@strapi/plugin-users-permissions 0.0.0-experimental.6340da17068c3bed7fb006e7bcc554c71129e282 → 0.0.0-experimental.63624e21eb5b0713345a0cf2f68f1c40eab427bc

package/server/{services → src/services}/users-permissions.js

@@ -1,7 +1,6 @@
 'use strict';
 
 const _ = require('lodash');
-const { filter, map, pipe, prop } = require('lodash/fp');
 const urlJoin = require('url-join');
 const {
   template: { createStrictInterpolationRegExp },
@@ -50,7 +49,7 @@ module.exports = ({ strapi }) => ({
       return action[Symbol.for('__type__')].includes('content-api');
     };
 
-    _.forEach(strapi.apis, (api, apiName) => {
+    for (const [apiName, api] of Object.entries(strapi.apis)) {
       const controllers = _.reduce(
         api.controllers,
         (acc, controller, controllerName) => {
@@ -75,9 +74,9 @@ module.exports = ({ strapi }) => ({
       if (!_.isEmpty(controllers)) {
         actionMap[`api::${apiName}`] = { controllers };
       }
-    });
+    }
 
-    _.forEach(strapi.plugins, (plugin, pluginName) => {
+    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {
       const controllers = _.reduce(
         plugin.controllers,
         (acc, controller, controllerName) => {
@@ -102,7 +101,7 @@ module.exports = ({ strapi }) => ({
       if (!_.isEmpty(controllers)) {
         actionMap[`plugin::${pluginName}`] = { controllers };
       }
-    });
+    }
 
     // Return a deeply cloned version to avoid circular references
     return _.cloneDeep(actionMap);
@@ -111,7 +110,7 @@ module.exports = ({ strapi }) => ({
   async getRoutes() {
     const routesMap = {};
 
-    _.forEach(strapi.apis, (api, apiName) => {
+    for (const [apiName, api] of Object.entries(strapi.apis)) {
       const routes = _.flatMap(api.routes, (route) => {
         if (_.has(route, 'routes')) {
           return route.routes;
@@ -121,7 +120,7 @@ module.exports = ({ strapi }) => ({
       }).filter((route) => route.info.type === 'content-api');
 
       if (routes.length === 0) {
-        return;
+        continue;
       }
 
       const apiPrefix = strapi.config.get('api.rest.prefix');
@@ -129,9 +128,9 @@ module.exports = ({ strapi }) => ({
         ...route,
         path: urlJoin(apiPrefix, route.path),
       }));
-    });
+    }
 
-    _.forEach(strapi.plugins, (plugin, pluginName) => {
+    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {
       const transformPrefix = transformRoutePrefixFor(pluginName);
 
       const routes = _.flatMap(plugin.routes, (route) => {
@@ -143,7 +142,7 @@ module.exports = ({ strapi }) => ({
       }).filter((route) => route.info.type === 'content-api');
 
       if (routes.length === 0) {
-        return;
+        continue;
       }
 
       const apiPrefix = strapi.config.get('api.rest.prefix');
@@ -151,7 +150,7 @@ module.exports = ({ strapi }) => ({
         ...route,
         path: urlJoin(apiPrefix, route.path),
       }));
-    });
+    }
 
     return sanitizeRoutesMapForSerialization(routesMap);
   },
@@ -193,10 +192,9 @@ module.exports = ({ strapi }) => ({
     if (permissionsFoundInDB.length === 0) {
       // create default permissions
       for (const role of roles) {
-        const toCreate = pipe(
-          filter(({ roleType }) => roleType === role.type || roleType === null),
-          map(prop('action'))
-        )(DEFAULT_PERMISSIONS);
+        const toCreate = DEFAULT_PERMISSIONS.filter(
+          ({ roleType }) => roleType === role.type || roleType === null
+        ).map(({ action }) => action);
 
         await Promise.all(
           toCreate.map((action) => {
@@ -250,7 +248,7 @@ module.exports = ({ strapi }) => ({
 
     try {
       return _.template(layout, { interpolate, evaluate: false, escape: false })(data);
-    } catch (e) {
+    } catch {
       throw new errors.ApplicationError('Invalid email template');
     }
   },

package/server/{strategies → src/strategies}/users-permissions.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { castArray, map, every, pipe } = require('lodash/fp');
+const { map, every } = require('lodash');
 const { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;
 
 const { getService } = require('../utils');
@@ -43,7 +43,11 @@ const authenticate = async (ctx) => {
       // Fetch user's permissions
       const permissions = await Promise.resolve(user.role.id)
         .then(getService('permission').findRolePermissions)
-        .then(map(getService('permission').toContentAPIPermission));
+        .then((permissions) =>
+          map(permissions, (permission) =>
+            getService('permission').toContentAPIPermission(permission)
+          )
+        );
 
       // Generate an ability (content API engine) based on the given permissions
       const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);
@@ -64,7 +68,11 @@ const authenticate = async (ctx) => {
 
     const publicPermissions = await getService('permission')
       .findPublicPermissions()
-      .then(map(getService('permission').toContentAPIPermission));
+      .then((permissions) =>
+        map(permissions, (permission) =>
+          getService('permission').toContentAPIPermission(permission)
+        )
+      );
 
     if (publicPermissions.length === 0) {
       return { authenticated: false };
@@ -77,7 +85,7 @@ const authenticate = async (ctx) => {
       credentials: null,
       ability,
     };
-  } catch (err) {
+  } catch {
     return { authenticated: false };
   }
 };
@@ -100,12 +108,8 @@ const verify = async (auth, config) => {
     throw new UnauthorizedError();
   }
 
-  const isAllowed = pipe(
-    // Make sure we're dealing with an array
-    castArray,
-    // Transform the scope array into an action array
-    every((scope) => ability.can(scope))
-  )(config.scope);
+  const scopes = Array.isArray(config.scope) ? config.scope : [config.scope];
+  const isAllowed = every(scopes, (scope) => ability.can(scope));
 
   if (!isAllowed) {
     throw new ForbiddenError();

package/server/src/utils/oauth-connect/index.js

@@ -0,0 +1,262 @@
+'use strict';
+
+const { errors } = require('@strapi/utils');
+
+const builtinProviderEndpoints = require('./providers');
+const oauth1 = require('./oauth1');
+const oauth2 = require('./oauth2');
+const { trimGrantSessionResponse } = require('../trim-grant-session-response');
+
+const CONNECT_PREFIX = '/connect';
+
+const parseConnectPath = (requestPath, apiPrefix) => {
+  const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;
+  if (!requestPath.startsWith(prefix)) {
+    return null;
+  }
+
+  const remainder = requestPath.slice(prefix.length);
+  const [provider, segment] = remainder.split('/').filter(Boolean);
+
+  if (!provider) {
+    return null;
+  }
+
+  return {
+    provider,
+    isCallback: segment === 'callback',
+  };
+};
+
+/**
+ * Resolve OAuth endpoint config from built-ins, falling back to store-defined
+ * endpoints so custom providers registered via providers-registry still work.
+ */
+const buildProviderConfig = (providerName, storedConfig, redirectUri) => {
+  const defaults = builtinProviderEndpoints[providerName];
+  const endpoints = defaults || {
+    oauth: storedConfig.oauth,
+    authorize_url: storedConfig.authorize_url,
+    access_url: storedConfig.access_url,
+    request_url: storedConfig.request_url,
+    scope_delimiter: storedConfig.scope_delimiter,
+    token_endpoint_auth_method: storedConfig.token_endpoint_auth_method,
+  };
+
+  if (endpoints.oauth === 1) {
+    if (!endpoints.request_url || !endpoints.authorize_url || !endpoints.access_url) {
+      return null;
+    }
+  } else if (!endpoints.authorize_url || !endpoints.access_url) {
+    return null;
+  }
+
+  return {
+    name: providerName,
+    ...endpoints,
+    key: storedConfig.key,
+    secret: storedConfig.secret,
+    scope: storedConfig.scope,
+    subdomain: storedConfig.subdomain,
+    callback: storedConfig.callback,
+    redirect_uri: redirectUri,
+  };
+};
+
+const redirectWithPayload = (ctx, callbackUrl, payload) => {
+  const url = new URL(callbackUrl);
+  const params = new URLSearchParams();
+
+  Object.entries(payload).forEach(([key, value]) => {
+    if (key === 'raw') {
+      Object.entries(value).forEach(([rawKey, rawValue]) => {
+        params.set(`raw[${rawKey}]`, String(rawValue));
+      });
+      return;
+    }
+    if (value !== undefined && value !== null) {
+      params.set(key, String(value));
+    }
+  });
+
+  url.search = params.toString();
+  ctx.redirect(url.toString());
+};
+
+const preserveGrantDynamic = (ctx) => {
+  const dynamic = ctx.session.grant?.dynamic;
+  return dynamic ? { dynamic } : {};
+};
+
+const redirectWithSessionResponse = (ctx, callbackUrl, provider, tokenResponse) => {
+  const grantResponse = oauth2.tokensToQueryPayload(provider, tokenResponse);
+  ctx.session.grant = {
+    response: trimGrantSessionResponse(grantResponse, provider.name),
+  };
+
+  return redirectWithPayload(ctx, callbackUrl, {});
+};
+
+const startOAuth1Flow = async (ctx, provider, parsed, redirectUri) => {
+  const requestToken = await oauth1.requestToken({
+    requestUrl: provider.request_url,
+    redirectUri,
+    consumerKey: provider.key,
+    clientCredential: provider.secret,
+  });
+
+  ctx.session.grant = {
+    ...preserveGrantDynamic(ctx),
+    provider: parsed.provider,
+    request: requestToken,
+  };
+
+  const authorizeUrl = `${provider.authorize_url}?oauth_token=${encodeURIComponent(requestToken.oauth_token)}`;
+  return ctx.redirect(authorizeUrl);
+};
+
+const startOAuth2Flow = (ctx, provider, parsed, redirectUri) => {
+  const state = oauth2.generateState();
+  ctx.session.grant = {
+    ...preserveGrantDynamic(ctx),
+    provider: parsed.provider,
+    state,
+  };
+
+  let authorizeUrl = oauth2.buildAuthorizeUrl(provider, {
+    key: provider.key,
+    redirectUri,
+    scope: provider.scope,
+    subdomain: provider.subdomain,
+  });
+
+  authorizeUrl += `&state=${encodeURIComponent(state)}`;
+  return ctx.redirect(authorizeUrl);
+};
+
+const handleOAuth1Callback = async (ctx, provider, callbackUrl) => {
+  const session = ctx.session.grant || {};
+  const { oauth_token: oauthToken, oauth_verifier: oauthVerifier } = ctx.query;
+  const requestToken = session.request;
+
+  if (!requestToken?.oauth_token || oauthToken !== requestToken.oauth_token) {
+    throw new Error('OAuth1 token mismatch');
+  }
+
+  const tokenResponse = await oauth1.accessToken({
+    accessUrl: provider.access_url,
+    consumerKey: provider.key,
+    clientCredential: provider.secret,
+    oauthToken,
+    oauthVerifier,
+    oauthTokenCredential: requestToken.oauth_token_secret,
+  });
+
+  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
+};
+
+const handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) => {
+  const session = ctx.session.grant || {};
+  const { code, state: queryState, error, error_description: errorDescription } = ctx.query;
+
+  if (error) {
+    ctx.session.grant = {};
+    return redirectWithPayload(ctx, callbackUrl, {
+      error,
+      error_description: errorDescription,
+    });
+  }
+
+  if (!code) {
+    throw new Error('OAuth2 missing code parameter');
+  }
+
+  // Reject when session state is missing (not only on mismatch) to close login-CSRF.
+  if (!session.state || queryState !== session.state) {
+    throw new Error('OAuth2 state mismatch');
+  }
+
+  const tokenResponse = await oauth2.exchangeAuthorizationCode(provider, {
+    key: provider.key,
+    secret: provider.secret,
+    redirectUri,
+    code,
+    subdomain: provider.subdomain,
+  });
+
+  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
+};
+
+const createOAuthConnectMiddleware = () => {
+  return async (ctx, next) => {
+    const apiPrefix = strapi.config.get('api.rest.prefix');
+    const [requestPath] = ctx.request.url.split('?');
+    const parsed = parseConnectPath(requestPath, apiPrefix);
+
+    if (!parsed) {
+      return next();
+    }
+
+    if (!ctx.session) {
+      ctx.throw(400, 'OAuth connect requires session middleware');
+    }
+
+    const storedProviders = await strapi
+      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })
+      .get();
+
+    const storedConfig = storedProviders?.[parsed.provider];
+    if (!storedConfig?.enabled) {
+      throw new errors.ApplicationError('This provider is disabled');
+    }
+
+    const { getService } = require('..');
+    const redirectUri = getService('providers').buildRedirectUri(parsed.provider);
+
+    const callbackOverride =
+      ctx.state.oauthConnect?.callback ?? ctx.session.grant?.dynamic?.callback;
+    const effectiveConfig = callbackOverride
+      ? { ...storedConfig, callback: callbackOverride }
+      : storedConfig;
+
+    const provider = buildProviderConfig(parsed.provider, effectiveConfig, redirectUri);
+
+    if (!provider) {
+      throw new errors.ApplicationError('Unknown OAuth provider');
+    }
+
+    ctx.session.grant = ctx.session.grant || {};
+
+    if (!parsed.isCallback) {
+      if (provider.oauth === 1) {
+        return startOAuth1Flow(ctx, provider, parsed, redirectUri);
+      }
+      return startOAuth2Flow(ctx, provider, parsed, redirectUri);
+    }
+
+    const callbackUrl = effectiveConfig.callback;
+    if (!callbackUrl) {
+      throw new errors.ApplicationError('Provider callback URL is not configured');
+    }
+
+    try {
+      if (provider.oauth === 1) {
+        return await handleOAuth1Callback(ctx, provider, callbackUrl);
+      }
+      return await handleOAuth2Callback(ctx, provider, callbackUrl, redirectUri);
+    } catch (err) {
+      ctx.session.grant = {};
+      return redirectWithPayload(ctx, callbackUrl, {
+        error: 'oauth_error',
+        error_description: err.message,
+      });
+    }
+  };
+};
+
+module.exports = {
+  createOAuthConnectMiddleware,
+  parseConnectPath,
+  buildProviderConfig,
+  redirectWithPayload,
+};

package/server/src/utils/oauth-connect/oauth1.js

@@ -0,0 +1,169 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const { URLSearchParams } = require('node:url');
+
+const encode = (str) =>
+  encodeURIComponent(str).replace(
+    /[!'()*]/g,
+    (c) => `%${c.codePointAt(0).toString(16).toUpperCase()}`
+  );
+
+const sortKeys = (keys) =>
+  keys.sort((a, b) => {
+    if (a < b) return -1;
+    if (a > b) return 1;
+    return 0;
+  });
+
+/**
+ * OAuth 1.0 (RFC 5849) request signature — HMAC-SHA1 is required by the protocol.
+ * This is not password storage or user-credential hashing (those use bcrypt).
+ */
+const signRfc5849BaseString = (signatureBaseString, signingMaterial) => {
+  // codeql[js/insufficient-password-hash] OAuth 1.0 signing material, not user password storage
+  return crypto.createHmac('sha1', signingMaterial).update(signatureBaseString).digest('base64');
+};
+
+const buildOAuth1Header = ({
+  method,
+  url,
+  params,
+  consumerKey,
+  clientCredential,
+  token,
+  tokenCredential,
+}) => {
+  const requestParameters = {
+    oauth_consumer_key: consumerKey,
+    oauth_nonce: crypto.randomBytes(16).toString('hex'),
+    oauth_signature_method: 'HMAC-SHA1',
+    oauth_timestamp: Math.floor(Date.now() / 1000).toString(),
+    oauth_version: '1.0',
+    ...(token ? { oauth_token: token } : {}),
+    ...params,
+  };
+
+  const paramString = sortKeys(Object.keys(requestParameters))
+    .map((key) => `${encode(key)}=${encode(requestParameters[key])}`)
+    .join('&');
+
+  const signatureBaseString = [method.toUpperCase(), encode(url), encode(paramString)].join('&');
+  const signingMaterial = `${encode(clientCredential)}&${encode(tokenCredential || '')}`;
+  const signature = signRfc5849BaseString(signatureBaseString, signingMaterial);
+
+  const headerParameters = { ...requestParameters, oauth_signature: signature };
+  const header = `OAuth ${sortKeys(Object.keys(headerParameters))
+    .map((key) => `${encode(key)}="${encode(headerParameters[key])}"`)
+    .join(', ')}`;
+
+  return header;
+};
+
+const oauth1Request = async ({
+  method,
+  url,
+  consumerKey,
+  clientCredential,
+  token,
+  tokenCredential,
+  params = {},
+}) => {
+  const authorization = buildOAuth1Header({
+    method,
+    url,
+    params,
+    consumerKey,
+    clientCredential,
+    token,
+    tokenCredential,
+  });
+
+  const response = await fetch(url, {
+    method,
+    headers: { Authorization: authorization },
+  });
+
+  const text = await response.text();
+  if (!response.ok) {
+    throw new Error(text || `OAuth1 request failed (${response.status})`);
+  }
+
+  return Object.fromEntries(new URLSearchParams(text));
+};
+
+const requestToken = async ({ requestUrl, redirectUri, consumerKey, clientCredential }) =>
+  oauth1Request({
+    method: 'POST',
+    url: requestUrl,
+    consumerKey,
+    clientCredential,
+    params: { oauth_callback: redirectUri },
+  });
+
+const accessToken = async ({
+  accessUrl,
+  consumerKey,
+  clientCredential,
+  oauthToken,
+  oauthVerifier,
+  oauthTokenCredential,
+}) =>
+  oauth1Request({
+    method: 'POST',
+    url: accessUrl,
+    consumerKey,
+    clientCredential,
+    token: oauthToken,
+    tokenCredential: oauthTokenCredential,
+    params: { oauth_verifier: oauthVerifier },
+  });
+
+const twitterGet = async ({
+  url,
+  accessToken,
+  accessCredential,
+  consumerKey,
+  clientCredential,
+  qs = {},
+}) => {
+  const target = new URL(url);
+  const signedParams = {};
+
+  Object.entries(qs).forEach(([key, value]) => {
+    if (value !== undefined && value !== null) {
+      const stringValue = String(value);
+      target.searchParams.set(key, stringValue);
+      // RFC 5849 §3.4.1: base-string URI excludes the query; params are signed separately.
+      signedParams[key] = stringValue;
+    }
+  });
+
+  const authorization = buildOAuth1Header({
+    method: 'GET',
+    url: target.origin + target.pathname,
+    params: signedParams,
+    consumerKey,
+    clientCredential,
+    token: accessToken,
+    tokenCredential: accessCredential,
+  });
+
+  const response = await fetch(target, {
+    headers: { Authorization: authorization },
+  });
+
+  const body = await response.json();
+  if (!response.ok) {
+    throw new Error(body.errors?.[0]?.message || `Twitter API error (${response.status})`);
+  }
+
+  return { body };
+};
+
+module.exports = {
+  buildOAuth1Header,
+  requestToken,
+  accessToken,
+  twitterGet,
+};