@strapi/plugin-users-permissions 0.0.0-next.e50ef5e2ea57ecf3da5bcf308508b51ee3c0deca → 0.0.0-next.e5b87a54008c9de2b3286a4774635dcf69895d9b

package/server/routes/content-api/user.js

@@ -1,60 +1,117 @@
 'use strict';
 
-module.exports = [
-  {
-    method: 'GET',
-    path: '/users/count',
-    handler: 'user.count',
-    config: {
-      prefix: '',
+const z = require('zod/v4');
+const { UsersPermissionsRouteValidator } = require('./validation');
+
+module.exports = (strapi) => {
+  const validator = new UsersPermissionsRouteValidator(strapi);
+
+  return [
+    {
+      method: 'GET',
+      path: '/users/count',
+      handler: 'user.count',
+      config: {
+        prefix: '',
+      },
+      request: {
+        query: {
+          filters: validator.filters.optional(),
+        },
+      },
+      response: z.number(),
     },
-  },
-  {
-    method: 'GET',
-    path: '/users',
-    handler: 'user.find',
-    config: {
-      prefix: '',
+    {
+      method: 'GET',
+      path: '/users',
+      handler: 'user.find',
+      config: {
+        prefix: '',
+      },
+      request: {
+        query: {
+          fields: validator.queryFields.optional(),
+          populate: validator.queryPopulate.optional(),
+          sort: validator.querySort.optional(),
+          pagination: validator.pagination.optional(),
+          filters: validator.filters.optional(),
+        },
+      },
+      response: z.array(validator.userSchema),
     },
-  },
-  {
-    method: 'GET',
-    path: '/users/me',
-    handler: 'user.me',
-    config: {
-      prefix: '',
+    {
+      method: 'GET',
+      path: '/users/me',
+      handler: 'user.me',
+      config: {
+        prefix: '',
+      },
+      request: {
+        query: {
+          fields: validator.queryFields.optional(),
+          populate: validator.queryPopulate.optional(),
+        },
+      },
+      response: validator.userSchema,
     },
-  },
-  {
-    method: 'GET',
-    path: '/users/:id',
-    handler: 'user.findOne',
-    config: {
-      prefix: '',
+    {
+      method: 'GET',
+      path: '/users/:id',
+      handler: 'user.findOne',
+      config: {
+        prefix: '',
+      },
+      request: {
+        params: {
+          id: validator.userIdParam,
+        },
+        query: {
+          fields: validator.queryFields.optional(),
+          populate: validator.queryPopulate.optional(),
+        },
+      },
+      response: validator.userSchema,
     },
-  },
-  {
-    method: 'POST',
-    path: '/users',
-    handler: 'user.create',
-    config: {
-      prefix: '',
+    {
+      method: 'POST',
+      path: '/users',
+      handler: 'user.create',
+      config: {
+        prefix: '',
+      },
+      request: {
+        body: { 'application/json': validator.createUserBodySchema },
+      },
+      response: validator.userSchema,
     },
-  },
-  {
-    method: 'PUT',
-    path: '/users/:id',
-    handler: 'user.update',
-    config: {
-      prefix: '',
+    {
+      method: 'PUT',
+      path: '/users/:id',
+      handler: 'user.update',
+      config: {
+        prefix: '',
+      },
+      request: {
+        params: {
+          id: validator.userIdParam,
+        },
+        body: { 'application/json': validator.updateUserBodySchema },
+      },
+      response: validator.userSchema,
     },
-  },
-  {
-    method: 'DELETE',
-    path: '/users/:id',
-    handler: 'user.destroy',
-    config: {
-      prefix: '',
+    {
+      method: 'DELETE',
+      path: '/users/:id',
+      handler: 'user.destroy',
+      config: {
+        prefix: '',
+      },
+      request: {
+        params: {
+          id: validator.userIdParam,
+        },
+      },
+      response: validator.userSchema,
     },
-  },
-];
+  ];
+};

package/server/routes/content-api/validation.js

@@ -0,0 +1,250 @@
+'use strict';
+
+const { AbstractRouteValidator } = require('@strapi/utils');
+const z = require('zod/v4');
+
+class UsersPermissionsRouteValidator extends AbstractRouteValidator {
+  constructor(strapi) {
+    super();
+    this._strapi = strapi;
+  }
+
+  get userSchema() {
+    return z.object({
+      id: z.number(),
+      documentId: z.string(),
+      username: z.string(),
+      email: z.string(),
+      provider: z.string(),
+      confirmed: z.boolean(),
+      blocked: z.boolean(),
+      role: z
+        .union([
+          z.number(),
+          z.object({
+            id: z.number(),
+            name: z.string(),
+            description: z.string().nullable(),
+            type: z.string(),
+            createdAt: z.string(),
+            updatedAt: z.string(),
+          }),
+        ])
+        .optional(),
+      createdAt: z.string(),
+      updatedAt: z.string(),
+      publishedAt: z.string(),
+    });
+  }
+
+  get roleSchema() {
+    return z.object({
+      id: z.number(),
+      documentId: z.string(),
+      name: z.string(),
+      description: z.string().nullable(),
+      type: z.string(),
+      createdAt: z.string(),
+      updatedAt: z.string(),
+      publishedAt: z.string(),
+      nb_users: z.number().optional(),
+      permissions: z
+        .record(
+          z.string(), // plugin name
+          z.object({
+            controllers: z.record(
+              z.string(), // controller name
+              z.record(
+                z.string(), // action name
+                z.object({
+                  enabled: z.boolean(),
+                  policy: z.string(),
+                })
+              )
+            ),
+          })
+        )
+        .optional(),
+      users: z.array(z.unknown()).optional(),
+    });
+  }
+
+  get permissionSchema() {
+    return z.object({
+      id: z.number(),
+      action: z.string(),
+      role: z.object({
+        id: z.number(),
+        name: z.string(),
+        description: z.string().nullable(),
+        type: z.string(),
+      }),
+      createdAt: z.string(),
+      updatedAt: z.string(),
+    });
+  }
+
+  get authResponseSchema() {
+    return z.object({
+      jwt: z.string(),
+      refreshToken: z.string().optional(),
+      user: this.userSchema,
+    });
+  }
+
+  get authResponseWithoutJwtSchema() {
+    return z.object({
+      user: this.userSchema,
+    });
+  }
+
+  get authRegisterResponseSchema() {
+    return z.union([this.authResponseSchema, this.authResponseWithoutJwtSchema]);
+  }
+
+  get forgotPasswordResponseSchema() {
+    return z.object({
+      ok: z.boolean(),
+    });
+  }
+
+  get sendEmailConfirmationResponseSchema() {
+    return z.object({
+      email: z.string(),
+      sent: z.boolean(),
+    });
+  }
+
+  get rolesResponseSchema() {
+    return z.object({
+      roles: z.array(this.roleSchema),
+    });
+  }
+
+  get roleResponseSchema() {
+    return z.object({
+      role: this.roleSchema,
+    });
+  }
+
+  get roleSuccessResponseSchema() {
+    return z.object({
+      ok: z.boolean(),
+    });
+  }
+
+  get permissionsResponseSchema() {
+    return z.object({
+      permissions: z.record(
+        z.string(), // plugin name
+        z.object({
+          controllers: z.record(
+            z.string(), // controller name
+            z.record(
+              z.string(), // action name
+              z.object({
+                enabled: z.boolean(),
+                policy: z.string(),
+              })
+            )
+          ),
+        })
+      ),
+    });
+  }
+
+  get loginBodySchema() {
+    return z.object({
+      identifier: z.string(),
+      password: z.string(),
+    });
+  }
+
+  get registerBodySchema() {
+    return z.object({
+      username: z.string(),
+      email: z.email(),
+      password: z.string(),
+    });
+  }
+
+  get forgotPasswordBodySchema() {
+    return z.object({
+      email: z.email(),
+    });
+  }
+
+  get resetPasswordBodySchema() {
+    return z.object({
+      code: z.string(),
+      password: z.string(),
+      passwordConfirmation: z.string(),
+    });
+  }
+
+  get changePasswordBodySchema() {
+    return z.object({
+      currentPassword: z.string(),
+      password: z.string(),
+      passwordConfirmation: z.string(),
+    });
+  }
+
+  get sendEmailConfirmationBodySchema() {
+    return z.object({
+      email: z.email(),
+    });
+  }
+
+  get createUserBodySchema() {
+    return z.object({
+      username: z.string(),
+      email: z.email(),
+      password: z.string(),
+      role: z.number().optional(),
+    });
+  }
+
+  get updateUserBodySchema() {
+    return z.object({
+      username: z.string().optional(),
+      email: z.email().optional(),
+      password: z.string().optional(),
+      role: z.number().optional(),
+    });
+  }
+
+  get createRoleBodySchema() {
+    return z.object({
+      name: z.string(),
+      description: z.string().optional(),
+      type: z.string(),
+      permissions: z.record(z.string(), z.unknown()).optional(),
+    });
+  }
+
+  get updateRoleBodySchema() {
+    return z.object({
+      name: z.string().optional(),
+      description: z.string().optional(),
+      type: z.string().optional(),
+      permissions: z.record(z.string(), z.unknown()).optional(),
+    });
+  }
+
+  get userIdParam() {
+    return z.string();
+  }
+
+  get roleIdParam() {
+    return z.string();
+  }
+
+  get providerParam() {
+    return z.string();
+  }
+}
+
+module.exports = {
+  UsersPermissionsRouteValidator,
+};

package/server/services/constants.js

@@ -0,0 +1,9 @@
+'use strict';
+
+module.exports = {
+  DEFAULT_ACCESS_TOKEN_LIFESPAN: 10 * 60, // 10 minutes
+  DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN: 30 * 24 * 60 * 60, // 30 days
+  DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN: 14 * 24 * 60 * 60, // 14 days
+  DEFAULT_MAX_SESSION_LIFESPAN: 1 * 24 * 60 * 60, // 1 day
+  DEFAULT_IDLE_SESSION_LIFESPAN: 2 * 60 * 60, // 2 hours
+};

package/server/services/jwt.js

@@ -29,6 +29,32 @@ module.exports = ({ strapi }) => ({
   },
 
   issue(payload, jwtOptions = {}) {
+    const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+
+    if (mode === 'refresh') {
+      const userId = String(payload.id ?? payload.userId ?? '');
+      if (!userId) {
+        throw new Error('Cannot issue token: missing user id');
+      }
+
+      const issueRefreshToken = async () => {
+        const refresh = await strapi
+          .sessionManager('users-permissions')
+          .generateRefreshToken(userId, undefined, { type: 'refresh' });
+
+        const access = await strapi
+          .sessionManager('users-permissions')
+          .generateAccessToken(refresh.token);
+        if ('error' in access) {
+          throw new Error('Failed to generate access token');
+        }
+
+        return access.token;
+      };
+
+      return issueRefreshToken();
+    }
+
     _.defaults(jwtOptions, strapi.config.get('plugin::users-permissions.jwt'));
     return jwt.sign(
       _.clone(payload.toJSON ? payload.toJSON() : payload),
@@ -37,12 +63,34 @@ module.exports = ({ strapi }) => ({
     );
   },
 
-  verify(token) {
+  async verify(token) {
+    const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');
+
+    if (mode === 'refresh') {
+      // Accept only access tokens minted by the SessionManager for UP
+      const result = strapi.sessionManager('users-permissions').validateAccessToken(token);
+      if (!result.isValid || result.payload.type !== 'access') {
+        throw new Error('Invalid token.');
+      }
+
+      const user = await strapi.db
+        .query('plugin::users-permissions.user')
+        .findOne({ where: { id: Number(result.payload.userId) || result.payload.userId } });
+      if (!user) {
+        throw new Error('Invalid token.');
+      }
+
+      return { id: user.id };
+    }
+
     return new Promise((resolve, reject) => {
+      const jwtConfig = strapi.config.get('plugin::users-permissions.jwt', {});
+      const algorithms = jwtConfig && jwtConfig.algorithm ? [jwtConfig.algorithm] : undefined;
+
       jwt.verify(
         token,
         strapi.config.get('plugin::users-permissions.jwtSecret'),
-        {},
+        algorithms ? { algorithms } : {},
         (err, tokenPayload = {}) => {
           if (err) {
             return reject(new Error('Invalid token.'));

package/server/services/user.js

@@ -16,6 +16,11 @@ const { getService } = require('../utils');
 
 const USER_MODEL_UID = 'plugin::users-permissions.user';
 
+const getSessionManager = () => {
+  const manager = strapi.sessionManager;
+  return manager ?? null;
+};
+
 module.exports = ({ strapi }) => ({
   /**
    * Promise to count users
@@ -112,6 +117,12 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   async remove(params) {
+    // Invalidate sessions for all affected users
+    const sessionManager = getSessionManager();
+    if (sessionManager && sessionManager.hasOrigin('users-permissions') && params.id) {
+      await sessionManager('users-permissions').invalidateRefreshToken(String(params.id));
+    }
+
     return strapi.db.query(USER_MODEL_UID).delete({ where: params });
   },
 

package/server/services/users-permissions.js

@@ -7,6 +7,7 @@ const {
   template: { createStrictInterpolationRegExp },
   errors,
   objects,
+  sanitizeRoutesMapForSerialization,
 } = require('@strapi/utils');
 
 const { getService } = require('../utils');
@@ -19,6 +20,8 @@ const DEFAULT_PERMISSIONS = [
   { action: 'plugin::users-permissions.auth.register', roleType: 'public' },
   { action: 'plugin::users-permissions.auth.emailConfirmation', roleType: 'public' },
   { action: 'plugin::users-permissions.auth.sendEmailConfirmation', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.refresh', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.logout', roleType: 'authenticated' },
   { action: 'plugin::users-permissions.user.me', roleType: 'authenticated' },
   { action: 'plugin::users-permissions.auth.changePassword', roleType: 'authenticated' },
 ];
@@ -99,7 +102,8 @@ module.exports = ({ strapi }) => ({
       }
     });
 
-    return actionMap;
+    // Return a deeply cloned version to avoid circular references
+    return _.cloneDeep(actionMap);
   },
 
   async getRoutes() {
@@ -147,7 +151,7 @@ module.exports = ({ strapi }) => ({
       }));
     });
 
-    return routesMap;
+    return sanitizeRoutesMapForSerialization(routesMap);
   },
 
   async syncPermissions() {