@strapi/plugin-users-permissions 5.0.0-beta.0 → 5.0.0-beta.10

package/server/services/user.js

@@ -10,7 +10,8 @@ const crypto = require('crypto');
 const bcrypt = require('bcryptjs');
 const urlJoin = require('url-join');
 
-const { sanitize, convertQueryParams } = require('@strapi/utils');
+const { sanitize } = require('@strapi/utils');
+const { toNumber, getOr } = require('lodash/fp');
 const { getService } = require('../utils');
 
 const USER_MODEL_UID = 'plugin::users-permissions.user';
@@ -27,10 +28,26 @@ module.exports = ({ strapi }) => ({
   },
 
   /**
-   * Promise to search count users
+   * Hashes password fields in the provided values object if they are present.
+   * It checks each key in the values object against the model's attributes and
+   * hashes it if the attribute type is 'password',
    *
-   * @return {Promise}
+   * @param {object} values - The object containing the fields to be hashed.
+   * @return {object} The values object with hashed password fields if they were present.
    */
+  async ensureHashedPasswords(values) {
+    const attributes = strapi.getModel(USER_MODEL_UID).attributes;
+
+    for (const key in values) {
+      if (attributes[key] && attributes[key].type === 'password') {
+        // Check if a custom encryption.rounds has been set on the password attribute
+        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));
+        values[key] = await bcrypt.hash(values[key], rounds);
+      }
+    }
+
+    return values;
+  },
 
   /**
    * Promise to add a/an user.
@@ -38,7 +55,7 @@ module.exports = ({ strapi }) => ({
    */
   async add(values) {
     return strapi.db.query(USER_MODEL_UID).create({
-      data: values,
+      data: await this.ensureHashedPasswords(values),
       populate: ['role'],
     });
   },
@@ -52,7 +69,7 @@ module.exports = ({ strapi }) => ({
   async edit(userId, params = {}) {
     return strapi.db.query(USER_MODEL_UID).update({
       where: { id: userId },
-      data: params,
+      data: await this.ensureHashedPasswords(params),
       populate: ['role'],
     });
   },
@@ -62,7 +79,7 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetch(id, params) {
-    const query = convertQueryParams.transformParamsToQuery(USER_MODEL_UID, params ?? {});
+    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});
 
     return strapi.db.query(USER_MODEL_UID).findOne({
       ...query,
@@ -85,7 +102,7 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetchAll(params) {
-    const query = convertQueryParams.transformParamsToQuery(USER_MODEL_UID, params ?? {});
+    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});
 
     return strapi.db.query(USER_MODEL_UID).findMany(query);
   },

package/server/services/users-permissions.js

@@ -45,7 +45,7 @@ module.exports = ({ strapi }) => ({
       return action[Symbol.for('__type__')].includes('content-api');
     };
 
-    _.forEach(strapi.api, (api, apiName) => {
+    _.forEach(strapi.apis, (api, apiName) => {
       const controllers = _.reduce(
         api.controllers,
         (acc, controller, controllerName) => {
@@ -105,7 +105,7 @@ module.exports = ({ strapi }) => ({
   async getRoutes() {
     const routesMap = {};
 
-    _.forEach(strapi.api, (api, apiName) => {
+    _.forEach(strapi.apis, (api, apiName) => {
       const routes = _.flatMap(api.routes, (route) => {
         if (_.has(route, 'routes')) {
           return route.routes;
@@ -156,7 +156,7 @@ module.exports = ({ strapi }) => ({
 
     const permissionsFoundInDB = _.uniq(_.map(dbPermissions, 'action'));
 
-    const appActions = _.flatMap(strapi.api, (api, apiName) => {
+    const appActions = _.flatMap(strapi.apis, (api, apiName) => {
       return _.flatMap(api.controllers, (controller, controllerName) => {
         return _.keys(controller).map((actionName) => {
           return `api::${apiName}.${controllerName}.${actionName}`;

package/server/utils/sanitize/sanitizers.js

@@ -6,7 +6,11 @@ const { traverseEntity, async } = require('@strapi/utils');
 const { removeUserRelationFromRoleEntities } = require('./visitors');
 
 const sanitizeUserRelationFromRoleEntities = curry((schema, entity) => {
-  return traverseEntity(removeUserRelationFromRoleEntities, { schema }, entity);
+  return traverseEntity(
+    removeUserRelationFromRoleEntities,
+    { schema, getModel: strapi.getModel.bind(strapi) },
+    entity
+  );
 });
 
 const defaultSanitizeOutput = curry((schema, entity) => {

package/server/utils/sanitize/visitors/remove-user-relation-from-role-entities.js

@@ -2,8 +2,8 @@
 
 module.exports = ({ schema, key, attribute }, { remove }) => {
   if (
-    attribute.type === 'relation' &&
-    attribute.target === 'plugin::users-permissions.user' &&
+    attribute?.type === 'relation' &&
+    attribute?.target === 'plugin::users-permissions.user' &&
     schema.uid === 'plugin::users-permissions.role'
   ) {
     remove(key);