@strapi/plugin-users-permissions 4.0.0-next.6 → 4.0.0

package/controllers/user/admin.js

@@ -1,230 +0,0 @@
-'use strict';
-
-const _ = require('lodash');
-const { contentTypes: contentTypesUtils } = require('@strapi/utils');
-
-const { getService } = require('../../utils');
-
-const { UPDATED_BY_ATTRIBUTE, CREATED_BY_ATTRIBUTE } = contentTypesUtils.constants;
-
-const formatError = error => [
-  { messages: [{ id: error.id, message: error.message, field: error.field }] },
-];
-
-const userModel = 'plugins::users-permissions.user';
-const ACTIONS = {
-  read: 'plugins::content-manager.explorer.read',
-  create: 'plugins::content-manager.explorer.create',
-  edit: 'plugins::content-manager.explorer.update',
-  delete: 'plugins::content-manager.explorer.delete',
-};
-
-const findEntityAndCheckPermissions = async (ability, action, model, id) => {
-  const entity = await strapi.query('plugins::users-permissions.user').findOne({ where: { id } });
-
-  if (_.isNil(entity)) {
-    throw strapi.errors.notFound();
-  }
-
-  const pm = strapi.admin.services.permission.createPermissionsManager({ ability, action, model });
-
-  const roles = _.has(entity, `${CREATED_BY_ATTRIBUTE}.id`)
-    ? await strapi.query('strapi::role').findMany({
-        where: {
-          users: { id: entity[CREATED_BY_ATTRIBUTE].id },
-        },
-      })
-    : [];
-
-  const entityWithRoles = _.set(_.cloneDeep(entity), `${CREATED_BY_ATTRIBUTE}.roles`, roles);
-
-  if (pm.ability.cannot(pm.action, pm.toSubject(entityWithRoles))) {
-    throw strapi.errors.forbidden();
-  }
-
-  return { pm, entity };
-};
-
-module.exports = {
-  /**
-   * Create a/an user record.
-   * @return {Object}
-   */
-  async create(ctx) {
-    const {
-      request: { body },
-      state: { userAbility, admin },
-    } = ctx;
-    const { email, username, password } = body;
-
-    const pm = strapi.admin.services.permission.createPermissionsManager({
-      ability: userAbility,
-      action: ACTIONS.create,
-      model: userModel,
-    });
-
-    if (!pm.isAllowed) {
-      throw strapi.errors.forbidden();
-    }
-
-    const sanitizedBody = pm.pickPermittedFieldsOf(body, { subject: userModel });
-
-    const advanced = await strapi
-      .store({
-        environment: '',
-        type: 'plugin',
-        name: 'users-permissions',
-        key: 'advanced',
-      })
-      .get();
-
-    if (!email) return ctx.badRequest('missing.email');
-    if (!username) return ctx.badRequest('missing.username');
-    if (!password) return ctx.badRequest('missing.password');
-
-    const userWithSameUsername = await strapi
-      .query('plugins::users-permissions.user')
-      .findOne({ where: { username } });
-
-    if (userWithSameUsername) {
-      return ctx.badRequest(
-        null,
-        formatError({
-          id: 'Auth.form.error.username.taken',
-          message: 'Username already taken.',
-          field: ['username'],
-        })
-      );
-    }
-
-    if (advanced.unique_email) {
-      const userWithSameEmail = await strapi
-        .query('plugins::users-permissions.user')
-        .findOne({ where: { email: email.toLowerCase() } });
-
-      if (userWithSameEmail) {
-        return ctx.badRequest(
-          null,
-
-          formatError({
-            id: 'Auth.form.error.email.taken',
-            message: 'Email already taken.',
-            field: ['email'],
-          })
-        );
-      }
-    }
-
-    const user = {
-      ...sanitizedBody,
-      provider: 'local',
-      [CREATED_BY_ATTRIBUTE]: admin.id,
-      [UPDATED_BY_ATTRIBUTE]: admin.id,
-    };
-
-    user.email = user.email.toLowerCase();
-
-    if (!user.role) {
-      const defaultRole = await strapi
-        .query('plugins::users-permissions.role')
-        .findOne({ where: { type: advanced.default_role } });
-
-      user.role = defaultRole.id;
-    }
-
-    try {
-      const data = await strapi.plugins['users-permissions'].services.user.add(user);
-
-      ctx.created(pm.sanitize(data, { action: ACTIONS.read }));
-    } catch (error) {
-      ctx.badRequest(null, formatError(error));
-    }
-  },
-  /**
-   * Update a/an user record.
-   * @return {Object}
-   */
-
-  async update(ctx) {
-    const advancedConfigs = await strapi
-      .store({
-        environment: '',
-        type: 'plugin',
-        name: 'users-permissions',
-        key: 'advanced',
-      })
-      .get();
-
-    const {
-      params: { id },
-      request: { body },
-      state: { userAbility, admin },
-    } = ctx;
-    const { email, username, password } = body;
-
-    const { pm, entity: user } = await findEntityAndCheckPermissions(
-      userAbility,
-      ACTIONS.edit,
-      userModel,
-      id
-    );
-
-    if (_.has(body, 'email') && !email) {
-      return ctx.badRequest('email.notNull');
-    }
-
-    if (_.has(body, 'username') && !username) {
-      return ctx.badRequest('username.notNull');
-    }
-
-    if (_.has(body, 'password') && !password && user.provider === 'local') {
-      return ctx.badRequest('password.notNull');
-    }
-
-    if (_.has(body, 'username')) {
-      const userWithSameUsername = await strapi
-        .query('plugins::users-permissions.user')
-        .findOne({ where: { username } });
-
-      if (userWithSameUsername && userWithSameUsername.id != id) {
-        return ctx.badRequest(
-          null,
-          formatError({
-            id: 'Auth.form.error.username.taken',
-            message: 'username.alreadyTaken.',
-            field: ['username'],
-          })
-        );
-      }
-    }
-
-    if (_.has(body, 'email') && advancedConfigs.unique_email) {
-      const userWithSameEmail = await strapi
-        .query('plugins::users-permissions.user')
-        .findOne({ where: { email: email.toLowerCase() } });
-
-      if (userWithSameEmail && userWithSameEmail.id != id) {
-        return ctx.badRequest(
-          null,
-          formatError({
-            id: 'Auth.form.error.email.taken',
-            message: 'Email already taken',
-            field: ['email'],
-          })
-        );
-      }
-      body.email = body.email.toLowerCase();
-    }
-
-    const sanitizedData = pm.pickPermittedFieldsOf(body, { subject: pm.toSubject(user) });
-    const updateData = _.omit({ ...sanitizedData, updated_by: admin.id }, 'created_by');
-
-    if (_.has(body, 'password') && password === user.password) {
-      delete updateData.password;
-    }
-
-    const data = await getService('user').edit({ id }, updateData);
-
-    ctx.body = pm.sanitize(data, { action: ACTIONS.read });
-  },
-};

package/controllers/user/api.js

@@ -1,174 +0,0 @@
-'use strict';
-
-const _ = require('lodash');
-const { sanitizeEntity } = require('@strapi/utils');
-const { getService } = require('../../utils');
-
-const sanitizeUser = user =>
-  sanitizeEntity(user, {
-    model: strapi.getModel('plugins::users-permissions.user'),
-  });
-
-const formatError = error => [
-  { messages: [{ id: error.id, message: error.message, field: error.field }] },
-];
-
-module.exports = {
-  /**
-   * Create a/an user record.
-   * @return {Object}
-   */
-  async create(ctx) {
-    const advanced = await strapi
-      .store({
-        environment: '',
-        type: 'plugin',
-        name: 'users-permissions',
-        key: 'advanced',
-      })
-      .get();
-
-    const { email, username, password, role } = ctx.request.body;
-
-    if (!email) return ctx.badRequest('missing.email');
-    if (!username) return ctx.badRequest('missing.username');
-    if (!password) return ctx.badRequest('missing.password');
-
-    const userWithSameUsername = await strapi
-      .query('plugins::users-permissions.user')
-      .findOne({ where: { username } });
-
-    if (userWithSameUsername) {
-      return ctx.badRequest(
-        null,
-        formatError({
-          id: 'Auth.form.error.username.taken',
-          message: 'Username already taken.',
-          field: ['username'],
-        })
-      );
-    }
-
-    if (advanced.unique_email) {
-      const userWithSameEmail = await strapi
-        .query('plugins::users-permissions.user')
-        .findOne({ where: { email: email.toLowerCase() } });
-
-      if (userWithSameEmail) {
-        return ctx.badRequest(
-          null,
-
-          formatError({
-            id: 'Auth.form.error.email.taken',
-            message: 'Email already taken.',
-            field: ['email'],
-          })
-        );
-      }
-    }
-
-    const user = {
-      ...ctx.request.body,
-      provider: 'local',
-    };
-
-    user.email = user.email.toLowerCase();
-
-    if (!role) {
-      const defaultRole = await strapi
-        .query('plugins::users-permissions.role')
-        .findOne({ where: { type: advanced.default_role } });
-
-      user.role = defaultRole.id;
-    }
-
-    try {
-      const data = await getService('user').add(user);
-
-      ctx.created(sanitizeUser(data));
-    } catch (error) {
-      ctx.badRequest(null, formatError(error));
-    }
-  },
-  /**
-   * Update a/an user record.
-   * @return {Object}
-   */
-
-  async update(ctx) {
-    const advancedConfigs = await strapi
-      .store({
-        environment: '',
-        type: 'plugin',
-        name: 'users-permissions',
-        key: 'advanced',
-      })
-      .get();
-
-    const { id } = ctx.params;
-    const { email, username, password } = ctx.request.body;
-
-    const user = await getService('user').fetch({
-      id,
-    });
-
-    if (_.has(ctx.request.body, 'email') && !email) {
-      return ctx.badRequest('email.notNull');
-    }
-
-    if (_.has(ctx.request.body, 'username') && !username) {
-      return ctx.badRequest('username.notNull');
-    }
-
-    if (_.has(ctx.request.body, 'password') && !password && user.provider === 'local') {
-      return ctx.badRequest('password.notNull');
-    }
-
-    if (_.has(ctx.request.body, 'username')) {
-      const userWithSameUsername = await strapi
-        .query('plugins::users-permissions.user')
-        .findOne({ where: { username } });
-
-      if (userWithSameUsername && userWithSameUsername.id != id) {
-        return ctx.badRequest(
-          null,
-          formatError({
-            id: 'Auth.form.error.username.taken',
-            message: 'username.alreadyTaken.',
-            field: ['username'],
-          })
-        );
-      }
-    }
-
-    if (_.has(ctx.request.body, 'email') && advancedConfigs.unique_email) {
-      const userWithSameEmail = await strapi
-        .query('plugins::users-permissions.user')
-        .findOne({ where: { email: email.toLowerCase() } });
-
-      if (userWithSameEmail && userWithSameEmail.id != id) {
-        return ctx.badRequest(
-          null,
-          formatError({
-            id: 'Auth.form.error.email.taken',
-            message: 'Email already taken',
-            field: ['email'],
-          })
-        );
-      }
-      ctx.request.body.email = ctx.request.body.email.toLowerCase();
-    }
-
-    let updateData = {
-      ...ctx.request.body,
-    };
-
-    if (_.has(ctx.request.body, 'password') && password === user.password) {
-      delete updateData.password;
-    }
-
-    const data = await getService('user').edit({ id }, updateData);
-
-    ctx.send(sanitizeUser(data));
-  },
-};

package/controllers/user.js

@@ -1,117 +0,0 @@
-'use strict';
-
-/**
- * User.js controller
- *
- * @description: A set of functions called "actions" for managing `User`.
- */
-
-const _ = require('lodash');
-const { sanitizeEntity } = require('@strapi/utils');
-const { getService } = require('../utils');
-const adminUserController = require('./user/admin');
-const apiUserController = require('./user/api');
-
-const sanitizeUser = user =>
-  sanitizeEntity(user, {
-    model: strapi.getModel('plugins::users-permissions.user'),
-  });
-
-const resolveController = ctx => {
-  const {
-    state: { isAuthenticatedAdmin },
-  } = ctx;
-
-  return isAuthenticatedAdmin ? adminUserController : apiUserController;
-};
-
-const resolveControllerMethod = method => ctx => {
-  const controller = resolveController(ctx);
-  const callbackFn = controller[method];
-
-  if (!_.isFunction(callbackFn)) {
-    return ctx.notFound();
-  }
-
-  return callbackFn(ctx);
-};
-
-module.exports = {
-  create: resolveControllerMethod('create'),
-  update: resolveControllerMethod('update'),
-
-  /**
-   * Retrieve user records.
-   * @return {Object|Array}
-   */
-  async find(ctx, next, { populate } = {}) {
-    const users = await getService('user').fetchAll(ctx.query, populate);
-
-    ctx.body = users.map(sanitizeUser);
-  },
-
-  /**
-   * Retrieve a user record.
-   * @return {Object}
-   */
-  async findOne(ctx) {
-    const { id } = ctx.params;
-    let data = await getService('user').fetch({ id });
-
-    if (data) {
-      data = sanitizeUser(data);
-    }
-
-    // Send 200 `ok`
-    ctx.body = data;
-  },
-
-  /**
-   * Retrieve user count.
-   * @return {Number}
-   */
-  async count(ctx) {
-    ctx.body = await getService('user').count(ctx.query);
-  },
-
-  /**
-   * Destroy a/an user record.
-   * @return {Object}
-   */
-  async destroy(ctx) {
-    const { id } = ctx.params;
-
-    const data = await getService('user').remove({ id });
-
-    ctx.send(sanitizeUser(data));
-  },
-
-  async destroyAll(ctx) {
-    const {
-      request: { query },
-    } = ctx;
-
-    const toRemove = Object.values(_.omit(query, 'source'));
-
-    // FIXME: delete many
-    const finalQuery = { id: toRemove };
-
-    const data = await getService('user').removeAll(finalQuery);
-
-    ctx.send(data);
-  },
-
-  /**
-   * Retrieve authenticated user.
-   * @return {Object|Array}
-   */
-  async me(ctx) {
-    const user = ctx.state.user;
-
-    if (!user) {
-      return ctx.badRequest(null, [{ messages: [{ id: 'No authorization header was found' }] }]);
-    }
-
-    ctx.body = sanitizeUser(user);
-  },
-};