@strapi/plugin-users-permissions 4.3.2 → 4.3.5

package/server/controllers/validation/email-template.js

@@ -19,6 +19,7 @@ const matchAll = (pattern, src) => {
   let match;
 
   const regexPatternWithGlobal = RegExp(pattern, 'g');
+  // eslint-disable-next-line no-cond-assign
   while ((match = regexPatternWithGlobal.exec(src))) {
     const [, group] = match;
 
@@ -27,8 +28,8 @@ const matchAll = (pattern, src) => {
   return matches;
 };
 
-const isValidEmailTemplate = template => {
-  for (let reg of invalidPatternsRegexes) {
+const isValidEmailTemplate = (template) => {
+  for (const reg of invalidPatternsRegexes) {
     if (reg.test(template)) {
       return false;
     }

package/server/controllers/validation/user.js

@@ -7,26 +7,14 @@ const deleteRoleSchema = yup.object().shape({
 });
 
 const createUserBodySchema = yup.object().shape({
-  email: yup
-    .string()
-    .email()
-    .required(),
-  username: yup
-    .string()
-    .min(1)
-    .required(),
-  password: yup
-    .string()
-    .min(1)
-    .required(),
+  email: yup.string().email().required(),
+  username: yup.string().min(1).required(),
+  password: yup.string().min(1).required(),
   role: yup.strapiID(),
 });
 
 const updateUserBodySchema = yup.object().shape({
-  email: yup
-    .string()
-    .email()
-    .min(1),
+  email: yup.string().email().min(1),
   username: yup.string().min(1),
   password: yup.string().min(1),
 });

package/server/graphql/mutations/auth/change-password.js

@@ -0,0 +1,38 @@
+'use strict';
+
+const { toPlainObject } = require('lodash/fp');
+
+const { checkBadRequest } = require('../../utils');
+
+module.exports = ({ nexus, strapi }) => {
+  const { nonNull } = nexus;
+
+  return {
+    type: 'UsersPermissionsLoginPayload',
+
+    args: {
+      currentPassword: nonNull('String'),
+      password: nonNull('String'),
+      passwordConfirmation: nonNull('String'),
+    },
+
+    description: 'Change user password. Confirm with the current password.',
+
+    async resolve(parent, args, context) {
+      const { koaContext } = context;
+
+      koaContext.request.body = toPlainObject(args);
+
+      await strapi.plugin('users-permissions').controller('auth').changePassword(koaContext);
+
+      const output = koaContext.body;
+
+      checkBadRequest(output);
+
+      return {
+        user: output.user || output,
+        jwt: output.jwt,
+      };
+    },
+  };
+};

package/server/graphql/mutations/auth/forgot-password.js

@@ -21,10 +21,7 @@ module.exports = ({ nexus, strapi }) => {
 
       koaContext.request.body = toPlainObject(args);
 
-      await strapi
-        .plugin('users-permissions')
-        .controller('auth')
-        .forgotPassword(koaContext);
+      await strapi.plugin('users-permissions').controller('auth').forgotPassword(koaContext);
 
       const output = koaContext.body;
 

package/server/graphql/mutations/auth/login.js

@@ -20,10 +20,7 @@ module.exports = ({ nexus, strapi }) => {
       koaContext.params = { provider: args.input.provider };
       koaContext.request.body = toPlainObject(args.input);
 
-      await strapi
-        .plugin('users-permissions')
-        .controller('auth')
-        .callback(koaContext);
+      await strapi.plugin('users-permissions').controller('auth').callback(koaContext);
 
       const output = koaContext.body;
 

package/server/graphql/mutations/auth/register.js

@@ -21,10 +21,7 @@ module.exports = ({ nexus, strapi }) => {
 
       koaContext.request.body = toPlainObject(args.input);
 
-      await strapi
-        .plugin('users-permissions')
-        .controller('auth')
-        .register(koaContext);
+      await strapi.plugin('users-permissions').controller('auth').register(koaContext);
 
       const output = koaContext.body;
 

package/server/graphql/mutations/auth/reset-password.js

@@ -23,10 +23,7 @@ module.exports = ({ nexus, strapi }) => {
 
       koaContext.request.body = toPlainObject(args);
 
-      await strapi
-        .plugin('users-permissions')
-        .controller('auth')
-        .resetPassword(koaContext);
+      await strapi.plugin('users-permissions').controller('auth').resetPassword(koaContext);
 
       const output = koaContext.body;
 

package/server/graphql/mutations/crud/role/create-role.js

@@ -26,10 +26,7 @@ module.exports = ({ nexus, strapi }) => {
 
       koaContext.request.body = toPlainObject(args.data);
 
-      await strapi
-        .plugin('users-permissions')
-        .controller('role')
-        .createRole(koaContext);
+      await strapi.plugin('users-permissions').controller('role').createRole(koaContext);
 
       return { ok: true };
     },

package/server/graphql/mutations/crud/role/delete-role.js

@@ -17,10 +17,7 @@ module.exports = ({ nexus, strapi }) => {
 
       koaContext.params = { role: args.id };
 
-      await strapi
-        .plugin('users-permissions')
-        .controller('role')
-        .deleteRole(koaContext);
+      await strapi.plugin('users-permissions').controller('role').deleteRole(koaContext);
 
       return { ok: true };
     },

package/server/graphql/mutations/crud/role/update-role.js

@@ -27,10 +27,7 @@ module.exports = ({ nexus, strapi }) => {
       koaContext.request.body = args.data;
       koaContext.request.body.role = args.id;
 
-      await strapi
-        .plugin('users-permissions')
-        .controller('role')
-        .updateRole(koaContext);
+      await strapi.plugin('users-permissions').controller('role').updateRole(koaContext);
 
       return { ok: true };
     },

package/server/graphql/mutations/crud/user/create-user.js

@@ -32,10 +32,7 @@ module.exports = ({ nexus, strapi }) => {
       koaContext.params = {};
       koaContext.request.body = toPlainObject(args.data);
 
-      await strapi
-        .plugin('users-permissions')
-        .controller('user')
-        .create(koaContext);
+      await strapi.plugin('users-permissions').controller('user').create(koaContext);
 
       checkBadRequest(koaContext.body);
 

package/server/graphql/mutations/crud/user/delete-user.js

@@ -26,10 +26,7 @@ module.exports = ({ nexus, strapi }) => {
 
       koaContext.params = { id: args.id };
 
-      await strapi
-        .plugin('users-permissions')
-        .controller('user')
-        .destroy(koaContext);
+      await strapi.plugin('users-permissions').controller('user').destroy(koaContext);
 
       checkBadRequest(koaContext.body);
 

package/server/graphql/mutations/crud/user/update-user.js

@@ -33,10 +33,7 @@ module.exports = ({ nexus, strapi }) => {
       koaContext.params = { id: args.id };
       koaContext.request.body = toPlainObject(args.data);
 
-      await strapi
-        .plugin('users-permissions')
-        .controller('user')
-        .update(koaContext);
+      await strapi.plugin('users-permissions').controller('user').update(koaContext);
 
       checkBadRequest(koaContext.body);
 

package/server/graphql/mutations/index.js

@@ -3,7 +3,7 @@
 const userUID = 'plugin::users-permissions.user';
 const roleUID = 'plugin::users-permissions.role';
 
-module.exports = context => {
+module.exports = (context) => {
   const { nexus, strapi } = context;
 
   const { naming } = strapi.plugin('graphql').service('utils');
@@ -25,6 +25,7 @@ module.exports = context => {
     register: require('./auth/register'),
     forgotPassword: require('./auth/forgot-password'),
     resetPassword: require('./auth/reset-password'),
+    changePassword: require('./auth/change-password'),
     emailConfirmation: require('./auth/email-confirmation'),
   };
 

package/server/graphql/resolvers-configs.js

@@ -23,6 +23,11 @@ module.exports = ({ strapi }) => {
     'Mutation.forgotPassword': { auth: false },
     'Mutation.resetPassword': { auth: false },
     'Mutation.emailConfirmation': { auth: false },
+    'Mutation.changePassword': {
+      auth: {
+        scope: 'plugin::users-permissions.auth.changePassword',
+      },
+    },
 
     // Scoped auth for replaced CRUD operations
     // Role

package/server/graphql/types/index.js

@@ -18,4 +18,4 @@ const typesFactories = [
  * @param {object} context.strapi
  * @return {any[]}
  */
-module.exports = context => typesFactories.map(factory => factory(context));
+module.exports = (context) => typesFactories.map((factory) => factory(context));

package/server/middlewares/rateLimit.js

@@ -1,30 +1,27 @@
 'use strict';
 
-module.exports = (config, { strapi }) => async (ctx, next) => {
-  const ratelimit = require('koa2-ratelimit').RateLimit;
+module.exports =
+  (config, { strapi }) =>
+  async (ctx, next) => {
+    const ratelimit = require('koa2-ratelimit').RateLimit;
 
-  const message = [
-    {
-      messages: [
-        {
-          id: 'Auth.form.error.ratelimit',
-          message: 'Too many attempts, please try again in a minute.',
-        },
-      ],
-    },
-  ];
-
-  return ratelimit.middleware(
-    Object.assign(
-      {},
+    const message = [
       {
-        interval: 1 * 60 * 1000,
-        max: 5,
-        prefixKey: `${ctx.request.path}:${ctx.request.ip}`,
-        message,
+        messages: [
+          {
+            id: 'Auth.form.error.ratelimit',
+            message: 'Too many attempts, please try again in a minute.',
+          },
+        ],
       },
-      strapi.config.get('plugin.users-permissions.ratelimit'),
-      config
-    )
-  )(ctx, next);
-};
+    ];
+
+    return ratelimit.middleware({
+      interval: 1 * 60 * 1000,
+      max: 5,
+      prefixKey: `${ctx.request.path}:${ctx.request.ip}`,
+      message,
+      ...strapi.config.get('plugin.users-permissions.ratelimit'),
+      ...config,
+    })(ctx, next);
+  };

package/server/register.js

@@ -1,4 +1,5 @@
 'use strict';
+
 const fs = require('fs');
 const path = require('path');
 
@@ -17,9 +18,6 @@ module.exports = ({ strapi }) => {
     const specPath = path.join(__dirname, '../documentation/content-api.yaml');
     const spec = fs.readFileSync(specPath, 'utf8');
 
-    strapi
-      .plugin('documentation')
-      .service('documentation')
-      .registerDoc(spec);
+    strapi.plugin('documentation').service('documentation').registerDoc(spec);
   }
 };

package/server/routes/content-api/auth.js

@@ -70,4 +70,13 @@ module.exports = [
       prefix: '',
     },
   },
+  {
+    method: 'POST',
+    path: '/auth/change-password',
+    handler: 'auth.changePassword',
+    config: {
+      middlewares: ['plugin::users-permissions.rateLimit'],
+      prefix: '',
+    },
+  },
 ];

package/server/services/jwt.js

@@ -38,16 +38,18 @@ module.exports = ({ strapi }) => ({
   },
 
   verify(token) {
-    return new Promise(function(resolve, reject) {
-      jwt.verify(token, strapi.config.get('plugin.users-permissions.jwtSecret'), {}, function(
-        err,
-        tokenPayload = {}
-      ) {
-        if (err) {
-          return reject(new Error('Invalid token.'));
+    return new Promise((resolve, reject) => {
+      jwt.verify(
+        token,
+        strapi.config.get('plugin.users-permissions.jwtSecret'),
+        {},
+        (err, tokenPayload = {}) => {
+          if (err) {
+            return reject(new Error('Invalid token.'));
+          }
+          resolve(tokenPayload);
         }
-        resolve(tokenPayload);
-      });
+      );
     });
   },
 });

package/server/services/providers-registry.js

@@ -4,15 +4,15 @@ const { strict: assert } = require('assert');
 const jwt = require('jsonwebtoken');
 
 const getInitialProviders = ({ purest }) => ({
-  async discord({ access_token }) {
+  async discord({ accessToken }) {
     const discord = purest({ provider: 'discord' });
     return discord
       .get('users/@me')
-      .auth(access_token)
+      .auth(accessToken)
       .request()
       .then(({ body }) => {
         // Combine username and discriminator because discord username is not unique
-        var username = `${body.username}#${body.discriminator}`;
+        const username = `${body.username}#${body.discriminator}`;
         return {
           username,
           email: body.email,
@@ -33,12 +33,12 @@ const getInitialProviders = ({ purest }) => ({
       };
     }
   },
-  async facebook({ access_token }) {
+  async facebook({ accessToken }) {
     const facebook = purest({ provider: 'facebook' });
 
     return facebook
       .get('me')
-      .auth(access_token)
+      .auth(accessToken)
       .qs({ fields: 'name,email' })
       .request()
       .then(({ body }) => ({
@@ -46,20 +46,20 @@ const getInitialProviders = ({ purest }) => ({
         email: body.email,
       }));
   },
-  async google({ access_token }) {
+  async google({ accessToken }) {
     const google = purest({ provider: 'google' });
 
     return google
       .query('oauth')
       .get('tokeninfo')
-      .qs({ access_token })
+      .qs({ accessToken })
       .request()
       .then(({ body }) => ({
         username: body.email.split('@')[0],
         email: body.email,
       }));
   },
-  async github({ access_token }) {
+  async github({ accessToken }) {
     const github = purest({
       provider: 'github',
       defaults: {
@@ -69,10 +69,7 @@ const getInitialProviders = ({ purest }) => ({
       },
     });
 
-    const { body: userBody } = await github
-      .get('user')
-      .auth(access_token)
-      .request();
+    const { body: userBody } = await github.get('user').auth(accessToken).request();
 
     // This is the public email on the github profile
     if (userBody.email) {
@@ -82,31 +79,28 @@ const getInitialProviders = ({ purest }) => ({
       };
     }
     // Get the email with Github's user/emails API
-    const { body: emailBody } = await github
-      .get('user/emails')
-      .auth(access_token)
-      .request();
+    const { body: emailBody } = await github.get('user/emails').auth(accessToken).request();
 
     return {
       username: userBody.login,
       email: Array.isArray(emailBody)
-        ? emailBody.find(email => email.primary === true).email
+        ? emailBody.find((email) => email.primary === true).email
         : null,
     };
   },
-  async microsoft({ access_token }) {
+  async microsoft({ accessToken }) {
     const microsoft = purest({ provider: 'microsoft' });
 
     return microsoft
       .get('me')
-      .auth(access_token)
+      .auth(accessToken)
       .request()
       .then(({ body }) => ({
         username: body.userPrincipalName,
         email: body.userPrincipalName,
       }));
   },
-  async twitter({ access_token, query, providers }) {
+  async twitter({ accessToken, query, providers }) {
     const twitter = purest({
       provider: 'twitter',
       defaults: {
@@ -119,7 +113,7 @@ const getInitialProviders = ({ purest }) => ({
 
     return twitter
       .get('account/verify_credentials')
-      .auth(access_token, query.access_secret)
+      .auth(accessToken, query.access_secret)
       .qs({ screen_name: query['raw[screen_name]'], include_email: 'true' })
       .request()
       .then(({ body }) => ({
@@ -127,12 +121,12 @@ const getInitialProviders = ({ purest }) => ({
         email: body.email,
       }));
   },
-  async instagram({ access_token }) {
+  async instagram({ accessToken }) {
     const instagram = purest({ provider: 'instagram' });
 
     return instagram
       .get('me')
-      .auth(access_token)
+      .auth(accessToken)
       .qs({ fields: 'id,username' })
       .request()
       .then(({ body }) => ({
@@ -140,12 +134,12 @@ const getInitialProviders = ({ purest }) => ({
         email: `${body.username}@strapi.io`, // dummy email as Instagram does not provide user email
       }));
   },
-  async vk({ access_token, query }) {
+  async vk({ accessToken, query }) {
     const vk = purest({ provider: 'vk' });
 
     return vk
       .get('users.get')
-      .auth(access_token)
+      .auth(accessToken)
       .qs({ id: query.raw.user_id, v: '5.122' })
       .request()
       .then(({ body }) => ({
@@ -153,7 +147,7 @@ const getInitialProviders = ({ purest }) => ({
         email: query.raw.email,
       }));
   },
-  async twitch({ access_token, providers }) {
+  async twitch({ accessToken, providers }) {
     const twitch = purest({
       provider: 'twitch',
       config: {
@@ -172,26 +166,23 @@ const getInitialProviders = ({ purest }) => ({
 
     return twitch
       .get('users')
-      .auth(access_token, providers.twitch.key)
+      .auth(accessToken, providers.twitch.key)
       .request()
       .then(({ body }) => ({
         username: body.data[0].login,
         email: body.data[0].email,
       }));
   },
-  async linkedin({ access_token }) {
+  async linkedin({ accessToken }) {
     const linkedIn = purest({ provider: 'linkedin' });
     const {
       body: { localizedFirstName },
-    } = await linkedIn
-      .get('me')
-      .auth(access_token)
-      .request();
+    } = await linkedIn.get('me').auth(accessToken).request();
     const {
       body: { elements },
     } = await linkedIn
       .get('emailAddress?q=members&projection=(elements*(handle~))')
-      .auth(access_token)
+      .auth(accessToken)
       .request();
 
     const email = elements[0]['handle~'];
@@ -201,7 +192,7 @@ const getInitialProviders = ({ purest }) => ({
       email: email.emailAddress,
     };
   },
-  async reddit({ access_token }) {
+  async reddit({ accessToken }) {
     const reddit = purest({
       provider: 'reddit',
       config: {
@@ -221,20 +212,20 @@ const getInitialProviders = ({ purest }) => ({
 
     return reddit
       .get('me')
-      .auth(access_token)
+      .auth(accessToken)
       .request()
       .then(({ body }) => ({
         username: body.name,
         email: `${body.name}@strapi.io`, // dummy email as Reddit does not provide user email
       }));
   },
-  async auth0({ access_token, providers }) {
+  async auth0({ accessToken, providers }) {
     const auth0 = purest({ provider: 'auth0' });
 
     return auth0
       .get('userinfo')
       .subdomain(providers.auth0.subdomain)
-      .auth(access_token)
+      .auth(accessToken)
       .request()
       .then(({ body }) => {
         const username = body.username || body.nickname || body.name || body.email.split('@')[0];
@@ -246,13 +237,13 @@ const getInitialProviders = ({ purest }) => ({
         };
       });
   },
-  async cas({ access_token, providers }) {
+  async cas({ accessToken, providers }) {
     const cas = purest({ provider: 'cas' });
 
     return cas
       .get('oidc/profile')
       .subdomain(providers.cas.subdomain)
-      .auth(access_token)
+      .auth(accessToken)
       .request()
       .then(({ body }) => {
         // CAS attribute may be in body.attributes or "FLAT", depending on CAS config
@@ -264,7 +255,7 @@ const getInitialProviders = ({ purest }) => ({
           : body.strapiemail || body.email;
         if (!username || !email) {
           strapi.log.warn(
-            'CAS Response Body did not contain required attributes: ' + JSON.stringify(body)
+            `CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`
           );
         }
         return {
@@ -288,14 +279,14 @@ module.exports = () => {
       providersCallbacks[providerName] = provider({ purest });
     },
 
-    async run({ provider, access_token, query, providers }) {
+    async run({ provider, accessToken, query, providers }) {
       if (!providersCallbacks[provider]) {
         throw new Error('Unknown provider.');
       }
 
       const providerCb = providersCallbacks[provider];
 
-      return providerCb({ access_token, query, providers });
+      return providerCb({ accessToken, query, providers });
     },
   };
 };

package/server/services/providers.js

@@ -1,7 +1,7 @@
 'use strict';
 
 /**
- * Module dependencies.
+ * Module dependencies
  */
 
 // Public node modules.
@@ -19,7 +19,7 @@ module.exports = ({ strapi }) => {
    */
 
   const getProfile = async (provider, query) => {
-    const access_token = query.access_token || query.code || query.oauth_token;
+    const accessToken = query.access_token || query.code || query.oauth_token;
 
     const providers = await strapi
       .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })
@@ -28,7 +28,7 @@ module.exports = ({ strapi }) => {
     return getService('providers-registry').run({
       provider,
       query,
-      access_token,
+      accessToken,
       providers,
     });
   };
@@ -38,15 +38,15 @@ module.exports = ({ strapi }) => {
    *
    *
    * @param {String}    provider
-   * @param {String}    access_token
+   * @param {String}    accessToken
    *
    * @return  {*}
    */
 
   const connect = async (provider, query) => {
-    const access_token = query.access_token || query.code || query.oauth_token;
+    const accessToken = query.access_token || query.code || query.oauth_token;
 
-    if (!access_token) {
+    if (!accessToken) {
       throw new Error('No access_token.');
     }