@ -129,7 +131,7 @@ module.exports = ({ strapi }) => ({
 
     await Promise.all(
       toDelete.map((permission) =>
-        strapi
+        strapi.db
           .query('plugin::users-permissions.permission')
           .delete({ where: { id: permission.id } })
       )
@@ -137,13 +139,13 @@ module.exports = ({ strapi }) => ({
 
     await Promise.all(
       toCreate.map((permissionInfo) =>
-        strapi.query('plugin::users-permissions.permission').create({ data: permissionInfo })
+        strapi.db.query('plugin::users-permissions.permission').create({ data: permissionInfo })
       )
     );
   },
 
   async deleteRole(roleID, publicRoleID) {
-    const role = await strapi
+    const role = await strapi.db
       .query('plugin::users-permissions.role')
       .findOne({ where: { id: roleID }, populate: ['users', 'permissions'] });
 
@@ -154,7 +156,7 @@ module.exports = ({ strapi }) => ({
     // Move users to guest role.
     await Promise.all(
       role.users.map((user) => {
-        return strapi.query('plugin::users-permissions.user').update({
+        return strapi.db.query('plugin::users-permissions.user').update({
           where: { id: user.id },
           data: { role: publicRoleID },
         });
@@ -165,13 +167,13 @@ module.exports = ({ strapi }) => ({
     // TODO: use delete many
     await Promise.all(
       role.permissions.map((permission) => {
-        return strapi.query('plugin::users-permissions.permission').delete({
+        return strapi.db.query('plugin::users-permissions.permission').delete({
           where: { id: permission.id },
         });
       })
     );
 
     // Delete the role.
-    await strapi.query('plugin::users-permissions.role').delete({ where: { id: roleID } });
+    await strapi.db.query('plugin::users-permissions.role').delete({ where: { id: roleID } });
   },
 });

package/server/services/user.js

@@ -10,9 +10,17 @@ const crypto = require('crypto');
 const bcrypt = require('bcryptjs');
 const urlJoin = require('url-join');
 
-const { getAbsoluteAdminUrl, getAbsoluteServerUrl, sanitize } = require('@strapi/utils');
+const { sanitize } = require('@strapi/utils');
+const { toNumber, getOr } = require('lodash/fp');
 const { getService } = require('../utils');
 
+const USER_MODEL_UID = 'plugin::users-permissions.user';
+
+const getSessionManager = () => {
+  const manager = strapi.sessionManager;
+  return manager ?? null;
+};
+
 module.exports = ({ strapi }) => ({
   /**
    * Promise to count users
@@ -21,21 +29,41 @@ module.exports = ({ strapi }) => ({
    */
 
   count(params) {
-    return strapi.query('plugin::users-permissions.user').count({ where: params });
+    return strapi.db.query(USER_MODEL_UID).count({ where: params });
   },
 
   /**
-   * Promise to search count users
+   * Hashes password fields in the provided values object if they are present.
+   * It checks each key in the values object against the model's attributes and
+   * hashes it if the attribute type is 'password',
    *
-   * @return {Promise}
+   * @param {object} values - The object containing the fields to be hashed.
+   * @return {object} The values object with hashed password fields if they were present.
    */
+  async ensureHashedPasswords(values) {
+    const attributes = strapi.getModel(USER_MODEL_UID).attributes;
+
+    for (const key in values) {
+      if (attributes[key] && attributes[key].type === 'password') {
+        // Check if a custom encryption.rounds has been set on the password attribute
+        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));
+        values[key] = await bcrypt.hash(values[key], rounds);
+      }
+    }
+
+    return values;
+  },
 
   /**
    * Promise to add a/an user.
    * @return {Promise}
    */
   async add(values) {
-    return strapi.entityService.create('plugin::users-permissions.user', {
+    // Use the Document Service so relation inputs accept both the internal
+    // numeric id (legacy) and the documentId (v5 default) syntax, consistent
+    // with every other content-type endpoint. The Document Service hashes
+    // `password` attributes itself, so we must not pre-hash here.
+    return strapi.documents(USER_MODEL_UID).create({
       data: values,
       populate: ['role'],
     });
@@ -48,7 +76,21 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   async edit(userId, params = {}) {
-    return strapi.entityService.update('plugin::users-permissions.user', userId, {
+    // The user is addressed by its numeric id (e.g. the `/users/:id` route),
+    // but the Document Service updates by documentId. Resolve it first so the
+    // relation inputs are processed by the Document Service, which accepts both
+    // numeric ids (legacy) and documentIds (v5 default). The Document Service
+    // hashes `password` attributes itself, so we must not pre-hash here.
+    const entry = await strapi.db
+      .query(USER_MODEL_UID)
+      .findOne({ where: { id: userId }, select: ['documentId'] });
+
+    if (!entry) {
+      return null;
+    }
+
+    return strapi.documents(USER_MODEL_UID).update({
+      documentId: entry.documentId,
       data: params,
       populate: ['role'],
     });
@@ -59,7 +101,14 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetch(id, params) {
-    return strapi.entityService.findOne('plugin::users-permissions.user', id, params);
+    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});
+
+    return strapi.db.query(USER_MODEL_UID).findOne({
+      ...query,
+      where: {
+        $and: [{ id }, query.where || {}],
+      },
+    });
   },
 
   /**
@@ -67,9 +116,7 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetchAuthenticatedUser(id) {
-    return strapi
-      .query('plugin::users-permissions.user')
-      .findOne({ where: { id }, populate: ['role'] });
+    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });
   },
 
   /**
@@ -77,7 +124,9 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetchAll(params) {
-    return strapi.entityService.findMany('plugin::users-permissions.user', params);
+    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});
+
+    return strapi.db.query(USER_MODEL_UID).findMany(query);
   },
 
   /**
@@ -85,7 +134,13 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   async remove(params) {
-    return strapi.query('plugin::users-permissions.user').delete({ where: params });
+    // Invalidate sessions for all affected users
+    const sessionManager = getSessionManager();
+    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {
+      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));
+    }
+
+    return strapi.db.query(USER_MODEL_UID).delete({ where: params });
   },
 
   validatePassword(password, hash) {
@@ -95,14 +150,20 @@ module.exports = ({ strapi }) => ({
   async sendConfirmationEmail(user) {
     const userPermissionService = getService('users-permissions');
     const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });
-    const userSchema = strapi.getModel('plugin::users-permissions.user');
+    const userSchema = strapi.getModel(USER_MODEL_UID);
 
     const settings = await pluginStore
       .get({ key: 'email' })
       .then((storeEmail) => storeEmail.email_confirmation.options);
 
     // Sanitize the template's user information
-    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(userSchema, user);
+    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(
+      {
+        schema: userSchema,
+        getModel: strapi.getModel.bind(strapi),
+      },
+      user
+    );
 
     const confirmationToken = crypto.randomBytes(20).toString('hex');
 
@@ -112,9 +173,13 @@ module.exports = ({ strapi }) => ({
 
     try {
       settings.message = await userPermissionService.template(settings.message, {
-        URL: urlJoin(getAbsoluteServerUrl(strapi.config), apiPrefix, '/auth/email-confirmation'),
-        SERVER_URL: getAbsoluteServerUrl(strapi.config),
-        ADMIN_URL: getAbsoluteAdminUrl(strapi.config),
+        URL: urlJoin(
+          strapi.config.get('server.absoluteUrl'),
+          apiPrefix,
+          '/auth/email-confirmation'
+        ),
+        SERVER_URL: strapi.config.get('server.absoluteUrl'),
+        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),
         USER: sanitizedUserInfo,
         CODE: confirmationToken,
       });

package/server/services/users-permissions.js

@@ -6,7 +6,8 @@ const urlJoin = require('url-join');
 const {
   template: { createStrictInterpolationRegExp },
   errors,
-  keysDeep,
+  objects,
+  sanitizeRoutesMapForSerialization,
 } = require('@strapi/utils');
 
 const { getService } = require('../utils');
@@ -19,6 +20,10 @@ const DEFAULT_PERMISSIONS = [
   { action: 'plugin::users-permissions.auth.register', roleType: 'public' },
   { action: 'plugin::users-permissions.auth.emailConfirmation', roleType: 'public' },
   { action: 'plugin::users-permissions.auth.sendEmailConfirmation', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.refresh', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.logout', roleType: 'authenticated' },
+  { action: 'plugin::users-permissions.auth.getSessions', roleType: 'authenticated' },
+  { action: 'plugin::users-permissions.auth.revokeSession', roleType: 'authenticated' },
   { action: 'plugin::users-permissions.user.me', roleType: 'authenticated' },
   { action: 'plugin::users-permissions.auth.changePassword', roleType: 'authenticated' },
 ];
@@ -45,7 +50,7 @@ module.exports = ({ strapi }) => ({
       return action[Symbol.for('__type__')].includes('content-api');
     };
 
-    _.forEach(strapi.api, (api, apiName) => {
+    _.forEach(strapi.apis, (api, apiName) => {
       const controllers = _.reduce(
         api.controllers,
         (acc, controller, controllerName) => {
@@ -99,13 +104,14 @@ module.exports = ({ strapi }) => ({
       }
     });
 
-    return actionMap;
+    // Return a deeply cloned version to avoid circular references
+    return _.cloneDeep(actionMap);
   },
 
   async getRoutes() {
     const routesMap = {};
 
-    _.forEach(strapi.api, (api, apiName) => {
+    _.forEach(strapi.apis, (api, apiName) => {
       const routes = _.flatMap(api.routes, (route) => {
         if (_.has(route, 'routes')) {
           return route.routes;
@@ -147,16 +153,16 @@ module.exports = ({ strapi }) => ({
       }));
     });
 
-    return routesMap;
+    return sanitizeRoutesMapForSerialization(routesMap);
   },
 
   async syncPermissions() {
-    const roles = await strapi.query('plugin::users-permissions.role').findMany();
-    const dbPermissions = await strapi.query('plugin::users-permissions.permission').findMany();
+    const roles = await strapi.db.query('plugin::users-permissions.role').findMany();
+    const dbPermissions = await strapi.db.query('plugin::users-permissions.permission').findMany();
 
     const permissionsFoundInDB = _.uniq(_.map(dbPermissions, 'action'));
 
-    const appActions = _.flatMap(strapi.api, (api, apiName) => {
+    const appActions = _.flatMap(strapi.apis, (api, apiName) => {
       return _.flatMap(api.controllers, (controller, controllerName) => {
         return _.keys(controller).map((actionName) => {
           return `api::${apiName}.${controllerName}.${actionName}`;
@@ -178,7 +184,9 @@ module.exports = ({ strapi }) => ({
 
     await Promise.all(
       toDelete.map((action) => {
-        return strapi.query('plugin::users-permissions.permission').delete({ where: { action } });
+        return strapi.db
+          .query('plugin::users-permissions.permission')
+          .delete({ where: { action } });
       })
     );
 
@@ -192,7 +200,7 @@ module.exports = ({ strapi }) => ({
 
         await Promise.all(
           toCreate.map((action) => {
-            return strapi.query('plugin::users-permissions.permission').create({
+            return strapi.db.query('plugin::users-permissions.permission').create({
               data: {
                 action,
                 role: role.id,
@@ -205,10 +213,10 @@ module.exports = ({ strapi }) => ({
   },
 
   async initialize() {
-    const roleCount = await strapi.query('plugin::users-permissions.role').count();
+    const roleCount = await strapi.db.query('plugin::users-permissions.role').count();
 
     if (roleCount === 0) {
-      await strapi.query('plugin::users-permissions.role').create({
+      await strapi.db.query('plugin::users-permissions.role').create({
         data: {
           name: 'Authenticated',
           description: 'Default role given to authenticated user.',
@@ -216,7 +224,7 @@ module.exports = ({ strapi }) => ({
         },
       });
 
-      await strapi.query('plugin::users-permissions.role').create({
+      await strapi.db.query('plugin::users-permissions.role').create({
         data: {
           name: 'Public',
           description: 'Default role given to unauthenticated user.',
@@ -229,13 +237,13 @@ module.exports = ({ strapi }) => ({
   },
 
   async updateUserRole(user, role) {
-    return strapi
+    return strapi.db
       .query('plugin::users-permissions.user')
       .update({ where: { id: user.id }, data: { role } });
   },
 
   template(layout, data) {
-    const allowedTemplateVariables = keysDeep(data);
+    const allowedTemplateVariables = objects.keysDeep(data);
 
     // Create a strict interpolation RegExp based on possible variable names
     const interpolate = createStrictInterpolationRegExp(allowedTemplateVariables, 'g');

package/server/strategies/users-permissions.js

@@ -14,7 +14,7 @@ const authenticate = async (ctx) => {
     const token = await getService('jwt').getToken(ctx);
 
     if (token) {
-      const { id } = token;
+      const { id, sessionId } = token;
 
       // Invalid token
       if (id === undefined) {
@@ -49,6 +49,11 @@ const authenticate = async (ctx) => {
       const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);
 
       ctx.state.user = user;
+      // Expose the session backing this request (refresh mode only) so endpoints
+      // can flag the "current" session when listing active sessions.
+      if (sessionId) {
+        ctx.state.session = { id: sessionId };
+      }
 
       return {
         authenticated: true,

package/server/utils/index.d.ts

@@ -3,6 +3,7 @@ import * as user from '../services/user';
 import * as role from '../services/role';
 import * as jwt from '../services/jwt';
 import * as providers from '../services/providers';
+import * as providersRegistry from '../services/providers-registry';
 import * as permission from '../services/permission';
 
 type S = {
@@ -11,8 +12,12 @@ type S = {
   user: typeof user;
   jwt: typeof jwt;
   providers: typeof providers;
-  ['providers-registry']: typeof providers;
+  ['providers-registry']: typeof providersRegistry;
   permission: typeof permission;
 };
 
 export function getService<T extends keyof S>(name: T): ReturnType<S[T]>;
+
+export function isUsernameTaken(username: string): Promise<boolean>;
+
+export function findValidUsername(basename: string): Promise<string>;

package/server/utils/index.js

@@ -1,12 +1,42 @@
 'use strict';
 
+const crypto = require('crypto');
 const sanitize = require('./sanitize');
 
+const MAX_USERNAME_ATTEMPTS = 10;
+
 const getService = (name) => {
   return strapi.plugin('users-permissions').service(name);
 };
 
+const isUsernameTaken = async (username) => {
+  const user = await strapi.db
+    .query('plugin::users-permissions.user')
+    .findOne({ where: { username } });
+  return Boolean(user);
+};
+
+const findValidUsername = async (basename) => {
+  const minLength =
+    strapi.getModel('plugin::users-permissions.user')?.attributes?.username?.minLength ?? 3;
+  const tryBasenameFirst = basename.length >= minLength;
+
+  let attempt = 0;
+  let candidate;
+  let taken;
+  do {
+    candidate =
+      attempt === 0 && tryBasenameFirst ? basename : `${basename}${crypto.randomInt(1000, 9999)}`;
+    taken = await isUsernameTaken(candidate);
+    attempt += 1;
+  } while (taken && attempt <= MAX_USERNAME_ATTEMPTS);
+
+  return taken ? crypto.randomUUID() : candidate;
+};
+
 module.exports = {
   getService,
+  isUsernameTaken,
+  findValidUsername,
   sanitize,
 };

package/server/utils/refresh-cookie-options.js

@@ -0,0 +1,20 @@
+'use strict';
+
+const buildRefreshCookieOptions = (upSessions, isProduction) => {
+  const isSecure =
+    typeof upSessions.cookie?.secure === 'boolean' ? upSessions.cookie?.secure : isProduction;
+
+  return {
+    httpOnly: true,
+    secure: isSecure,
+    sameSite: upSessions.cookie?.sameSite ?? 'lax',
+    path: upSessions.cookie?.path ?? '/',
+    domain: upSessions.cookie?.domain,
+    maxAge: upSessions.cookie?.maxAge,
+    overwrite: true,
+  };
+};
+
+module.exports = {
+  buildRefreshCookieOptions,
+};

package/server/utils/sanitize/sanitizers.js

@@ -1,16 +1,20 @@
 'use strict';
 
 const { curry } = require('lodash/fp');
-const { traverseEntity, pipeAsync } = require('@strapi/utils');
+const { traverseEntity, async } = require('@strapi/utils');
 
 const { removeUserRelationFromRoleEntities } = require('./visitors');
 
 const sanitizeUserRelationFromRoleEntities = curry((schema, entity) => {
-  return traverseEntity(removeUserRelationFromRoleEntities, { schema }, entity);
+  return traverseEntity(
+    removeUserRelationFromRoleEntities,
+    { schema, getModel: strapi.getModel.bind(strapi) },
+    entity
+  );
 });
 
 const defaultSanitizeOutput = curry((schema, entity) => {
-  return pipeAsync(sanitizeUserRelationFromRoleEntities(schema))(entity);
+  return async.pipe(sanitizeUserRelationFromRoleEntities(schema))(entity);
 });
 
 module.exports = {

package/server/utils/sanitize/visitors/remove-user-relation-from-role-entities.js

@@ -2,8 +2,8 @@
 
 module.exports = ({ schema, key, attribute }, { remove }) => {
   if (
-    attribute.type === 'relation' &&
-    attribute.target === 'plugin::users-permissions.user' &&
+    attribute?.type === 'relation' &&
+    attribute?.target === 'plugin::users-permissions.user' &&
     schema.uid === 'plugin::users-permissions.role'
   ) {
     remove(key);

package/.eslintignore

@@ -1 +0,0 @@
-dist

package/.eslintrc

@@ -1,17 +0,0 @@
-{
-  "root": true,
-  "overrides": [
-    {
-      "files": ["admin/**/*"],
-      "extends": ["custom/front"],
-      "rules": {
-        "import/extensions": "off"
-      }
-    },
-    {
-      "files": ["**/*"],
-      "excludedFiles": ["admin/**/*"],
-      "extends": ["custom/back"]
-    }
-  ]
-}

package/admin/src/pages/Roles/pages/ListPage/utils/api.js

@@ -1,30 +0,0 @@
-import { getFetchClient } from '@strapi/helper-plugin';
-
-export const fetchData = async (toggleNotification, notifyStatus) => {
-  try {
-    const { get } = getFetchClient();
-    const { data } = await get('/users-permissions/roles');
-    notifyStatus('The roles have loaded successfully');
-
-    return data;
-  } catch (err) {
-    toggleNotification({
-      type: 'warning',
-      message: { id: 'notification.error' },
-    });
-
-    throw new Error(err);
-  }
-};
-
-export const deleteData = async (id, toggleNotification) => {
-  try {
-    const { del } = getFetchClient();
-    await del(`/users-permissions/roles/${id}`);
-  } catch (error) {
-    toggleNotification({
-      type: 'warning',
-      message: { id: 'notification.error', defaultMessage: 'An error occured' },
-    });
-  }
-};