@strapi/plugin-users-permissions 4.0.0-next.6 → 4.0.0

package/server/services/role.js

@@ -0,0 +1,177 @@
+'use strict';
+
+const _ = require('lodash');
+const { NotFoundError } = require('@strapi/utils').errors;
+const { getService } = require('../utils');
+
+module.exports = ({ strapi }) => ({
+  async createRole(params) {
+    if (!params.type) {
+      params.type = _.snakeCase(_.deburr(_.toLower(params.name)));
+    }
+
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .create({ data: _.omit(params, ['users', 'permissions']) });
+
+    const createPromises = _.flatMap(params.permissions, (type, typeName) => {
+      return _.flatMap(type.controllers, (controller, controllerName) => {
+        return _.reduce(
+          controller,
+          (acc, action, actionName) => {
+            const { enabled /* policy */ } = action;
+
+            if (enabled) {
+              const actionID = `${typeName}.${controllerName}.${actionName}`;
+
+              acc.push(
+                strapi
+                  .query('plugin::users-permissions.permission')
+                  .create({ data: { action: actionID, role: role.id } })
+              );
+            }
+
+            return acc;
+          },
+          []
+        );
+      });
+    });
+
+    await Promise.all(createPromises);
+  },
+
+  async getRole(roleID) {
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .findOne({ where: { id: roleID }, populate: ['permissions'] });
+
+    if (!role) {
+      throw new NotFoundError('Role not found');
+    }
+
+    const allActions = getService('users-permissions').getActions();
+
+    // Group by `type`.
+    role.permissions.forEach(permission => {
+      const [type, controller, action] = permission.action.split('.');
+
+      _.set(allActions, `${type}.controllers.${controller}.${action}`, {
+        enabled: true,
+        policy: '',
+      });
+    });
+
+    return {
+      ...role,
+      permissions: allActions,
+    };
+  },
+
+  async getRoles() {
+    const roles = await strapi.query('plugin::users-permissions.role').findMany({ sort: ['name'] });
+
+    for (const role of roles) {
+      role.nb_users = await strapi
+        .query('plugin::users-permissions.user')
+        .count({ where: { role: { id: role.id } } });
+    }
+
+    return roles;
+  },
+
+  async updateRole(roleID, data) {
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .findOne({ where: { id: roleID }, populate: ['permissions'] });
+
+    if (!role) {
+      throw new NotFoundError('Role not found');
+    }
+
+    await strapi.query('plugin::users-permissions.role').update({
+      where: { id: roleID },
+      data: _.pick(data, ['name', 'description']),
+    });
+
+    const { permissions } = data;
+
+    const newActions = _.flatMap(permissions, (type, typeName) => {
+      return _.flatMap(type.controllers, (controller, controllerName) => {
+        return _.reduce(
+          controller,
+          (acc, action, actionName) => {
+            const { enabled /* policy */ } = action;
+
+            if (enabled) {
+              acc.push(`${typeName}.${controllerName}.${actionName}`);
+            }
+
+            return acc;
+          },
+          []
+        );
+      });
+    });
+
+    const oldActions = role.permissions.map(({ action }) => action);
+
+    const toDelete = role.permissions.reduce((acc, permission) => {
+      if (!newActions.includes(permission.action)) {
+        acc.push(permission);
+      }
+      return acc;
+    }, []);
+
+    const toCreate = newActions
+      .filter(action => !oldActions.includes(action))
+      .map(action => ({ action, role: role.id }));
+
+    await Promise.all(
+      toDelete.map(permission =>
+        strapi
+          .query('plugin::users-permissions.permission')
+          .delete({ where: { id: permission.id } })
+      )
+    );
+
+    await Promise.all(
+      toCreate.map(permissionInfo =>
+        strapi.query('plugin::users-permissions.permission').create({ data: permissionInfo })
+      )
+    );
+  },
+
+  async deleteRole(roleID, publicRoleID) {
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .findOne({ where: { id: roleID }, populate: ['users', 'permissions'] });
+
+    if (!role) {
+      throw new NotFoundError('Role not found');
+    }
+
+    // Move users to guest role.
+    await Promise.all(
+      role.users.map(user => {
+        return strapi.query('plugin::users-permissions.user').update({
+          where: { id: user.id },
+          data: { role: publicRoleID },
+        });
+      })
+    );
+
+    // Remove permissions related to this role.
+    // TODO: use delete many
+    await Promise.all(
+      role.permissions.map(permission => {
+        return strapi.query('plugin::users-permissions.permission').delete({
+          where: { id: permission.id },
+        });
+      })
+    );
+
+    // Delete the role.
+    await strapi.query('plugin::users-permissions.role').delete({ where: { id: roleID } });
+  },
+});

package/{services → server/services}/user.js

@@ -9,10 +9,10 @@
 const crypto = require('crypto');
 const bcrypt = require('bcryptjs');
 
-const { sanitizeEntity, getAbsoluteServerUrl } = require('@strapi/utils');
+const { getAbsoluteServerUrl, sanitize } = require('@strapi/utils');
 const { getService } = require('../utils');
 
-module.exports = {
+module.exports = ({ strapi }) => ({
   /**
    * Promise to count users
    *
@@ -20,7 +20,7 @@ module.exports = {
    */
 
   count(params) {
-    return strapi.query('plugins::users-permissions.user').count({ where: params });
+    return strapi.query('plugin::users-permissions.user').count({ where: params });
   },
 
   /**
@@ -39,7 +39,7 @@ module.exports = {
     }
 
     return strapi
-      .query('plugins::users-permissions.user')
+      .query('plugin::users-permissions.user')
       .create({ data: values, populate: ['role'] });
   },
 
@@ -53,7 +53,7 @@ module.exports = {
     }
 
     return strapi
-      .query('plugins::users-permissions.user')
+      .query('plugin::users-permissions.user')
       .update({ where: params, data: values, populate: ['role'] });
   },
 
@@ -62,7 +62,7 @@ module.exports = {
    * @return {Promise}
    */
   fetch(params, populate) {
-    return strapi.query('plugins::users-permissions.user').findOne({ where: params, populate });
+    return strapi.query('plugin::users-permissions.user').findOne({ where: params, populate });
   },
 
   /**
@@ -71,7 +71,7 @@ module.exports = {
    */
   fetchAuthenticatedUser(id) {
     return strapi
-      .query('plugins::users-permissions.user')
+      .query('plugin::users-permissions.user')
       .findOne({ where: { id }, populate: ['role'] });
   },
 
@@ -80,7 +80,7 @@ module.exports = {
    * @return {Promise}
    */
   fetchAll(params, populate) {
-    return strapi.query('plugins::users-permissions.user').findMany({ where: params, populate });
+    return strapi.query('plugin::users-permissions.user').findMany({ where: params, populate });
   },
 
   hashPassword(user = {}) {
@@ -111,11 +111,7 @@ module.exports = {
    * @return {Promise}
    */
   async remove(params) {
-    return strapi.query('plugins::users-permissions.user').delete({ where: params });
-  },
-
-  async removeAll(params) {
-    return strapi.query('plugins::users-permissions.user').delete({ where: params });
+    return strapi.query('plugin::users-permissions.user').delete({ where: params });
   },
 
   validatePassword(password, hash) {
@@ -124,19 +120,15 @@ module.exports = {
 
   async sendConfirmationEmail(user) {
     const userPermissionService = getService('users-permissions');
-    const pluginStore = await strapi.store({
-      environment: '',
-      type: 'plugin',
-      name: 'users-permissions',
-    });
+    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });
+    const userSchema = strapi.getModel('plugin::users-permissions.user');
 
     const settings = await pluginStore
       .get({ key: 'email' })
       .then(storeEmail => storeEmail['email_confirmation'].options);
 
-    const userInfo = sanitizeEntity(user, {
-      model: strapi.getModel('plugins::users-permissions.user'),
-    });
+    // Sanitize the template's user information
+    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(userSchema, user);
 
     const confirmationToken = crypto.randomBytes(20).toString('hex');
 
@@ -144,23 +136,28 @@ module.exports = {
 
     settings.message = await userPermissionService.template(settings.message, {
       URL: `${getAbsoluteServerUrl(strapi.config)}/auth/email-confirmation`,
-      USER: userInfo,
+      USER: sanitizedUserInfo,
       CODE: confirmationToken,
     });
 
-    settings.object = await userPermissionService.template(settings.object, { USER: userInfo });
+    settings.object = await userPermissionService.template(settings.object, {
+      USER: sanitizedUserInfo,
+    });
 
     // Send an email to the user.
-    await strapi.plugins['email'].services.email.send({
-      to: user.email,
-      from:
-        settings.from.email && settings.from.name
-          ? `${settings.from.name} <${settings.from.email}>`
-          : undefined,
-      replyTo: settings.response_email,
-      subject: settings.object,
-      text: settings.message,
-      html: settings.message,
-    });
+    await strapi
+      .plugin('email')
+      .service('email')
+      .send({
+        to: user.email,
+        from:
+          settings.from.email && settings.from.name
+            ? `${settings.from.name} <${settings.from.email}>`
+            : undefined,
+        replyTo: settings.response_email,
+        subject: settings.object,
+        text: settings.message,
+        html: settings.message,
+      });
   },
-};
+});

package/server/services/users-permissions.js

@@ -0,0 +1,233 @@
+'use strict';
+
+const _ = require('lodash');
+const { filter, map, pipe, prop } = require('lodash/fp');
+
+const { getService } = require('../utils');
+
+const DEFAULT_PERMISSIONS = [
+  { action: 'plugin::users-permissions.auth.admincallback', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.adminregister', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.callback', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.connect', roleType: null },
+  { action: 'plugin::users-permissions.auth.forgotpassword', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.resetpassword', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.register', roleType: 'public' },
+  { action: 'plugin::users-permissions.auth.emailconfirmation', roleType: 'public' },
+  { action: 'plugin::users-permissions.user.me', roleType: null },
+];
+
+const transformRoutePrefixFor = pluginName => route => {
+  const prefix = route.config && route.config.prefix;
+  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;
+
+  return {
+    ...route,
+    path,
+  };
+};
+
+module.exports = ({ strapi }) => ({
+  getActions({ defaultEnable = false } = {}) {
+    const actionMap = {};
+
+    const isContentApi = action => {
+      if (!_.has(action, Symbol.for('__type__'))) {
+        return false;
+      }
+
+      return action[Symbol.for('__type__')].includes('content-api');
+    };
+
+    _.forEach(strapi.api, (api, apiName) => {
+      const controllers = _.reduce(
+        api.controllers,
+        (acc, controller, controllerName) => {
+          const contentApiActions = _.pickBy(controller, isContentApi);
+
+          if (_.isEmpty(contentApiActions)) {
+            return acc;
+          }
+
+          acc[controllerName] = _.mapValues(contentApiActions, () => {
+            return {
+              enabled: defaultEnable,
+              policy: '',
+            };
+          });
+
+          return acc;
+        },
+        {}
+      );
+
+      if (!_.isEmpty(controllers)) {
+        actionMap[`api::${apiName}`] = { controllers };
+      }
+    });
+
+    _.forEach(strapi.plugins, (plugin, pluginName) => {
+      const controllers = _.reduce(
+        plugin.controllers,
+        (acc, controller, controllerName) => {
+          const contentApiActions = _.pickBy(controller, isContentApi);
+
+          if (_.isEmpty(contentApiActions)) {
+            return acc;
+          }
+
+          acc[controllerName] = _.mapValues(contentApiActions, () => {
+            return {
+              enabled: defaultEnable,
+              policy: '',
+            };
+          });
+
+          return acc;
+        },
+        {}
+      );
+
+      if (!_.isEmpty(controllers)) {
+        actionMap[`plugin::${pluginName}`] = { controllers };
+      }
+    });
+
+    return actionMap;
+  },
+
+  async getRoutes() {
+    const routesMap = {};
+
+    _.forEach(strapi.api, (api, apiName) => {
+      const routes = _.flatMap(api.routes, route => {
+        if (_.has(route, 'routes')) {
+          return route.routes;
+        }
+
+        return route;
+      }).filter(route => route.info.type === 'content-api');
+
+      if (routes.length === 0) {
+        return;
+      }
+
+      routesMap[`api::${apiName}`] = routes.map(route => ({
+        ...route,
+        path: `/api${route.path}`,
+      }));
+    });
+
+    _.forEach(strapi.plugins, (plugin, pluginName) => {
+      const transformPrefix = transformRoutePrefixFor(pluginName);
+
+      const routes = _.flatMap(plugin.routes, route => {
+        if (_.has(route, 'routes')) {
+          return route.routes.map(transformPrefix);
+        }
+
+        return transformPrefix(route);
+      }).filter(route => route.info.type === 'content-api');
+
+      if (routes.length === 0) {
+        return;
+      }
+
+      routesMap[`plugin::${pluginName}`] = routes.map(route => ({
+        ...route,
+        path: `/api${route.path}`,
+      }));
+    });
+
+    return routesMap;
+  },
+
+  async syncPermissions() {
+    const roles = await strapi.query('plugin::users-permissions.role').findMany();
+    const dbPermissions = await strapi.query('plugin::users-permissions.permission').findMany();
+
+    const permissionsFoundInDB = _.uniq(_.map(dbPermissions, 'action'));
+
+    const appActions = _.flatMap(strapi.api, (api, apiName) => {
+      return _.flatMap(api.controllers, (controller, controllerName) => {
+        return _.keys(controller).map(actionName => {
+          return `api::${apiName}.${controllerName}.${actionName}`;
+        });
+      });
+    });
+
+    const pluginsActions = _.flatMap(strapi.plugins, (plugin, pluginName) => {
+      return _.flatMap(plugin.controllers, (controller, controllerName) => {
+        return _.keys(controller).map(actionName => {
+          return `plugin::${pluginName}.${controllerName}.${actionName}`;
+        });
+      });
+    });
+
+    const allActions = [...appActions, ...pluginsActions];
+
+    const toDelete = _.difference(permissionsFoundInDB, allActions);
+
+    await Promise.all(
+      toDelete.map(action => {
+        return strapi.query('plugin::users-permissions.permission').delete({ where: { action } });
+      })
+    );
+
+    if (permissionsFoundInDB.length === 0) {
+      // create default permissions
+      for (const role of roles) {
+        const toCreate = pipe(
+          filter(({ roleType }) => roleType === role.type || roleType === null),
+          map(prop('action'))
+        )(DEFAULT_PERMISSIONS);
+
+        await Promise.all(
+          toCreate.map(action => {
+            return strapi.query('plugin::users-permissions.permission').create({
+              data: {
+                action,
+                role: role.id,
+              },
+            });
+          })
+        );
+      }
+    }
+  },
+
+  async initialize() {
+    const roleCount = await strapi.query('plugin::users-permissions.role').count();
+
+    if (roleCount === 0) {
+      await strapi.query('plugin::users-permissions.role').create({
+        data: {
+          name: 'Authenticated',
+          description: 'Default role given to authenticated user.',
+          type: 'authenticated',
+        },
+      });
+
+      await strapi.query('plugin::users-permissions.role').create({
+        data: {
+          name: 'Public',
+          description: 'Default role given to unauthenticated user.',
+          type: 'public',
+        },
+      });
+    }
+
+    return getService('users-permissions').syncPermissions();
+  },
+
+  async updateUserRole(user, role) {
+    return strapi
+      .query('plugin::users-permissions.user')
+      .update({ where: { id: user.id }, data: { role } });
+  },
+
+  template(layout, data) {
+    const compiledObject = _.template(layout);
+    return compiledObject(data);
+  },
+});

package/server/strategies/users-permissions.js

@@ -0,0 +1,123 @@
+'use strict';
+
+const { castArray, map } = require('lodash/fp');
+const { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;
+
+const { getService } = require('../utils');
+
+const getAdvancedSettings = () => {
+  return strapi.store({ type: 'plugin', name: 'users-permissions' }).get({ key: 'advanced' });
+};
+
+const authenticate = async ctx => {
+  try {
+    const token = await getService('jwt').getToken(ctx);
+
+    if (token) {
+      const { id } = token;
+
+      if (id === undefined) {
+        return { authenticated: false };
+      }
+
+      // fetch authenticated user
+      const user = await getService('user').fetchAuthenticatedUser(id);
+
+      if (!user) {
+        return { error: 'Invalid credentials' };
+      }
+
+      const advancedSettings = await getAdvancedSettings();
+
+      if (advancedSettings.email_confirmation && !user.confirmed) {
+        return { error: 'Invalid credentials' };
+      }
+
+      if (user.blocked) {
+        return { error: 'Invalid credentials' };
+      }
+
+      ctx.state.user = user;
+
+      return {
+        authenticated: true,
+        credentials: user,
+      };
+    }
+
+    const publicPermissions = await strapi.query('plugin::users-permissions.permission').findMany({
+      where: {
+        role: { type: 'public' },
+      },
+    });
+
+    if (publicPermissions.length === 0) {
+      return { authenticated: false };
+    }
+
+    return {
+      authenticated: true,
+      credentials: null,
+    };
+  } catch (err) {
+    return { authenticated: false };
+  }
+};
+
+const verify = async (auth, config) => {
+  const { credentials: user } = auth;
+
+  // public accesss
+  if (!user) {
+    // test against public role
+    const publicPermissions = await strapi.query('plugin::users-permissions.permission').findMany({
+      where: {
+        role: { type: 'public' },
+      },
+    });
+
+    const allowedActions = map('action', publicPermissions);
+
+    // A non authenticated user cannot access routes that do not have a scope
+    if (!config.scope) {
+      throw new UnauthorizedError();
+    }
+
+    const isAllowed = castArray(config.scope).every(scope => allowedActions.includes(scope));
+
+    if (!isAllowed) {
+      throw new ForbiddenError();
+    }
+
+    return;
+  }
+
+  const permissions = await strapi.query('plugin::users-permissions.permission').findMany({
+    where: { role: user.role.id },
+  });
+
+  const allowedActions = map('action', permissions);
+
+  // An authenticated user can access non scoped routes
+  if (!config.scope) {
+    return;
+  }
+
+  const isAllowed = castArray(config.scope).every(scope => allowedActions.includes(scope));
+
+  if (!isAllowed) {
+    throw new ForbiddenError();
+  }
+
+  // TODO: if we need to keep policies for u&p execution
+  // Execute the policies.
+  // if (permission.policy) {
+  //   return await strapi.plugin('users-permissions').policy(permission.policy)(ctx, next);
+  // }
+};
+
+module.exports = {
+  name: 'users-permissions',
+  authenticate,
+  verify,
+};

package/{utils → server/utils}/index.d.ts

@@ -1,11 +1,16 @@
 import * as usersPermissions from '../services/users-permissions';
 import * as user from '../services/user';
+import * as role from '../services/role';
 import * as jwt from '../services/jwt';
+import * as providers from '../services/providers';
+
 
 type S = {
   ['users-permissions']: typeof usersPermissions;
+  ['role']: typeof role;
   user: typeof user;
   jwt: typeof jwt;
+  providers: typeof providers;
 };
 
-export function getService<T extends keyof S>(name: T): S[T];
+export function getService<T extends keyof S>(name: T): ReturnType<S[T]>;

package/server/utils/index.js

@@ -0,0 +1,9 @@
+'use strict';
+
+const getService = name => {
+  return strapi.plugin('users-permissions').service(name);
+};
+
+module.exports = {
+  getService,
+};