@strapi/plugin-users-permissions 5.56.0 → 5.57.0

package/server/src/graphql/utils.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { getOr } = require('lodash/fp');
+const { get } = require('lodash');
 
 /**
  * Throws an ApolloError if context body contains a bad request
@@ -8,10 +8,10 @@ const { getOr } = require('lodash/fp');
  * @throws ApolloError if the body is a bad request
  */
 function checkBadRequest(contextBody) {
-  const statusCode = getOr(200, 'statusCode', contextBody);
+  const statusCode = get(contextBody, 'statusCode', 200);
 
   if (statusCode !== 200) {
-    const errorMessage = getOr('Bad Request', 'error', contextBody);
+    const errorMessage = get(contextBody, 'error', 'Bad Request');
 
     const exception = new Error(errorMessage);
 

package/server/src/middlewares/rateLimit.js

@@ -2,7 +2,7 @@
 
 const path = require('path');
 const utils = require('@strapi/utils');
-const { isString, has, toLower } = require('lodash/fp');
+const { toLower, isString, has } = require('lodash');
 
 const { RateLimitError } = utils.errors;
 
@@ -47,7 +47,7 @@ const routeUsesEmailIdentifier = (requestPath) => {
  */
 const normalizeRequestPathForRateLimit = (requestPath) => {
   const normalized = path.posix.normalize(requestPath);
-  const lower = toLower(normalized);
+  const lower = normalized.toLowerCase();
   return lower.replace(/\/+$/, '') || '/';
 };
 
@@ -102,7 +102,7 @@ module.exports =
       };
     }
 
-    if (!has('enabled', rateLimitConfig)) {
+    if (!has(rateLimitConfig, 'enabled')) {
       rateLimitConfig.enabled = true;
     }
 

package/server/src/services/user.js

@@ -11,12 +11,12 @@ const bcrypt = require('bcryptjs');
 const urlJoin = require('url-join');
 
 const { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require('@strapi/utils');
-const { toNumber, getOr, pick } = require('lodash/fp');
+const { pick, get, toNumber } = require('lodash');
 const { getService } = require('../utils');
 
 const USER_MODEL_UID = 'plugin::users-permissions.user';
 
-const pickAllowedQueryParams = pick(ALLOWED_QUERY_PARAM_KEYS);
+const pickAllowedQueryParams = (params) => pick(params, ALLOWED_QUERY_PARAM_KEYS);
 
 const getSessionManager = () => {
   const manager = strapi.sessionManager;
@@ -52,7 +52,7 @@ module.exports = ({ strapi }) => ({
     for (const key in values) {
       if (attributes[key] && attributes[key].type === 'password') {
         // Check if a custom encryption.rounds has been set on the password attribute
-        const rounds = toNumber(getOr(10, 'encryption.rounds', attributes[key]));
+        const rounds = toNumber(get(attributes[key], 'encryption.rounds', 10));
         values[key] = await bcrypt.hash(values[key], rounds);
       }
     }

package/server/src/services/users-permissions.js

@@ -1,7 +1,6 @@
 'use strict';
 
 const _ = require('lodash');
-const { filter, map, pipe, prop } = require('lodash/fp');
 const urlJoin = require('url-join');
 const {
   template: { createStrictInterpolationRegExp },
@@ -193,10 +192,9 @@ module.exports = ({ strapi }) => ({
     if (permissionsFoundInDB.length === 0) {
       // create default permissions
       for (const role of roles) {
-        const toCreate = pipe(
-          filter(({ roleType }) => roleType === role.type || roleType === null),
-          map(prop('action'))
-        )(DEFAULT_PERMISSIONS);
+        const toCreate = DEFAULT_PERMISSIONS.filter(
+          ({ roleType }) => roleType === role.type || roleType === null
+        ).map(({ action }) => action);
 
         await Promise.all(
           toCreate.map((action) => {

package/server/src/strategies/users-permissions.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { castArray, map, every, pipe } = require('lodash/fp');
+const { map, every } = require('lodash');
 const { ForbiddenError, UnauthorizedError } = require('@strapi/utils').errors;
 
 const { getService } = require('../utils');
@@ -43,7 +43,11 @@ const authenticate = async (ctx) => {
       // Fetch user's permissions
       const permissions = await Promise.resolve(user.role.id)
         .then(getService('permission').findRolePermissions)
-        .then(map(getService('permission').toContentAPIPermission));
+        .then((permissions) =>
+          map(permissions, (permission) =>
+            getService('permission').toContentAPIPermission(permission)
+          )
+        );
 
       // Generate an ability (content API engine) based on the given permissions
       const ability = await strapi.contentAPI.permissions.engine.generateAbility(permissions);
@@ -64,7 +68,11 @@ const authenticate = async (ctx) => {
 
     const publicPermissions = await getService('permission')
       .findPublicPermissions()
-      .then(map(getService('permission').toContentAPIPermission));
+      .then((permissions) =>
+        map(permissions, (permission) =>
+          getService('permission').toContentAPIPermission(permission)
+        )
+      );
 
     if (publicPermissions.length === 0) {
       return { authenticated: false };
@@ -100,12 +108,8 @@ const verify = async (auth, config) => {
     throw new UnauthorizedError();
   }
 
-  const isAllowed = pipe(
-    // Make sure we're dealing with an array
-    castArray,
-    // Transform the scope array into an action array
-    every((scope) => ability.can(scope))
-  )(config.scope);
+  const scopes = Array.isArray(config.scope) ? config.scope : [config.scope];
+  const isAllowed = every(scopes, (scope) => ability.can(scope));
 
   if (!isAllowed) {
     throw new ForbiddenError();

package/server/src/utils/sanitize/sanitizers.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { curry } = require('lodash/fp');
+const { curry } = require('lodash');
 const { traverseEntity, async } = require('@strapi/utils');
 
 const { removeUserRelationFromRoleEntities } = require('./visitors');