@strapi/plugin-users-permissions 0.0.0-experimental.6340da17068c3bed7fb006e7bcc554c71129e282 → 0.0.0-experimental.63624e21eb5b0713345a0cf2f68f1c40eab427bc

package/server/{controllers → src/controllers}/auth.js

@@ -9,7 +9,6 @@
 /* eslint-disable no-useless-escape */
 const crypto = require('crypto');
 const _ = require('lodash');
-const { concat, compact, isArray } = require('lodash/fp');
 const utils = require('@strapi/utils');
 const { getService } = require('../utils');
 const { buildRefreshCookieOptions } = require('../utils/refresh-cookie-options');
@@ -41,7 +40,6 @@ const extractDeviceId = (requestBody) => {
 
 const buildSessionMetadataFromContext = (ctx) =>
   buildSessionMetadata({
-    ip: ctx.request.ip,
     userAgent: ctx.request.headers['user-agent'],
   });
 
@@ -206,7 +204,15 @@ module.exports = ({ strapi }) => ({
 
     // Connect the user with the third-party provider.
     try {
-      const user = await getService('providers').connect(provider, ctx.query);
+      const grantResponse = _.get(ctx, 'session.grant.response');
+
+      if (!grantResponse) {
+        throw new ApplicationError('OAuth authentication requires a completed provider session');
+      }
+
+      const user = await getService('providers').connect(provider, grantResponse, {
+        grantResponse,
+      });
 
       if (user.blocked) {
         throw new ForbiddenError('Your account has been blocked by an administrator');
@@ -372,7 +378,14 @@ module.exports = ({ strapi }) => ({
     const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';
     if (upSessions?.httpOnly || requestHttpOnly) {
       const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
-      ctx.cookies.set(cookieName, '', { expires: new Date(0) });
+      const isProduction = process.env.NODE_ENV === 'production';
+
+      const { maxAge: _maxAge, ...cookieOptions } = buildRefreshCookieOptions(
+        upSessions,
+        isProduction
+      );
+
+      ctx.cookies.set(cookieName, '', { ...cookieOptions, expires: new Date(0) });
     }
     return ctx.send({ ok: true });
   },
@@ -419,24 +432,14 @@ module.exports = ({ strapi }) => ({
     return ctx.send({ data: {} });
   },
   async connect(ctx, next) {
-    const grant = require('grant').koa();
-
     const providers = await strapi
       .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })
       .get();
 
-    const apiPrefix = strapi.config.get('api.rest.prefix');
-    const grantConfig = {
-      defaults: {
-        prefix: `${apiPrefix}/connect`,
-      },
-      ...providers,
-    };
-
     const [requestPath] = ctx.request.url.split('?');
     const provider = requestPath.split('/connect/')[1].split('/')[0];
 
-    if (!_.get(grantConfig[provider], 'enabled')) {
+    if (!_.get(providers, [provider, 'enabled'])) {
       throw new ApplicationError('This provider is disabled');
     }
 
@@ -446,32 +449,35 @@ module.exports = ({ strapi }) => ({
       );
     }
 
-    // Ability to pass OAuth callback dynamically
     const queryCustomCallback = _.get(ctx, 'query.callback');
     const dynamicSessionCallback = _.get(ctx, 'session.grant.dynamic.callback');
-
     const customCallback = queryCustomCallback ?? dynamicSessionCallback;
 
-    // The custom callback is validated to make sure it's not redirecting to an unwanted actor.
     if (customCallback !== undefined) {
       try {
-        // We're extracting the callback validator from the plugin config since it can be user-customized
         const { validate: validateCallback } = strapi
           .plugin('users-permissions')
           .config('callback');
 
-        await validateCallback(customCallback, grantConfig[provider]);
-
-        grantConfig[provider].callback = customCallback;
-      } catch (e) {
+        await validateCallback(customCallback, providers[provider]);
+
+        // Persist across the provider redirect round-trip (request state alone is lost).
+        ctx.session = ctx.session || {};
+        ctx.session.grant = ctx.session.grant || {};
+        ctx.session.grant.dynamic = {
+          ...ctx.session.grant.dynamic,
+          callback: customCallback,
+        };
+        ctx.state.oauthConnect = { callback: customCallback };
+      } catch {
         throw new ValidationError('Invalid callback URL provided', { callback: customCallback });
       }
     }
 
-    // Build a valid redirect URI for the current provider
-    grantConfig[provider].redirect_uri = getService('providers').buildRedirectUri(provider);
+    const { createOAuthConnectMiddleware } = require('../utils/oauth-connect');
+    const oauthConnect = createOAuthConnectMiddleware();
 
-    return grant(grantConfig)(ctx, next);
+    return oauthConnect(ctx, next);
   },
 
   async forgotPassword(ctx) {
@@ -549,9 +555,10 @@ module.exports = ({ strapi }) => ({
     const alwaysAllowedKeys = ['username', 'password', 'email'];
 
     // Note that we intentionally do not filter allowedFields to allow a project to explicitly accept private or other Strapi field on registration
-    const allowedKeys = compact(
-      concat(alwaysAllowedKeys, isArray(register?.allowedFields) ? register.allowedFields : [])
-    );
+    const allowedKeys = [
+      ...alwaysAllowedKeys,
+      ...(Array.isArray(register?.allowedFields) ? register.allowedFields : []),
+    ].filter((field) => Boolean(field));
 
     // Check if there are any keys in requestBody that are not in allowedKeys
     const invalidKeys = Object.keys(ctx.request.body).filter((key) => !allowedKeys.includes(key));

package/server/{controllers → src/controllers}/validation/auth.js

@@ -14,7 +14,7 @@ const createRegisterSchema = (config) =>
     password: yup
       .string()
       .required()
-      .test(function (value) {
+      .test(function validateRegisterPasswordMaxLength(value) {
         if (!value) return true;
         const isValid = new TextEncoder().encode(value).length <= 72;
         if (!isValid) {
@@ -22,7 +22,7 @@ const createRegisterSchema = (config) =>
         }
         return true;
       })
-      .test(async function (value) {
+      .test(async function validateRegisterPassword(value) {
         if (typeof config?.validatePassword === 'function') {
           try {
             const isValid = await config.validatePassword(value);
@@ -57,7 +57,7 @@ const createResetPasswordSchema = (config) =>
       password: yup
         .string()
         .required()
-        .test(function (value) {
+        .test(function validateResetPasswordMaxLength(value) {
           if (!value) return true;
           const isValid = new TextEncoder().encode(value).length <= 72;
           if (!isValid) {
@@ -65,7 +65,7 @@ const createResetPasswordSchema = (config) =>
           }
           return true;
         })
-        .test(async function (value) {
+        .test(async function validateResetPassword(value) {
           if (typeof config?.validatePassword === 'function') {
             try {
               const isValid = await config.validatePassword(value);
@@ -93,7 +93,7 @@ const createChangePasswordSchema = (config) =>
       password: yup
         .string()
         .required()
-        .test(function (value) {
+        .test(function validateChangePasswordMaxLength(value) {
           if (!value) return true;
           const isValid = new TextEncoder().encode(value).length <= 72;
           if (!isValid) {
@@ -101,7 +101,7 @@ const createChangePasswordSchema = (config) =>
           }
           return true;
         })
-        .test(async function (value) {
+        .test(async function validateChangePassword(value) {
           if (typeof config?.validatePassword === 'function') {
             try {
               const isValid = await config.validatePassword(value);

package/server/{controllers → src/controllers}/validation/email-template.js

@@ -1,6 +1,5 @@
 'use strict';
 
-const { trim } = require('lodash/fp');
 const {
   template: { createLooseInterpolationRegExp, createStrictInterpolationRegExp },
 } = require('@strapi/utils');
@@ -33,7 +32,7 @@ const matchAll = (pattern, src) => {
   while ((match = regexPatternWithGlobal.exec(src))) {
     const [, group] = match;
 
-    matches.push(trim(group));
+    matches.push(group.trim());
   }
 
   return matches;

package/server/{graphql → src/graphql}/mutations/auth/change-password.js

@@ -1,11 +1,13 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
+const { createRateLimitRunner } = require('./rate-limit');
 
 module.exports = ({ nexus, strapi }) => {
   const { nonNull } = nexus;
+  const runRateLimit = createRateLimitRunner(strapi, '/auth/change-password');
 
   return {
     type: 'UsersPermissionsLoginPayload',
@@ -21,11 +23,9 @@ module.exports = ({ nexus, strapi }) => {
     async resolve(parent, args, context) {
       const { koaContext } = context;
 
-      koaContext.request.body = toPlainObject(args);
-
-      await strapi.plugin('users-permissions').controller('auth').changePassword(koaContext);
-
-      const output = koaContext.body;
+      const output = await runRateLimit(koaContext, { body: toPlainObject(args) }, (ctx) =>
+        strapi.plugin('users-permissions').controller('auth').changePassword(ctx)
+      );
 
       checkBadRequest(output);
 

package/server/{graphql → src/graphql}/mutations/auth/email-confirmation.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
 

package/server/{graphql → src/graphql}/mutations/auth/forgot-password.js

@@ -1,11 +1,13 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
+const { createRateLimitRunner } = require('./rate-limit');
 
 module.exports = ({ nexus, strapi }) => {
   const { nonNull } = nexus;
+  const runRateLimit = createRateLimitRunner(strapi, '/auth/forgot-password');
 
   return {
     type: 'UsersPermissionsPasswordPayload',
@@ -19,11 +21,9 @@ module.exports = ({ nexus, strapi }) => {
     async resolve(parent, args, context) {
       const { koaContext } = context;
 
-      koaContext.request.body = toPlainObject(args);
-
-      await strapi.plugin('users-permissions').controller('auth').forgotPassword(koaContext);
-
-      const output = koaContext.body;
+      const output = await runRateLimit(koaContext, { body: toPlainObject(args) }, (ctx) =>
+        strapi.plugin('users-permissions').controller('auth').forgotPassword(ctx)
+      );
 
       checkBadRequest(output);
 

package/server/{graphql → src/graphql}/mutations/auth/login.js

@@ -1,11 +1,13 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
+const { createRateLimitRunner } = require('./rate-limit');
 
 module.exports = ({ nexus, strapi }) => {
   const { nonNull } = nexus;
+  const runRateLimit = createRateLimitRunner(strapi, '/auth/local');
 
   return {
     type: nonNull('UsersPermissionsLoginPayload'),
@@ -17,12 +19,14 @@ module.exports = ({ nexus, strapi }) => {
     async resolve(parent, args, context) {
       const { koaContext } = context;
 
-      koaContext.params = { provider: args.input.provider };
-      koaContext.request.body = toPlainObject(args.input);
-
-      await strapi.plugin('users-permissions').controller('auth').callback(koaContext);
-
-      const output = koaContext.body;
+      const output = await runRateLimit(
+        koaContext,
+        {
+          body: toPlainObject(args.input),
+          params: { provider: args.input.provider },
+        },
+        (ctx) => strapi.plugin('users-permissions').controller('auth').callback(ctx)
+      );
 
       checkBadRequest(output);
 

package/server/src/graphql/mutations/auth/rate-limit.js

@@ -0,0 +1,62 @@
+'use strict';
+
+const RATE_LIMIT_MIDDLEWARE = 'plugin::users-permissions.rateLimit';
+const contextQueues = new WeakMap();
+
+const getRateLimitPath = (strapi, routeSuffix) => {
+  const configuredPrefix = strapi.config.get('api.rest.prefix', '/api');
+  const prefix = typeof configuredPrefix === 'string' ? configuredPrefix : '/api';
+  const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, '');
+  const normalizedSuffix = routeSuffix.replace(/^\/+/, '');
+
+  return `/${[normalizedPrefix, normalizedSuffix].filter(Boolean).join('/')}`;
+};
+
+const enqueueContextOperation = (koaContext, operation) => {
+  const previous = contextQueues.get(koaContext) || Promise.resolve();
+  const result = previous.catch(() => undefined).then(operation);
+
+  contextQueues.set(
+    koaContext,
+    result.catch(() => undefined)
+  );
+
+  return result;
+};
+
+const createRateLimitRunner = (strapi, routeSuffix) => {
+  const rateLimit = strapi.middleware(RATE_LIMIT_MIDDLEWARE)({}, { strapi });
+  const routePath = getRateLimitPath(strapi, routeSuffix);
+
+  return (koaContext, { body, params }, controller) =>
+    enqueueContextOperation(koaContext, async () => {
+      const originalBody = koaContext.request.body;
+      const originalPath = koaContext.request.path;
+      const originalParams = koaContext.params;
+      const originalResponseBody = koaContext.body;
+      let responseStatus = 200;
+
+      koaContext.request.path = routePath;
+      koaContext.request.body = body;
+      if (params) {
+        koaContext.params = params;
+      }
+
+      try {
+        await rateLimit(koaContext, () => controller(koaContext));
+        responseStatus = koaContext.status;
+        return koaContext.body;
+      } finally {
+        koaContext.request.path = originalPath;
+        koaContext.request.body = originalBody;
+        koaContext.params = originalParams;
+        koaContext.body = originalResponseBody;
+        koaContext.status = responseStatus;
+      }
+    });
+};
+
+module.exports = {
+  createRateLimitRunner,
+  getRateLimitPath,
+};

package/server/{graphql → src/graphql}/mutations/auth/register.js

@@ -1,11 +1,13 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
+const { createRateLimitRunner } = require('./rate-limit');
 
 module.exports = ({ nexus, strapi }) => {
   const { nonNull } = nexus;
+  const runRateLimit = createRateLimitRunner(strapi, '/auth/local/register');
 
   return {
     type: nonNull('UsersPermissionsLoginPayload'),
@@ -19,11 +21,9 @@ module.exports = ({ nexus, strapi }) => {
     async resolve(parent, args, context) {
       const { koaContext } = context;
 
-      koaContext.request.body = toPlainObject(args.input);
-
-      await strapi.plugin('users-permissions').controller('auth').register(koaContext);
-
-      const output = koaContext.body;
+      const output = await runRateLimit(koaContext, { body: toPlainObject(args.input) }, (ctx) =>
+        strapi.plugin('users-permissions').controller('auth').register(ctx)
+      );
 
       checkBadRequest(output);
 

package/server/{graphql → src/graphql}/mutations/auth/reset-password.js

@@ -1,11 +1,13 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../utils');
+const { createRateLimitRunner } = require('./rate-limit');
 
 module.exports = ({ nexus, strapi }) => {
   const { nonNull } = nexus;
+  const runRateLimit = createRateLimitRunner(strapi, '/auth/reset-password');
 
   return {
     type: 'UsersPermissionsLoginPayload',
@@ -21,11 +23,9 @@ module.exports = ({ nexus, strapi }) => {
     async resolve(parent, args, context) {
       const { koaContext } = context;
 
-      koaContext.request.body = toPlainObject(args);
-
-      await strapi.plugin('users-permissions').controller('auth').resetPassword(koaContext);
-
-      const output = koaContext.body;
+      const output = await runRateLimit(koaContext, { body: toPlainObject(args) }, (ctx) =>
+        strapi.plugin('users-permissions').controller('auth').resetPassword(ctx)
+      );
 
       checkBadRequest(output);
 

package/server/{graphql → src/graphql}/mutations/crud/role/create-role.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const usersPermissionsRoleUID = 'plugin::users-permissions.role';
 

package/server/{graphql → src/graphql}/mutations/crud/user/create-user.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../../utils');
 

package/server/{graphql → src/graphql}/mutations/crud/user/update-user.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { toPlainObject } = require('lodash/fp');
+const { toPlainObject } = require('lodash');
 
 const { checkBadRequest } = require('../../../utils');
 

package/server/{graphql → src/graphql}/utils.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { getOr } = require('lodash/fp');
+const { get } = require('lodash');
 
 /**
  * Throws an ApolloError if context body contains a bad request
@@ -8,10 +8,10 @@ const { getOr } = require('lodash/fp');
  * @throws ApolloError if the body is a bad request
  */
 function checkBadRequest(contextBody) {
-  const statusCode = getOr(200, 'statusCode', contextBody);
+  const statusCode = get(contextBody, 'statusCode', 200);
 
   if (statusCode !== 200) {
-    const errorMessage = getOr('Bad Request', 'error', contextBody);
+    const errorMessage = get(contextBody, 'error', 'Bad Request');
 
     const exception = new Error(errorMessage);
 

package/server/{middlewares → src/middlewares}/rateLimit.js

@@ -2,7 +2,7 @@
 
 const path = require('path');
 const utils = require('@strapi/utils');
-const { isString, has, toLower } = require('lodash/fp');
+const { toLower, isString, has } = require('lodash');
 
 const { RateLimitError } = utils.errors;
 
@@ -46,8 +46,8 @@ const routeUsesEmailIdentifier = (requestPath) => {
  * `/api/auth/local/` share one bucket.
  */
 const normalizeRequestPathForRateLimit = (requestPath) => {
-  const normalized = path.normalize(requestPath);
-  const lower = toLower(normalized);
+  const normalized = path.posix.normalize(requestPath);
+  const lower = normalized.toLowerCase();
   return lower.replace(/\/+$/, '') || '/';
 };
 
@@ -102,7 +102,7 @@ module.exports =
       };
     }
 
-    if (!has('enabled', rateLimitConfig)) {
+    if (!has(rateLimitConfig, 'enabled')) {
       rateLimitConfig.enabled = true;
     }