@strapi/plugin-users-permissions 4.20.5 → 5.0.0-alpha.0

package/server/controllers/content-manager-user.js

@@ -17,24 +17,23 @@ const ACTIONS = {
 };
 
 const findEntityAndCheckPermissions = async (ability, action, model, id) => {
-  const entity = await strapi.query(userModel).findOne({
-    where: { id },
+  const doc = await strapi.service('plugin::content-manager.document-manager').findOne(id, model, {
     populate: [`${CREATED_BY_ATTRIBUTE}.roles`],
   });
 
-  if (_.isNil(entity)) {
+  if (_.isNil(doc)) {
     throw new NotFoundError();
   }
 
   const pm = strapi.admin.services.permission.createPermissionsManager({ ability, action, model });
 
-  if (pm.ability.cannot(pm.action, pm.toSubject(entity))) {
+  if (pm.ability.cannot(pm.action, pm.toSubject(doc))) {
     throw new ForbiddenError();
   }
 
-  const entityWithoutCreatorRoles = _.omit(entity, `${CREATED_BY_ATTRIBUTE}.roles`);
+  const docWithoutCreatorRoles = _.omit(doc, `${CREATED_BY_ATTRIBUTE}.roles`);
 
-  return { pm, entity: entityWithoutCreatorRoles };
+  return { pm, doc: docWithoutCreatorRoles };
 };
 
 module.exports = {
@@ -66,7 +65,7 @@ module.exports = {
 
     await validateCreateUserBody(ctx.request.body);
 
-    const userWithSameUsername = await strapi
+    const userWithSameUsername = await strapi.db
       .query('plugin::users-permissions.user')
       .findOne({ where: { username } });
 
@@ -75,7 +74,7 @@ module.exports = {
     }
 
     if (advanced.unique_email) {
-      const userWithSameEmail = await strapi
+      const userWithSameEmail = await strapi.db
         .query('plugin::users-permissions.user')
         .findOne({ where: { email: email.toLowerCase() } });
 
@@ -93,18 +92,11 @@ module.exports = {
 
     user.email = _.toLower(user.email);
 
-    if (!user.role) {
-      const defaultRole = await strapi
-        .query('plugin::users-permissions.role')
-        .findOne({ where: { type: advanced.default_role } });
-
-      user.role = defaultRole.id;
-    }
-
     try {
       const data = await strapi
-        .service('plugin::content-manager.entity-manager')
-        .create(user, userModel);
+        .service('plugin::content-manager.document-manager')
+        .create(userModel, { data: user });
+
       const sanitizedData = await pm.sanitizeOutput(data, { action: ACTIONS.read });
 
       ctx.created(sanitizedData);
@@ -118,7 +110,7 @@ module.exports = {
    */
 
   async update(ctx) {
-    const { id } = ctx.params;
+    const { id: documentId } = ctx.params;
     const { body } = ctx.request;
     const { user: admin, userAbility } = ctx.state;
 
@@ -128,13 +120,14 @@ module.exports = {
 
     const { email, username, password } = body;
 
-    const { pm, entity } = await findEntityAndCheckPermissions(
+    const { pm, doc } = await findEntityAndCheckPermissions(
       userAbility,
       ACTIONS.edit,
       userModel,
-      id
+      documentId
     );
-    const user = entity;
+
+    const user = doc;
 
     await validateUpdateUserBody(ctx.request.body);
 
@@ -143,23 +136,24 @@ module.exports = {
     }
 
     if (_.has(body, 'username')) {
-      const userWithSameUsername = await strapi
+      const userWithSameUsername = await strapi.db
         .query('plugin::users-permissions.user')
         .findOne({ where: { username } });
 
-      if (userWithSameUsername && _.toString(userWithSameUsername.id) !== _.toString(id)) {
+      if (userWithSameUsername && _.toString(userWithSameUsername.id) !== _.toString(user.id)) {
         throw new ApplicationError('Username already taken');
       }
     }
 
     if (_.has(body, 'email') && advancedConfigs.unique_email) {
-      const userWithSameEmail = await strapi
+      const userWithSameEmail = await strapi.db
         .query('plugin::users-permissions.user')
         .findOne({ where: { email: _.toLower(email) } });
 
-      if (userWithSameEmail && _.toString(userWithSameEmail.id) !== _.toString(id)) {
+      if (userWithSameEmail && _.toString(userWithSameEmail.id) !== _.toString(user.id)) {
         throw new ApplicationError('Email already taken');
       }
+
       body.email = _.toLower(body.email);
     }
 
@@ -167,8 +161,10 @@ module.exports = {
     const updateData = _.omit({ ...sanitizedData, updatedBy: admin.id }, 'createdBy');
 
     const data = await strapi
-      .service('plugin::content-manager.entity-manager')
-      .update({ id }, updateData, userModel);
+      .service('plugin::content-manager.document-manager')
+      .update(documentId, userModel, {
+        data: updateData,
+      });
 
     ctx.body = await pm.sanitizeOutput(data, { action: ACTIONS.read });
   },

package/server/controllers/role.js

@@ -59,7 +59,7 @@ module.exports = {
     }
 
     // Fetch public role.
-    const publicRole = await strapi
+    const publicRole = await strapi.db
       .query('plugin::users-permissions.role')
       .findOne({ where: { type: 'public' } });
 

package/server/controllers/user.js

@@ -49,7 +49,7 @@ module.exports = {
 
     const { email, username, role } = ctx.request.body;
 
-    const userWithSameUsername = await strapi
+    const userWithSameUsername = await strapi.db
       .query('plugin::users-permissions.user')
       .findOne({ where: { username } });
 
@@ -58,7 +58,7 @@ module.exports = {
     }
 
     if (advanced.unique_email) {
-      const userWithSameEmail = await strapi
+      const userWithSameEmail = await strapi.db
         .query('plugin::users-permissions.user')
         .findOne({ where: { email: email.toLowerCase() } });
 
@@ -74,7 +74,7 @@ module.exports = {
     };
 
     if (!role) {
-      const defaultRole = await strapi
+      const defaultRole = await strapi.db
         .query('plugin::users-permissions.role')
         .findOne({ where: { type: advanced.default_role } });
 
@@ -115,7 +115,7 @@ module.exports = {
     }
 
     if (_.has(ctx.request.body, 'username')) {
-      const userWithSameUsername = await strapi
+      const userWithSameUsername = await strapi.db
         .query('plugin::users-permissions.user')
         .findOne({ where: { username } });
 
@@ -125,7 +125,7 @@ module.exports = {
     }
 
     if (_.has(ctx.request.body, 'email') && advancedConfigs.unique_email) {
-      const userWithSameEmail = await strapi
+      const userWithSameEmail = await strapi.db
         .query('plugin::users-permissions.user')
         .findOne({ where: { email: email.toLowerCase() } });
 

package/server/middlewares/rateLimit.js

@@ -9,7 +9,7 @@ const { RateLimitError } = utils.errors;
 module.exports =
   (config, { strapi }) =>
   async (ctx, next) => {
-    let rateLimitConfig = strapi.config.get('plugin.users-permissions.ratelimit');
+    let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');
 
     if (!rateLimitConfig) {
       rateLimitConfig = {

package/server/register.js

@@ -7,7 +7,7 @@ const authStrategy = require('./strategies/users-permissions');
 const sanitizers = require('./utils/sanitize/sanitizers');
 
 module.exports = ({ strapi }) => {
-  strapi.container.get('auth').register('content-api', authStrategy);
+  strapi.get('auth').register('content-api', authStrategy);
   strapi.sanitizers.add('content-api.output', sanitizers.defaultSanitizeOutput);
 
   if (strapi.plugin('graphql')) {

package/server/services/jwt.js

@@ -29,10 +29,10 @@ module.exports = ({ strapi }) => ({
   },
 
   issue(payload, jwtOptions = {}) {
-    _.defaults(jwtOptions, strapi.config.get('plugin.users-permissions.jwt'));
+    _.defaults(jwtOptions, strapi.config.get('plugin::users-permissions.jwt'));
     return jwt.sign(
       _.clone(payload.toJSON ? payload.toJSON() : payload),
-      strapi.config.get('plugin.users-permissions.jwtSecret'),
+      strapi.config.get('plugin::users-permissions.jwtSecret'),
       jwtOptions
     );
   },
@@ -41,7 +41,7 @@ module.exports = ({ strapi }) => ({
     return new Promise((resolve, reject) => {
       jwt.verify(
         token,
-        strapi.config.get('plugin.users-permissions.jwtSecret'),
+        strapi.config.get('plugin::users-permissions.jwtSecret'),
         {},
         (err, tokenPayload = {}) => {
           if (err) {

package/server/services/permission.js

@@ -11,11 +11,7 @@ module.exports = ({ strapi }) => ({
    * @return {object[]}
    */
   async findRolePermissions(roleID) {
-    return strapi.entityService.load(
-      'plugin::users-permissions.role',
-      { id: roleID },
-      'permissions'
-    );
+    return strapi.db.query('plugin::users-permissions.role').load({ id: roleID }, 'permissions');
   },
 
   /**
@@ -24,8 +20,8 @@ module.exports = ({ strapi }) => ({
    * @return {object[]}
    */
   async findPublicPermissions() {
-    return strapi.entityService.findMany('plugin::users-permissions.permission', {
-      filters: PUBLIC_ROLE_FILTER,
+    return strapi.db.query('plugin::users-permissions.permission').findMany({
+      where: PUBLIC_ROLE_FILTER,
     });
   },
 

package/server/services/providers-registry.js

@@ -331,6 +331,21 @@ const getInitialProviders = ({ purest }) => ({
         };
       });
   },
+  async keycloak({ accessToken, providers }) {
+    const keycloak = purest({ provider: 'keycloak' });
+
+    return keycloak
+      .subdomain(providers.keycloak.subdomain)
+      .get('protocol/openid-connect/userinfo')
+      .auth(accessToken)
+      .request()
+      .then(({ body }) => {
+        return {
+          username: body.preferred_username,
+          email: body.email,
+        };
+      });
+  },
 });
 
 module.exports = () => {

package/server/services/providers.js

@@ -8,7 +8,6 @@
 const _ = require('lodash');
 const urlJoin = require('url-join');
 
-const { getAbsoluteServerUrl } = require('@strapi/utils');
 const { getService } = require('../utils');
 
 module.exports = ({ strapi }) => {
@@ -60,7 +59,7 @@ module.exports = ({ strapi }) => {
       throw new Error('Email was not available.');
     }
 
-    const users = await strapi.query('plugin::users-permissions.user').findMany({
+    const users = await strapi.db.query('plugin::users-permissions.user').findMany({
       where: { email },
     });
 
@@ -83,7 +82,7 @@ module.exports = ({ strapi }) => {
     }
 
     // Retrieve default role.
-    const defaultRole = await strapi
+    const defaultRole = await strapi.db
       .query('plugin::users-permissions.role')
       .findOne({ where: { type: advancedSettings.default_role } });
 
@@ -96,7 +95,7 @@ module.exports = ({ strapi }) => {
       confirmed: true,
     };
 
-    const createdUser = await strapi
+    const createdUser = await strapi.db
       .query('plugin::users-permissions.user')
       .create({ data: newUser });
 
@@ -105,7 +104,13 @@ module.exports = ({ strapi }) => {
 
   const buildRedirectUri = (provider = '') => {
     const apiPrefix = strapi.config.get('api.rest.prefix');
-    return urlJoin(getAbsoluteServerUrl(strapi.config), apiPrefix, 'connect', provider, 'callback');
+    return urlJoin(
+      strapi.config.get('server.absoluteUrl'),
+      apiPrefix,
+      'connect',
+      provider,
+      'callback'
+    );
   };
 
   return {

package/server/services/role.js

@@ -10,7 +10,7 @@ module.exports = ({ strapi }) => ({
       params.type = _.snakeCase(_.deburr(_.toLower(params.name)));
     }
 
-    const role = await strapi
+    const role = await strapi.db
       .query('plugin::users-permissions.role')
       .create({ data: _.omit(params, ['users', 'permissions']) });
 
@@ -25,7 +25,7 @@ module.exports = ({ strapi }) => ({
               const actionID = `${typeName}.${controllerName}.${actionName}`;
 
               acc.push(
-                strapi
+                strapi.db
                   .query('plugin::users-permissions.permission')
                   .create({ data: { action: actionID, role: role.id } })
               );
@@ -42,7 +42,7 @@ module.exports = ({ strapi }) => ({
   },
 
   async findOne(roleID) {
-    const role = await strapi
+    const role = await strapi.db
       .query('plugin::users-permissions.role')
       .findOne({ where: { id: roleID }, populate: ['permissions'] });
 
@@ -69,10 +69,12 @@ module.exports = ({ strapi }) => ({
   },
 
   async find() {
-    const roles = await strapi.query('plugin::users-permissions.role').findMany({ sort: ['name'] });
+    const roles = await strapi.db
+      .query('plugin::users-permissions.role')
+      .findMany({ sort: ['name'] });
 
     for (const role of roles) {
-      role.nb_users = await strapi
+      role.nb_users = await strapi.db
         .query('plugin::users-permissions.user')
         .count({ where: { role: { id: role.id } } });
     }
@@ -81,7 +83,7 @@ module.exports = ({ strapi }) => ({
   },
 
   async updateRole(roleID, data) {
-    const role = await strapi
+    const role = await strapi.db
       .query('plugin::users-permissions.role')
       .findOne({ where: { id: roleID }, populate: ['permissions'] });
 
@@ -89,7 +91,7 @@ module.exports = ({ strapi }) => ({
       throw new NotFoundError('Role not found');
     }
 
-    await strapi.query('plugin::users-permissions.role').update({
+    await strapi.db.query('plugin::users-permissions.role').update({
       where: { id: roleID },
       data: _.pick(data, ['name', 'description']),
     });
@@ -129,7 +131,7 @@ module.exports = ({ strapi }) => ({
 
     await Promise.all(
       toDelete.map((permission) =>
-        strapi
+        strapi.db
           .query('plugin::users-permissions.permission')
           .delete({ where: { id: permission.id } })
       )
@@ -137,13 +139,13 @@ module.exports = ({ strapi }) => ({
 
     await Promise.all(
       toCreate.map((permissionInfo) =>
-        strapi.query('plugin::users-permissions.permission').create({ data: permissionInfo })
+        strapi.db.query('plugin::users-permissions.permission').create({ data: permissionInfo })
       )
     );
   },
 
   async deleteRole(roleID, publicRoleID) {
-    const role = await strapi
+    const role = await strapi.db
       .query('plugin::users-permissions.role')
       .findOne({ where: { id: roleID }, populate: ['users', 'permissions'] });
 
@@ -154,7 +156,7 @@ module.exports = ({ strapi }) => ({
     // Move users to guest role.
     await Promise.all(
       role.users.map((user) => {
-        return strapi.query('plugin::users-permissions.user').update({
+        return strapi.db.query('plugin::users-permissions.user').update({
           where: { id: user.id },
           data: { role: publicRoleID },
         });
@@ -165,13 +167,13 @@ module.exports = ({ strapi }) => ({
     // TODO: use delete many
     await Promise.all(
       role.permissions.map((permission) => {
-        return strapi.query('plugin::users-permissions.permission').delete({
+        return strapi.db.query('plugin::users-permissions.permission').delete({
           where: { id: permission.id },
         });
       })
     );
 
     // Delete the role.
-    await strapi.query('plugin::users-permissions.role').delete({ where: { id: roleID } });
+    await strapi.db.query('plugin::users-permissions.role').delete({ where: { id: roleID } });
   },
 });

package/server/services/user.js

@@ -10,9 +10,11 @@ const crypto = require('crypto');
 const bcrypt = require('bcryptjs');
 const urlJoin = require('url-join');
 
-const { getAbsoluteAdminUrl, getAbsoluteServerUrl, sanitize } = require('@strapi/utils');
+const { sanitize, convertQueryParams } = require('@strapi/utils');
 const { getService } = require('../utils');
 
+const USER_MODEL_UID = 'plugin::users-permissions.user';
+
 module.exports = ({ strapi }) => ({
   /**
    * Promise to count users
@@ -21,7 +23,7 @@ module.exports = ({ strapi }) => ({
    */
 
   count(params) {
-    return strapi.query('plugin::users-permissions.user').count({ where: params });
+    return strapi.db.query(USER_MODEL_UID).count({ where: params });
   },
 
   /**
@@ -35,7 +37,7 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   async add(values) {
-    return strapi.entityService.create('plugin::users-permissions.user', {
+    return strapi.db.query(USER_MODEL_UID).create({
       data: values,
       populate: ['role'],
     });
@@ -48,7 +50,8 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   async edit(userId, params = {}) {
-    return strapi.entityService.update('plugin::users-permissions.user', userId, {
+    return strapi.db.query(USER_MODEL_UID).update({
+      where: { id: userId },
       data: params,
       populate: ['role'],
     });
@@ -59,7 +62,14 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetch(id, params) {
-    return strapi.entityService.findOne('plugin::users-permissions.user', id, params);
+    const query = convertQueryParams.transformParamsToQuery(USER_MODEL_UID, params ?? {});
+
+    return strapi.db.query(USER_MODEL_UID).findOne({
+      ...query,
+      where: {
+        $and: [{ id }, query.where || {}],
+      },
+    });
   },
 
   /**
@@ -67,9 +77,7 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetchAuthenticatedUser(id) {
-    return strapi
-      .query('plugin::users-permissions.user')
-      .findOne({ where: { id }, populate: ['role'] });
+    return strapi.db.query(USER_MODEL_UID).findOne({ where: { id }, populate: ['role'] });
   },
 
   /**
@@ -77,7 +85,9 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetchAll(params) {
-    return strapi.entityService.findMany('plugin::users-permissions.user', params);
+    const query = convertQueryParams.transformParamsToQuery(USER_MODEL_UID, params ?? {});
+
+    return strapi.db.query(USER_MODEL_UID).findMany(query);
   },
 
   /**
@@ -85,7 +95,7 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   async remove(params) {
-    return strapi.query('plugin::users-permissions.user').delete({ where: params });
+    return strapi.db.query(USER_MODEL_UID).delete({ where: params });
   },
 
   validatePassword(password, hash) {
@@ -95,7 +105,7 @@ module.exports = ({ strapi }) => ({
   async sendConfirmationEmail(user) {
     const userPermissionService = getService('users-permissions');
     const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });
-    const userSchema = strapi.getModel('plugin::users-permissions.user');
+    const userSchema = strapi.getModel(USER_MODEL_UID);
 
     const settings = await pluginStore
       .get({ key: 'email' })
@@ -112,9 +122,13 @@ module.exports = ({ strapi }) => ({
 
     try {
       settings.message = await userPermissionService.template(settings.message, {
-        URL: urlJoin(getAbsoluteServerUrl(strapi.config), apiPrefix, '/auth/email-confirmation'),
-        SERVER_URL: getAbsoluteServerUrl(strapi.config),
-        ADMIN_URL: getAbsoluteAdminUrl(strapi.config),
+        URL: urlJoin(
+          strapi.config.get('server.absoluteUrl'),
+          apiPrefix,
+          '/auth/email-confirmation'
+        ),
+        SERVER_URL: strapi.config.get('server.absoluteUrl'),
+        ADMIN_URL: strapi.config.get('admin.absoluteUrl'),
         USER: sanitizedUserInfo,
         CODE: confirmationToken,
       });

package/server/services/users-permissions.js

@@ -6,7 +6,7 @@ const urlJoin = require('url-join');
 const {
   template: { createStrictInterpolationRegExp },
   errors,
-  keysDeep,
+  objects,
 } = require('@strapi/utils');
 
 const { getService } = require('../utils');
@@ -151,8 +151,8 @@ module.exports = ({ strapi }) => ({
   },
 
   async syncPermissions() {
-    const roles = await strapi.query('plugin::users-permissions.role').findMany();
-    const dbPermissions = await strapi.query('plugin::users-permissions.permission').findMany();
+    const roles = await strapi.db.query('plugin::users-permissions.role').findMany();
+    const dbPermissions = await strapi.db.query('plugin::users-permissions.permission').findMany();
 
     const permissionsFoundInDB = _.uniq(_.map(dbPermissions, 'action'));
 
@@ -178,7 +178,9 @@ module.exports = ({ strapi }) => ({
 
     await Promise.all(
       toDelete.map((action) => {
-        return strapi.query('plugin::users-permissions.permission').delete({ where: { action } });
+        return strapi.db
+          .query('plugin::users-permissions.permission')
+          .delete({ where: { action } });
       })
     );
 
@@ -192,7 +194,7 @@ module.exports = ({ strapi }) => ({
 
         await Promise.all(
           toCreate.map((action) => {
-            return strapi.query('plugin::users-permissions.permission').create({
+            return strapi.db.query('plugin::users-permissions.permission').create({
               data: {
                 action,
                 role: role.id,
@@ -205,10 +207,10 @@ module.exports = ({ strapi }) => ({
   },
 
   async initialize() {
-    const roleCount = await strapi.query('plugin::users-permissions.role').count();
+    const roleCount = await strapi.db.query('plugin::users-permissions.role').count();
 
     if (roleCount === 0) {
-      await strapi.query('plugin::users-permissions.role').create({
+      await strapi.db.query('plugin::users-permissions.role').create({
         data: {
           name: 'Authenticated',
           description: 'Default role given to authenticated user.',
@@ -216,7 +218,7 @@ module.exports = ({ strapi }) => ({
         },
       });
 
-      await strapi.query('plugin::users-permissions.role').create({
+      await strapi.db.query('plugin::users-permissions.role').create({
         data: {
           name: 'Public',
           description: 'Default role given to unauthenticated user.',
@@ -229,13 +231,13 @@ module.exports = ({ strapi }) => ({
   },
 
   async updateUserRole(user, role) {
-    return strapi
+    return strapi.db
       .query('plugin::users-permissions.user')
       .update({ where: { id: user.id }, data: { role } });
   },
 
   template(layout, data) {
-    const allowedTemplateVariables = keysDeep(data);
+    const allowedTemplateVariables = objects.keysDeep(data);
 
     // Create a strict interpolation RegExp based on possible variable names
     const interpolate = createStrictInterpolationRegExp(allowedTemplateVariables, 'g');

package/server/utils/sanitize/sanitizers.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { curry } = require('lodash/fp');
-const { traverseEntity, pipeAsync } = require('@strapi/utils');
+const { traverseEntity, async } = require('@strapi/utils');
 
 const { removeUserRelationFromRoleEntities } = require('./visitors');
 
@@ -10,7 +10,7 @@ const sanitizeUserRelationFromRoleEntities = curry((schema, entity) => {
 });
 
 const defaultSanitizeOutput = curry((schema, entity) => {
-  return pipeAsync(sanitizeUserRelationFromRoleEntities(schema))(entity);
+  return async.pipe(sanitizeUserRelationFromRoleEntities(schema))(entity);
 });
 
 module.exports = {

package/dist/_chunks/en-CE3wEy_c.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"en-CE3wEy_c.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/_chunks/en-m608rMZx.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"en-m608rMZx.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}