@strapi/plugin-users-permissions 4.0.0-next.9 → 4.0.0

package/server/controllers/users-permissions.js

@@ -1,271 +0,0 @@
-'use strict';
-
-const _ = require('lodash');
-const { getService } = require('../utils');
-const { isValidEmailTemplate } = require('./validation/email-template');
-
-module.exports = {
-  /**
-   * Default action.
-   *
-   * @return {Object}
-   */
-  async createRole(ctx) {
-    if (_.isEmpty(ctx.request.body)) {
-      return ctx.badRequest(null, [{ messages: [{ id: 'Cannot be empty' }] }]);
-    }
-
-    try {
-      await getService('users-permissions').createRole(ctx.request.body);
-
-      ctx.send({ ok: true });
-    } catch (err) {
-      strapi.log.error(err);
-      ctx.badRequest(null, [{ messages: [{ id: 'An error occured' }] }]);
-    }
-  },
-
-  async deleteRole(ctx) {
-    // Fetch public role.
-    const publicRole = await strapi
-      .query('plugin::users-permissions.role')
-      .findOne({ where: { type: 'public' } });
-
-    const publicRoleID = publicRole.id;
-
-    const roleID = ctx.params.role;
-
-    if (!roleID) {
-      return ctx.badRequest(null, [{ messages: [{ id: 'Bad request' }] }]);
-    }
-
-    // Prevent from removing the public role.
-    if (roleID.toString() === publicRoleID.toString()) {
-      return ctx.badRequest(null, [{ messages: [{ id: 'Unauthorized' }] }]);
-    }
-
-    try {
-      await getService('users-permissions').deleteRole(roleID, publicRoleID);
-
-      ctx.send({ ok: true });
-    } catch (err) {
-      strapi.log.error(err);
-      ctx.badRequest(null, [{ messages: [{ id: 'Bad request' }] }]);
-    }
-  },
-
-  async getPermissions(ctx) {
-    try {
-      const permissions = await getService('users-permissions').getActions();
-
-      ctx.send({ permissions });
-    } catch (err) {
-      ctx.badRequest(null, [{ message: [{ id: 'Not Found' }] }]);
-    }
-  },
-
-  async getPolicies(ctx) {
-    const policies = _.keys(strapi.plugin('users-permissions').policies);
-
-    ctx.send({
-      policies: _.without(policies, 'permissions'),
-    });
-  },
-
-  async getRole(ctx) {
-    const { id } = ctx.params;
-    const { lang } = ctx.query;
-    const plugins = await getService('users-permissions').getPlugins(lang);
-    const role = await getService('users-permissions').getRole(id, plugins);
-
-    if (_.isEmpty(role)) {
-      return ctx.badRequest(null, [{ messages: [{ id: `Role don't exist` }] }]);
-    }
-
-    ctx.send({ role });
-  },
-
-  async getRoles(ctx) {
-    try {
-      const roles = await getService('users-permissions').getRoles();
-
-      ctx.send({ roles });
-    } catch (err) {
-      ctx.badRequest(null, [{ messages: [{ id: 'Not found' }] }]);
-    }
-  },
-
-  async getRoutes(ctx) {
-    try {
-      const routes = await getService('users-permissions').getRoutes();
-
-      ctx.send({ routes });
-    } catch (err) {
-      ctx.badRequest(null, [{ messages: [{ id: 'Not found' }] }]);
-    }
-  },
-
-  async index(ctx) {
-    // Send 200 `ok`
-    ctx.send({ message: 'ok' });
-  },
-
-  async searchUsers(ctx) {
-    const { id } = ctx.params;
-
-    const data = await strapi.query('plugin::users-permissions.user').custom(searchQueries)({
-      id,
-    });
-
-    ctx.send(data);
-  },
-
-  async updateRole(ctx) {
-    const roleID = ctx.params.role;
-
-    if (_.isEmpty(ctx.request.body)) {
-      return ctx.badRequest(null, [{ messages: [{ id: 'Bad request' }] }]);
-    }
-
-    try {
-      await getService('users-permissions').updateRole(roleID, ctx.request.body);
-
-      ctx.send({ ok: true });
-    } catch (err) {
-      strapi.log.error(err);
-      ctx.badRequest(null, [{ messages: [{ id: 'An error occurred' }] }]);
-    }
-  },
-
-  async getEmailTemplate(ctx) {
-    ctx.send(
-      await strapi
-        .store({
-          environment: '',
-          type: 'plugin',
-          name: 'users-permissions',
-          key: 'email',
-        })
-        .get()
-    );
-  },
-
-  async updateEmailTemplate(ctx) {
-    if (_.isEmpty(ctx.request.body)) {
-      return ctx.badRequest(null, [{ messages: [{ id: 'Cannot be empty' }] }]);
-    }
-
-    const emailTemplates = ctx.request.body['email-templates'];
-
-    for (let key in emailTemplates) {
-      const template = emailTemplates[key].options.message;
-
-      if (!isValidEmailTemplate(template)) {
-        return ctx.badRequest(null, [{ messages: [{ id: 'Invalid template' }] }]);
-      }
-    }
-
-    await strapi
-      .store({
-        environment: '',
-        type: 'plugin',
-        name: 'users-permissions',
-        key: 'email',
-      })
-      .set({ value: emailTemplates });
-
-    ctx.send({ ok: true });
-  },
-
-  async getAdvancedSettings(ctx) {
-    ctx.send({
-      settings: await strapi
-        .store({
-          environment: '',
-          type: 'plugin',
-          name: 'users-permissions',
-          key: 'advanced',
-        })
-        .get(),
-      roles: await getService('users-permissions').getRoles(),
-    });
-  },
-
-  async updateAdvancedSettings(ctx) {
-    if (_.isEmpty(ctx.request.body)) {
-      return ctx.badRequest(null, [{ messages: [{ id: 'Cannot be empty' }] }]);
-    }
-
-    await strapi
-      .store({
-        environment: '',
-        type: 'plugin',
-        name: 'users-permissions',
-        key: 'advanced',
-      })
-      .set({ value: ctx.request.body });
-
-    ctx.send({ ok: true });
-  },
-
-  async getProviders(ctx) {
-    const providers = await strapi
-      .store({
-        environment: '',
-        type: 'plugin',
-        name: 'users-permissions',
-        key: 'grant',
-      })
-      .get();
-
-    for (const provider in providers) {
-      if (provider !== 'email') {
-        providers[provider].redirectUri = strapi
-          .plugin('users-permissions')
-          .service('providers')
-          .buildRedirectUri(provider);
-      }
-    }
-
-    ctx.send(providers);
-  },
-
-  async updateProviders(ctx) {
-    if (_.isEmpty(ctx.request.body)) {
-      return ctx.badRequest(null, [{ messages: [{ id: 'Cannot be empty' }] }]);
-    }
-
-    await strapi
-      .store({
-        environment: '',
-        type: 'plugin',
-        name: 'users-permissions',
-        key: 'grant',
-      })
-      .set({ value: ctx.request.body.providers });
-
-    ctx.send({ ok: true });
-  },
-};
-
-const searchQueries = {
-  bookshelf({ model }) {
-    return ({ id }) => {
-      return model
-        .query(function(qb) {
-          qb.where('username', 'LIKE', `%${id}%`).orWhere('email', 'LIKE', `%${id}%`);
-        })
-        .fetchAll()
-        .then(results => results.toJSON());
-    };
-  },
-  mongoose({ model }) {
-    return ({ id }) => {
-      const re = new RegExp(id);
-
-      return model.find({
-        $or: [{ username: re }, { email: re }],
-      });
-    };
-  },
-};

package/server/middlewares/users-permissions.js

@@ -1,44 +0,0 @@
-'use strict';
-
-const _ = require('lodash');
-
-module.exports = {
-  defaults: { 'users-permissions': { enabled: true } },
-  load: {
-    beforeInitialize() {
-      strapi.config.middleware.load.before.unshift('users-permissions');
-    },
-
-    initialize() {
-      _.forEach(strapi.admin.routes, value => {
-        if (_.get(value.config, 'policies')) {
-          value.config.policies.unshift('plugin::users-permissions.permissions');
-        }
-      });
-
-      _.forEach(strapi.api, api => {
-        _.forEach(api.routes, route => {
-          if (_.has(route, 'routes')) {
-            _.forEach(route.routes || [], route => {
-              if (_.get(route.config, 'policies')) {
-                route.config.policies.unshift('plugin::users-permissions.permissions');
-              }
-            });
-          } else if (_.get(route.config, 'policies')) {
-            route.config.policies.unshift('plugin::users-permissions.permissions');
-          }
-        });
-      });
-
-      if (strapi.plugins) {
-        _.forEach(strapi.plugins, plugin => {
-          _.forEach(plugin.routes, route => {
-            if (_.get(route.config, 'policies')) {
-              route.config.policies.unshift('plugin::users-permissions.permissions');
-            }
-          });
-        });
-      }
-    },
-  },
-};

package/server/policies/index.js

@@ -1,11 +0,0 @@
-'use strict';
-
-const isAuthenticated = require('./isAuthenticated');
-const permissions = require('./permissions');
-const rateLimit = require('./rateLimit');
-
-module.exports = {
-  isAuthenticated,
-  permissions,
-  rateLimit,
-};

package/server/policies/isAuthenticated.js

@@ -1,9 +0,0 @@
-'use strict';
-
-module.exports = async (ctx, next) => {
-  if (!ctx.state.user) {
-    return ctx.unauthorized();
-  }
-
-  await next();
-};

package/server/policies/permissions.js

@@ -1,94 +0,0 @@
-'use strict';
-
-const _ = require('lodash');
-const { getService } = require('../utils');
-
-module.exports = async (ctx, next) => {
-  let role;
-
-  if (ctx.state.user) {
-    // request is already authenticated in a different way
-    return next();
-  }
-
-  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {
-    try {
-      const { id } = await getService('jwt').getToken(ctx);
-
-      if (id === undefined) {
-        throw new Error('Invalid token: Token did not contain required fields');
-      }
-
-      // fetch authenticated user
-      ctx.state.user = await getService('user').fetchAuthenticatedUser(id);
-    } catch (err) {
-      return handleErrors(ctx, err, 'unauthorized');
-    }
-
-    if (!ctx.state.user) {
-      return handleErrors(ctx, 'User Not Found', 'unauthorized');
-    }
-
-    role = ctx.state.user.role;
-
-    if (role.type === 'root') {
-      return await next();
-    }
-
-    const store = await strapi.store({
-      environment: '',
-      type: 'plugin',
-      name: 'users-permissions',
-    });
-
-    if (
-      _.get(await store.get({ key: 'advanced' }), 'email_confirmation') &&
-      !ctx.state.user.confirmed
-    ) {
-      return handleErrors(ctx, 'Your account email is not confirmed.', 'unauthorized');
-    }
-
-    if (ctx.state.user.blocked) {
-      return handleErrors(
-        ctx,
-        'Your account has been blocked by the administrator.',
-        'unauthorized'
-      );
-    }
-  }
-
-  // Retrieve `public` role.
-  if (!role) {
-    role = await strapi
-      .query('plugin::users-permissions.role')
-      .findOne({ where: { type: 'public' } });
-  }
-
-  const route = ctx.request.route;
-
-  const permission = await strapi.query('plugin::users-permissions.permission').findOne({
-    where: {
-      role: { id: role.id },
-      type: route.plugin || 'application',
-      controller: route.controller,
-      action: route.action,
-      enabled: true,
-    },
-  });
-
-  if (!permission) {
-    return handleErrors(ctx, undefined, 'forbidden');
-  }
-
-  // Execute the policies.
-  if (permission.policy) {
-    return await strapi.plugin('users-permissions').policy(permission.policy)(ctx, next);
-  }
-
-  // Execute the action.
-  await next();
-};
-
-const handleErrors = (ctx, err = undefined, type) => {
-  throw strapi.errors[type](err);
-};