@strapi/plugin-users-permissions 4.1.7 → 4.1.10-beta.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/plugin-users-permissions",
-  "version": "4.1.7",
+  "version": "4.1.10-beta.0",
   "description": "Protect your API with a full-authentication process based on JWT",
   "repository": {
     "type": "git",
@@ -27,15 +27,14 @@
     "test:front:watch:ce": "cross-env IS_EE=false jest --config ./jest.config.front.js --watchAll"
   },
   "dependencies": {
-    "@purest/providers": "^1.0.2",
-    "@strapi/helper-plugin": "4.1.7",
-    "@strapi/utils": "4.1.7",
+    "@strapi/helper-plugin": "4.1.10-beta.0",
+    "@strapi/utils": "4.1.10-beta.0",
     "bcryptjs": "2.4.3",
     "grant-koa": "5.4.8",
     "jsonwebtoken": "^8.1.0",
     "koa2-ratelimit": "^0.9.0",
     "lodash": "4.17.21",
-    "purest": "3.1.0",
+    "purest": "4.0.2",
     "react": "^17.0.2",
     "react-dom": "^17.0.2",
     "react-intl": "5.20.2",
@@ -44,8 +43,7 @@
     "react-router-dom": "5.2.0",
     "redux-saga": "^0.16.0",
     "request": "^2.83.0",
-    "url-join": "4.0.1",
-    "uuid": "^3.1.0"
+    "url-join": "4.0.1"
   },
   "devDependencies": {
     "koa": "^2.13.1"
@@ -61,5 +59,5 @@
     "required": true,
     "kind": "plugin"
   },
-  "gitHead": "1699aac1515f439ed69d0b68a43555c1d497554f"
+  "gitHead": "a9082d9a3b26bf0abeb8e45d4507d5329e9ae733"
 }

package/server/bootstrap/index.js

@@ -7,9 +7,9 @@
  * This gives you an opportunity to set up your data model,
  * run jobs, or perform some special logic.
  */
+const crypto = require('crypto');
 const _ = require('lodash');
 const urljoin = require('url-join');
-const uuid = require('uuid/v4');
 const { getService } = require('../utils');
 const getGrantConfig = require('./grant-config');
 
@@ -29,13 +29,22 @@ module.exports = async ({ strapi }) => {
   await getService('users-permissions').initialize();
 
   if (!strapi.config.get('plugin.users-permissions.jwtSecret')) {
-    const jwtSecret = uuid();
+    if (process.env.NODE_ENV !== 'development') {
+      throw new Error(
+        `Missing jwtSecret. Please, set configuration variable "jwtSecret" for the users-permissions plugin in config/plugins.js (ex: you can generate one using Node with \`crypto.randomBytes(16).toString('base64')\`).
+For security reasons, prefer storing the secret in an environment variable and read it in config/plugins.js. See https://docs.strapi.io/developer-docs/latest/setup-deployment-guides/configurations/optional/environment.html#configuration-using-environment-variables.`
+      );
+    }
+
+    const jwtSecret = crypto.randomBytes(16).toString('base64');
+
     strapi.config.set('plugin.users-permissions.jwtSecret', jwtSecret);
 
     if (!process.env.JWT_SECRET) {
-      strapi.fs.appendFile(process.env.ENV_PATH || '.env', `JWT_SECRET=${jwtSecret}\n`);
+      const envPath = process.env.ENV_PATH || '.env';
+      strapi.fs.appendFile(envPath, `JWT_SECRET=${jwtSecret}\n`);
       strapi.log.info(
-        'The Users & Permissions plugin automatically generated a jwt secret and stored it in your .env file under the name JWT_SECRET.'
+        `The Users & Permissions plugin automatically generated a jwt secret and stored it in ${envPath} under the name JWT_SECRET.`
       );
     }
   }

package/server/controllers/auth.js

@@ -34,7 +34,7 @@ module.exports = {
     const provider = ctx.params.provider || 'local';
     const params = ctx.request.body;
 
-    const store = await strapi.store({ type: 'plugin', name: 'users-permissions' });
+    const store = strapi.store({ type: 'plugin', name: 'users-permissions' });
 
     if (provider === 'local') {
       if (!_.get(await store.get({ key: 'grant' }), 'email.enabled')) {
@@ -101,22 +101,15 @@ module.exports = {
       }
 
       // Connect the user with the third-party provider.
-      let user;
-      let error;
       try {
-        [user, error] = await getService('providers').connect(provider, ctx.query);
-      } catch ([user, error]) {
-        throw new ApplicationError(error.message);
-      }
-
-      if (!user) {
+        const user = await getService('providers').connect(provider, ctx.query);
+        ctx.send({
+          jwt: getService('jwt').issue({ id: user.id }),
+          user: await sanitizeUser(user, ctx),
+        });
+      } catch (error) {
         throw new ApplicationError(error.message);
       }
-
-      ctx.send({
-        jwt: getService('jwt').issue({ id: user.id }),
-        user: await sanitizeUser(user, ctx),
-      });
     }
   },
 

package/server/services/providers-list.js

@@ -1,51 +1,25 @@
 'use strict';
 
-const _ = require('lodash');
 const jwt = require('jsonwebtoken');
-const request = require('request');
 // Purest strategies.
-const purest = require('purest')({ request });
-const purestConfig = require('@purest/providers');
+const purest = require('purest');
 
-module.exports = async ({ provider, access_token, callback, query, providers }) => {
+module.exports = async ({ provider, access_token, query, providers }) => {
   switch (provider) {
     case 'discord': {
-      const discord = purest({
-        provider: 'discord',
-        config: {
-          discord: {
-            'https://discordapp.com/api/': {
-              __domain: {
-                auth: {
-                  auth: { bearer: '[0]' },
-                },
-              },
-              '{endpoint}': {
-                __path: {
-                  alias: '__default',
-                },
-              },
-            },
-          },
-        },
-      });
-      discord
-        .query()
+      const discord = purest({ provider: 'discord' });
+      return discord
         .get('users/@me')
         .auth(access_token)
-        .request((err, res, body) => {
-          if (err) {
-            callback(err);
-          } else {
-            // Combine username and discriminator because discord username is not unique
-            var username = `${body.username}#${body.discriminator}`;
-            callback(null, {
-              username,
-              email: body.email,
-            });
-          }
+        .request()
+        .then(({ body }) => {
+          // Combine username and discriminator because discord username is not unique
+          var username = `${body.username}#${body.discriminator}`;
+          return {
+            username,
+            email: body.email,
+          };
         });
-      break;
     }
     case 'cognito': {
       // get the id_token
@@ -53,60 +27,43 @@ module.exports = async ({ provider, access_token, callback, query, providers })
       // decode the jwt token
       const tokenPayload = jwt.decode(idToken);
       if (!tokenPayload) {
-        callback(new Error('unable to decode jwt token'));
+        throw new Error('unable to decode jwt token');
       } else {
-        callback(null, {
+        return {
           username: tokenPayload['cognito:username'],
           email: tokenPayload.email,
-        });
+        };
       }
-      break;
     }
     case 'facebook': {
-      const facebook = purest({
-        provider: 'facebook',
-        config: purestConfig,
-      });
+      const facebook = purest({ provider: 'facebook' });
 
-      facebook
-        .query()
-        .get('me?fields=name,email')
+      return facebook
+        .get('me')
         .auth(access_token)
-        .request((err, res, body) => {
-          if (err) {
-            callback(err);
-          } else {
-            callback(null, {
-              username: body.name,
-              email: body.email,
-            });
-          }
-        });
-      break;
+        .qs({ fields: 'name,email' })
+        .request()
+        .then(({ body }) => ({
+          username: body.name,
+          email: body.email,
+        }));
     }
     case 'google': {
-      const google = purest({ provider: 'google', config: purestConfig });
+      const google = purest({ provider: 'google' });
 
-      google
+      return google
         .query('oauth')
         .get('tokeninfo')
         .qs({ access_token })
-        .request((err, res, body) => {
-          if (err) {
-            callback(err);
-          } else {
-            callback(null, {
-              username: body.email.split('@')[0],
-              email: body.email,
-            });
-          }
-        });
-      break;
+        .request()
+        .then(({ body }) => ({
+          username: body.email.split('@')[0],
+          email: body.email,
+        }));
     }
     case 'github': {
       const github = purest({
         provider: 'github',
-        config: purestConfig,
         defaults: {
           headers: {
             'user-agent': 'strapi',
@@ -114,360 +71,207 @@ module.exports = async ({ provider, access_token, callback, query, providers })
         },
       });
 
-      github
-        .query()
+      return github
         .get('user')
         .auth(access_token)
-        .request((err, res, userbody) => {
-          if (err) {
-            return callback(err);
-          }
-
+        .request()
+        .then(({ body: userbody }) => {
           // This is the public email on the github profile
           if (userbody.email) {
-            return callback(null, {
+            return {
               username: userbody.login,
               email: userbody.email,
-            });
+            };
           }
-
           // Get the email with Github's user/emails API
-          github
-            .query()
+          return github
             .get('user/emails')
             .auth(access_token)
-            .request((err, res, emailsbody) => {
-              if (err) {
-                return callback(err);
-              }
-
-              return callback(null, {
+            .request()
+            .then(({ body: emailsbody }) => {
+              return {
                 username: userbody.login,
                 email: Array.isArray(emailsbody)
                   ? emailsbody.find(email => email.primary === true).email
                   : null,
-              });
+              };
             });
         });
-      break;
     }
     case 'microsoft': {
-      const microsoft = purest({
-        provider: 'microsoft',
-        config: purestConfig,
-      });
+      const microsoft = purest({ provider: 'microsoft' });
 
-      microsoft
-        .query()
+      return microsoft
         .get('me')
         .auth(access_token)
-        .request((err, res, body) => {
-          if (err) {
-            callback(err);
-          } else {
-            callback(null, {
-              username: body.userPrincipalName,
-              email: body.userPrincipalName,
-            });
-          }
-        });
-      break;
+        .request()
+        .then(({ body }) => ({
+          username: body.userPrincipalName,
+          email: body.userPrincipalName,
+        }));
     }
     case 'twitter': {
       const twitter = purest({
         provider: 'twitter',
-        config: purestConfig,
-        key: providers.twitter.key,
-        secret: providers.twitter.secret,
       });
 
-      twitter
-        .query()
+      return twitter
         .get('account/verify_credentials')
         .auth(access_token, query.access_secret)
         .qs({ screen_name: query['raw[screen_name]'], include_email: 'true' })
-        .request((err, res, body) => {
-          if (err) {
-            callback(err);
-          } else {
-            callback(null, {
-              username: body.screen_name,
-              email: body.email,
-            });
-          }
-        });
-      break;
+        .request()
+        .then(({ body }) => ({
+          username: body.screen_name,
+          email: body.email,
+        }));
     }
     case 'instagram': {
-      const instagram = purest({
-        provider: 'instagram',
-        key: providers.instagram.key,
-        secret: providers.instagram.secret,
-        config: purestConfig,
-      });
+      const instagram = purest({ provider: 'instagram' });
 
-      instagram
-        .query()
+      return instagram
         .get('me')
-        .qs({ access_token, fields: 'id,username' })
-        .request((err, res, body) => {
-          if (err) {
-            callback(err);
-          } else {
-            callback(null, {
-              username: body.username,
-              email: `${body.username}@strapi.io`, // dummy email as Instagram does not provide user email
-            });
-          }
-        });
-      break;
+        .auth(access_token)
+        .qs({ fields: 'id,username' })
+        .request()
+        .then(({ body }) => ({
+          username: body.username,
+          email: `${body.username}@strapi.io`, // dummy email as Instagram does not provide user email
+        }));
     }
     case 'vk': {
-      const vk = purest({
-        provider: 'vk',
-        config: purestConfig,
-      });
+      const vk = purest({ provider: 'vk' });
 
-      vk.query()
+      return vk
         .get('users.get')
-        .qs({ access_token, id: query.raw.user_id, v: '5.122' })
-        .request((err, res, body) => {
-          if (err) {
-            callback(err);
-          } else {
-            callback(null, {
-              username: `${body.response[0].last_name} ${body.response[0].first_name}`,
-              email: query.raw.email,
-            });
-          }
-        });
-      break;
+        .auth(access_token)
+        .qs({ id: query.raw.user_id, v: '5.122' })
+        .request()
+        .then(({ body }) => ({
+          username: `${body.response[0].last_name} ${body.response[0].first_name}`,
+          email: query.raw.email,
+        }));
     }
     case 'twitch': {
       const twitch = purest({
         provider: 'twitch',
         config: {
           twitch: {
-            'https://api.twitch.tv': {
-              __domain: {
-                auth: {
-                  headers: {
-                    Authorization: 'Bearer [0]',
-                    'Client-ID': '[1]',
-                  },
-                },
-              },
-              'helix/{endpoint}': {
-                __path: {
-                  alias: '__default',
-                },
-              },
-              'oauth2/{endpoint}': {
-                __path: {
-                  alias: 'oauth',
-                },
+            default: {
+              origin: 'https://api.twitch.tv',
+              path: 'helix/{path}',
+              headers: {
+                Authorization: 'Bearer {auth}',
+                'Client-Id': '{auth}',
               },
             },
           },
         },
       });
 
-      twitch
+      return twitch
         .get('users')
         .auth(access_token, providers.twitch.key)
-        .request((err, res, body) => {
-          if (err) {
-            callback(err);
-          } else {
-            callback(null, {
-              username: body.data[0].login,
-              email: body.data[0].email,
-            });
-          }
-        });
-      break;
+        .request()
+        .then(({ body }) => ({
+          username: body.data[0].login,
+          email: body.data[0].email,
+        }));
     }
     case 'linkedin': {
-      const linkedIn = purest({
-        provider: 'linkedin',
-        config: {
-          linkedin: {
-            'https://api.linkedin.com': {
-              __domain: {
-                auth: [{ auth: { bearer: '[0]' } }],
-              },
-              '[version]/{endpoint}': {
-                __path: {
-                  alias: '__default',
-                  version: 'v2',
-                },
-              },
-            },
-          },
-        },
-      });
-      try {
-        const getDetailsRequest = () => {
-          return new Promise((resolve, reject) => {
-            linkedIn
-              .query()
-              .get('me')
-              .auth(access_token)
-              .request((err, res, body) => {
-                if (err) {
-                  return reject(err);
-                }
-                resolve(body);
-              });
-          });
-        };
-
-        const getEmailRequest = () => {
-          return new Promise((resolve, reject) => {
-            linkedIn
-              .query()
-              .get('emailAddress?q=members&projection=(elements*(handle~))')
-              .auth(access_token)
-              .request((err, res, body) => {
-                if (err) {
-                  return reject(err);
-                }
-                resolve(body);
-              });
-          });
-        };
+      const linkedIn = purest({ provider: 'linkedin' });
+      const {
+        body: { localizedFirstName },
+      } = await linkedIn
+        .get('me')
+        .auth(access_token)
+        .request();
+      const {
+        body: { elements },
+      } = await linkedIn
+        .get('emailAddress?q=members&projection=(elements*(handle~))')
+        .auth(access_token)
+        .request();
 
-        const { localizedFirstName } = await getDetailsRequest();
-        const { elements } = await getEmailRequest();
-        const email = elements[0]['handle~'];
+      const email = elements[0]['handle~'];
 
-        callback(null, {
-          username: localizedFirstName,
-          email: email.emailAddress,
-        });
-      } catch (err) {
-        callback(err);
-      }
-      break;
+      return {
+        username: localizedFirstName,
+        email: email.emailAddress,
+      };
     }
     case 'reddit': {
       const reddit = purest({
         provider: 'reddit',
-        config: purestConfig,
-        defaults: {
-          headers: {
-            'user-agent': 'strapi',
+        config: {
+          reddit: {
+            default: {
+              origin: 'https://oauth.reddit.com',
+              path: 'api/{version}/{path}',
+              version: 'v1',
+              headers: {
+                Authorization: 'Bearer {auth}',
+                'user-agent': 'strapi',
+              },
+            },
           },
         },
       });
 
-      reddit
-        .query('auth')
+      return reddit
         .get('me')
         .auth(access_token)
-        .request((err, res, body) => {
-          if (err) {
-            callback(err);
-          } else {
-            callback(null, {
-              username: body.name,
-              email: `${body.name}@strapi.io`, // dummy email as Reddit does not provide user email
-            });
-          }
-        });
-      break;
+        .request()
+        .then(({ body }) => ({
+          username: body.name,
+          email: `${body.name}@strapi.io`, // dummy email as Reddit does not provide user email
+        }));
     }
     case 'auth0': {
-      const purestAuth0Conf = {};
-      purestAuth0Conf[`https://${providers.auth0.subdomain}.auth0.com`] = {
-        __domain: {
-          auth: {
-            auth: { bearer: '[0]' },
-          },
-        },
-        '{endpoint}': {
-          __path: {
-            alias: '__default',
-          },
-        },
-      };
-      const auth0 = purest({
-        provider: 'auth0',
-        config: {
-          auth0: purestAuth0Conf,
-        },
-      });
+      const auth0 = purest({ provider: 'auth0' });
 
-      auth0
+      return auth0
         .get('userinfo')
+        .subdomain(providers.auth0.subdomain)
         .auth(access_token)
-        .request((err, res, body) => {
-          if (err) {
-            callback(err);
-          } else {
-            const username =
-              body.username || body.nickname || body.name || body.email.split('@')[0];
-            const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
+        .request()
+        .then(({ body }) => {
+          const username = body.username || body.nickname || body.name || body.email.split('@')[0];
+          const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
 
-            callback(null, {
-              username,
-              email,
-            });
-          }
+          return {
+            username,
+            email,
+          };
         });
-      break;
     }
     case 'cas': {
-      const provider_url = 'https://' + _.get(providers.cas, 'subdomain');
-      const cas = purest({
-        provider: 'cas',
-        config: {
-          cas: {
-            [provider_url]: {
-              __domain: {
-                auth: {
-                  auth: { bearer: '[0]' },
-                },
-              },
-              '{endpoint}': {
-                __path: {
-                  alias: '__default',
-                },
-              },
-            },
-          },
-        },
-      });
-      cas
-        .query()
+      const cas = purest({ provider: 'cas' });
+
+      return cas
         .get('oidc/profile')
+        .subdomain(providers.cas.subdomain)
         .auth(access_token)
-        .request((err, res, body) => {
-          if (err) {
-            callback(err);
-          } else {
-            // CAS attribute may be in body.attributes or "FLAT", depending on CAS config
-            const username = body.attributes
-              ? body.attributes.strapiusername || body.id || body.sub
-              : body.strapiusername || body.id || body.sub;
-            const email = body.attributes
-              ? body.attributes.strapiemail || body.attributes.email
-              : body.strapiemail || body.email;
-            if (!username || !email) {
-              strapi.log.warn(
-                'CAS Response Body did not contain required attributes: ' + JSON.stringify(body)
-              );
-            }
-            callback(null, {
-              username,
-              email,
-            });
+        .request()
+        .then(({ body }) => {
+          // CAS attribute may be in body.attributes or "FLAT", depending on CAS config
+          const username = body.attributes
+            ? body.attributes.strapiusername || body.id || body.sub
+            : body.strapiusername || body.id || body.sub;
+          const email = body.attributes
+            ? body.attributes.strapiemail || body.attributes.email
+            : body.strapiemail || body.email;
+          if (!username || !email) {
+            strapi.log.warn(
+              'CAS Response Body did not contain required attributes: ' + JSON.stringify(body)
+            );
           }
+          return {
+            username,
+            email,
+          };
         });
-      break;
     }
     default:
-      callback(new Error('Unknown provider.'));
-      break;
+      throw new Error('Unknown provider.');
   }
 };

package/server/services/providers.js

@@ -18,17 +18,16 @@ module.exports = ({ strapi }) => {
    * Helper to get profiles
    *
    * @param {String}   provider
-   * @param {Function} callback
    */
 
-  const getProfile = async (provider, query, callback) => {
+  const getProfile = async (provider, query) => {
     const access_token = query.access_token || query.code || query.oauth_token;
 
     const providers = await strapi
       .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })
       .get();
 
-    await providerRequest({ provider, query, callback, access_token, providers });
+    return providerRequest({ provider, query, access_token, providers });
   };
 
   /**
@@ -46,79 +45,69 @@ module.exports = ({ strapi }) => {
 
     return new Promise((resolve, reject) => {
       if (!access_token) {
-        return reject([null, { message: 'No access_token.' }]);
+        return reject({ message: 'No access_token.' });
       }
 
       // Get the profile.
-      getProfile(provider, query, async (err, profile) => {
-        if (err) {
-          return reject([null, err]);
-        }
-
-        const email = _.toLower(profile.email);
-
-        // We need at least the mail.
-        if (!email) {
-          return reject([null, { message: 'Email was not available.' }]);
-        }
-
-        try {
-          const users = await strapi.query('plugin::users-permissions.user').findMany({
-            where: { email },
-          });
-
-          const advanced = await strapi
-            .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })
-            .get();
-
-          const user = _.find(users, { provider });
-
-          if (_.isEmpty(user) && !advanced.allow_register) {
-            return resolve([
-              null,
-              [{ messages: [{ id: 'Auth.advanced.allow_register' }] }],
-              'Register action is actually not available.',
-            ]);
-          }
+      getProfile(provider, query)
+        .then(async profile => {
+          const email = _.toLower(profile.email);
 
-          if (!_.isEmpty(user)) {
-            return resolve([user, null]);
+          // We need at least the mail.
+          if (!email) {
+            return reject({ message: 'Email was not available.' });
           }
 
-          if (
-            !_.isEmpty(_.find(users, user => user.provider !== provider)) &&
-            advanced.unique_email
-          ) {
-            return resolve([
-              null,
-              [{ messages: [{ id: 'Auth.form.error.email.taken' }] }],
-              'Email is already taken.',
-            ]);
+          try {
+            const users = await strapi.query('plugin::users-permissions.user').findMany({
+              where: { email },
+            });
+
+            const advanced = await strapi
+              .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })
+              .get();
+
+            const user = _.find(users, { provider });
+
+            if (_.isEmpty(user) && !advanced.allow_register) {
+              return reject({ message: 'Register action is actually not available.' });
+            }
+
+            if (!_.isEmpty(user)) {
+              return resolve(user);
+            }
+
+            if (
+              !_.isEmpty(_.find(users, user => user.provider !== provider)) &&
+              advanced.unique_email
+            ) {
+              return reject({ message: 'Email is already taken.' });
+            }
+
+            // Retrieve default role.
+            const defaultRole = await strapi
+              .query('plugin::users-permissions.role')
+              .findOne({ where: { type: advanced.default_role } });
+
+            // Create the new user.
+            const params = {
+              ...profile,
+              email, // overwrite with lowercased email
+              provider,
+              role: defaultRole.id,
+              confirmed: true,
+            };
+
+            const createdUser = await strapi
+              .query('plugin::users-permissions.user')
+              .create({ data: params });
+
+            return resolve(createdUser);
+          } catch (err) {
+            reject(err);
           }
-
-          // Retrieve default role.
-          const defaultRole = await strapi
-            .query('plugin::users-permissions.role')
-            .findOne({ where: { type: advanced.default_role } });
-
-          // Create the new user.
-          const params = {
-            ...profile,
-            email, // overwrite with lowercased email
-            provider,
-            role: defaultRole.id,
-            confirmed: true,
-          };
-
-          const createdUser = await strapi
-            .query('plugin::users-permissions.user')
-            .create({ data: params });
-
-          return resolve([createdUser, null]);
-        } catch (err) {
-          reject([null, err]);
-        }
-      });
+        })
+        .catch(reject);
     });
   };