@strapi/strapi 4.14.0-beta.0 → 4.14.1

package/lib/middlewares/public/index.js

@@ -1,94 +0,0 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const stream = require('stream');
-const _ = require('lodash');
-const { defaultsDeep } = require('lodash/fp');
-const koaStatic = require('koa-static');
-const utils = require('../../utils');
-const serveStatic = require('./serve-static');
-
-const defaults = {
-  maxAge: 60000,
-  defaultIndex: true,
-};
-
-/**
- * @type {import('../').MiddlewareFactory}
- */
-module.exports = (config, { strapi }) => {
-  const { defaultIndex, maxAge } = defaultsDeep(defaults, config);
-
-  if (defaultIndex === true) {
-    const index = fs.readFileSync(path.join(__dirname, 'index.html'), 'utf8');
-
-    const serveIndexPage = async (ctx, next) => {
-      // defer rendering of strapi index page
-      await next();
-
-      if (ctx.body != null || ctx.status !== 404) return;
-
-      ctx.url = 'index.html';
-      const isInitialized = await utils.isInitialized(strapi);
-      const data = {
-        serverTime: new Date().toUTCString(),
-        isInitialized,
-        ..._.pick(strapi, [
-          'config.info.version',
-          'config.info.name',
-          'config.admin.url',
-          'config.server.url',
-          'config.environment',
-          'config.serveAdminPanel',
-        ]),
-      };
-      const content = _.template(index)(data);
-      const body = stream.Readable({
-        read() {
-          this.push(Buffer.from(content));
-          this.push(null);
-        },
-      });
-      // Serve static.
-      ctx.type = 'html';
-      ctx.body = body;
-    };
-
-    strapi.server.routes([
-      {
-        method: 'GET',
-        path: '/',
-        handler: serveIndexPage,
-        config: { auth: false },
-      },
-      {
-        method: 'GET',
-        path: '/index.html',
-        handler: serveIndexPage,
-        config: { auth: false },
-      },
-      {
-        method: 'GET',
-        path: '/assets/images/(.*)',
-        handler: serveStatic(path.resolve(__dirname, 'assets/images'), {
-          maxage: maxAge,
-          defer: true,
-        }),
-        config: { auth: false },
-      },
-      // All other public GET-routes except /uploads/(.*) which is handled in upload middleware
-      {
-        method: 'GET',
-        path: '/((?!uploads/).+)',
-        handler: koaStatic(strapi.dirs.static.public, {
-          maxage: maxAge,
-          defer: true,
-        }),
-        config: { auth: false },
-      },
-    ]);
-  }
-
-  return null;
-};

package/lib/middlewares/public/serve-static.js

@@ -1,23 +0,0 @@
-'use strict';
-
-const path = require('path');
-const koaStatic = require('koa-static');
-
-// serveStatic is not supposed to be used to serve a folder that have sub-folders
-const serveStatic = (filesDir, koaStaticOptions = {}) => {
-  const serve = koaStatic(filesDir, koaStaticOptions);
-
-  return async (ctx, next) => {
-    const prev = ctx.path;
-    const newPath = path.basename(ctx.path);
-    ctx.path = newPath;
-    await serve(ctx, async () => {
-      ctx.path = prev;
-      await next();
-      ctx.path = newPath;
-    });
-    ctx.path = prev;
-  };
-};
-
-module.exports = serveStatic;

package/lib/middlewares/query.js

@@ -1,52 +0,0 @@
-'use strict';
-
-const { defaultsDeep } = require('lodash/fp');
-const qs = require('qs');
-
-const defaults = {
-  strictNullHandling: true,
-  arrayLimit: 100,
-  depth: 20,
-};
-
-/**
- * Body parser hook
- */
-const addQsParser = (app, settings) => {
-  Object.defineProperty(app.request, 'query', {
-    configurable: false,
-    enumerable: true,
-    /*
-     * Get parsed query-string.
-     */
-    get() {
-      const qstr = this.querystring;
-      this._querycache = this._querycache || {};
-      const cache = this._querycache;
-
-      if (!cache[qstr]) {
-        cache[qstr] = qs.parse(qstr, settings);
-      }
-
-      return cache[qstr];
-    },
-
-    /*
-     * Set query-string as an object.
-     */
-    set(obj) {
-      this.querystring = qs.stringify(obj);
-    },
-  });
-
-  return app;
-};
-
-/**
- * @type {import('./').MiddlewareFactory}
- */
-module.exports = (config, { strapi }) => {
-  addQsParser(strapi.server.app, defaultsDeep(defaults, config));
-
-  return null;
-};

package/lib/middlewares/response-time.js

@@ -1,15 +0,0 @@
-'use strict';
-
-/**
- * @type {import('./').MiddlewareFactory}
- */
-module.exports = () => {
-  return async (ctx, next) => {
-    const start = Date.now();
-
-    await next();
-
-    const delta = Math.ceil(Date.now() - start);
-    ctx.set('X-Response-Time', `${delta}ms`);
-  };
-};

package/lib/middlewares/responses.js

@@ -1,19 +0,0 @@
-'use strict';
-
-const { prop, isFunction } = require('lodash/fp');
-
-/**
- * @type {import('./').MiddlewareFactory}
- */
-module.exports = (config = {}) => {
-  return async (ctx, next) => {
-    await next();
-
-    const { status } = ctx;
-    const handler = prop(`handlers.${status}`, config);
-
-    if (isFunction(handler)) {
-      await handler(ctx);
-    }
-  };
-};

package/lib/middlewares/security.js

@@ -1,57 +0,0 @@
-'use strict';
-
-const { defaultsDeep, merge } = require('lodash/fp');
-const helmet = require('koa-helmet');
-
-const defaults = {
-  crossOriginEmbedderPolicy: false,
-  crossOriginOpenerPolicy: false,
-  crossOriginResourcePolicy: false,
-  originAgentCluster: false,
-  contentSecurityPolicy: {
-    useDefaults: true,
-    directives: {
-      'connect-src': ["'self'", 'https:'],
-      'img-src': ["'self'", 'data:', 'blob:', 'https://market-assets.strapi.io'],
-      'media-src': ["'self'", 'data:', 'blob:'],
-      upgradeInsecureRequests: null,
-    },
-  },
-  xssFilter: false,
-  hsts: {
-    maxAge: 31536000,
-    includeSubDomains: true,
-  },
-  frameguard: {
-    action: 'sameorigin',
-  },
-};
-
-/**
- * @type {import('./').MiddlewareFactory}
- */
-
-module.exports =
-  (config, { strapi }) =>
-  (ctx, next) => {
-    let helmetConfig = defaultsDeep(defaults, config);
-    const specialPaths = ['/documentation'];
-
-    if (strapi.plugin('graphql')) {
-      const { config: gqlConfig } = strapi.plugin('graphql');
-      specialPaths.push(gqlConfig('endpoint'));
-    }
-
-    if (ctx.method === 'GET' && specialPaths.some((str) => ctx.path.startsWith(str))) {
-      helmetConfig = merge(helmetConfig, {
-        contentSecurityPolicy: {
-          directives: {
-            'script-src': ["'self'", "'unsafe-inline'", 'cdn.jsdelivr.net'],
-            'img-src': ["'self'", 'data:', 'cdn.jsdelivr.net', 'strapi.io'],
-          },
-        },
-      });
-    }
-
-    return helmet(helmetConfig)(ctx, next);
-  };

package/lib/middlewares/session.js

@@ -1,30 +0,0 @@
-'use strict';
-
-const { defaultsDeep, isEmpty, isArray } = require('lodash/fp');
-const session = require('koa-session');
-
-const defaultConfig = {
-  key: 'koa.sess',
-  maxAge: 86400000,
-  autoCommit: true,
-  overwrite: true,
-  httpOnly: true,
-  signed: true,
-  rolling: false,
-  renew: false,
-  secure: process.env.NODE_ENV === 'production',
-  sameSite: null,
-};
-
-module.exports = (userConfig, { strapi }) => {
-  const { keys } = strapi.server.app;
-  if (!isArray(keys) || isEmpty(keys) || keys.some(isEmpty)) {
-    throw new Error(
-      `App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`
-    );
-  }
-
-  const config = defaultsDeep(defaultConfig, userConfig);
-
-  strapi.server.use(session(config, strapi.server.app));
-};

package/lib/migrations/draft-publish.js

@@ -1,53 +0,0 @@
-'use strict';
-
-const { hasDraftAndPublish } = require('@strapi/utils').contentTypes;
-
-const enableDraftAndPublish = async ({ oldContentTypes, contentTypes }) => {
-  if (!oldContentTypes) {
-    return;
-  }
-  // run the after content types migrations
-
-  for (const uid in contentTypes) {
-    if (!oldContentTypes[uid]) {
-      continue;
-    }
-
-    const oldContentType = oldContentTypes[uid];
-    const contentType = contentTypes[uid];
-
-    // if d&p was enabled set publishedAt to eq createdAt
-    if (!hasDraftAndPublish(oldContentType) && hasDraftAndPublish(contentType)) {
-      const qb = strapi.db.queryBuilder(uid);
-      await qb
-        .update({ published_at: qb.ref('created_at') })
-        .where({ published_at: null })
-        .execute();
-    }
-  }
-};
-
-const disableDraftAndPublish = async ({ oldContentTypes, contentTypes }) => {
-  if (!oldContentTypes) {
-    return;
-  }
-
-  for (const uid in contentTypes) {
-    if (!oldContentTypes[uid]) {
-      continue;
-    }
-
-    const oldContentType = oldContentTypes[uid];
-    const contentType = contentTypes[uid];
-
-    // if d&p was disabled remove unpublish content before sync
-    if (hasDraftAndPublish(oldContentType) && !hasDraftAndPublish(contentType)) {
-      await strapi.db.queryBuilder(uid).delete().where({ published_at: null }).execute();
-    }
-  }
-};
-
-module.exports = {
-  enable: enableDraftAndPublish,
-  disable: disableDraftAndPublish,
-};

package/lib/services/auth/index.js

@@ -1,109 +0,0 @@
-'use strict';
-
-const { strict: assert } = require('assert');
-const { has, prop } = require('lodash/fp');
-
-const { UnauthorizedError } = require('@strapi/utils').errors;
-
-const INVALID_STRATEGY_MSG =
-  'Invalid auth strategy. Expecting an object with properties {name: string, authenticate: function, verify: function}';
-
-const validStrategy = (strategy) => {
-  assert(has('authenticate', strategy), INVALID_STRATEGY_MSG);
-  assert(typeof strategy.authenticate === 'function', INVALID_STRATEGY_MSG);
-
-  if (has('verify', strategy)) {
-    assert(typeof strategy.verify === 'function', INVALID_STRATEGY_MSG);
-  }
-};
-
-const createAuthentication = () => {
-  const strategies = {};
-
-  return {
-    register(type, strategy) {
-      validStrategy(strategy);
-
-      if (!strategies[type]) {
-        strategies[type] = [];
-      }
-
-      strategies[type].push(strategy);
-
-      return this;
-    },
-
-    async authenticate(ctx, next) {
-      const { route } = ctx.state;
-
-      // use route strategy
-      const config = prop('config.auth', route);
-
-      if (config === false) {
-        return next();
-      }
-
-      const routeStrategies = strategies[route.info.type];
-      const configStrategies = config?.strategies ?? routeStrategies ?? [];
-
-      const strategiesToUse = configStrategies.reduce((acc, strategy) => {
-        // Resolve by strategy name
-        if (typeof strategy === 'string') {
-          const routeStrategy = routeStrategies.find((rs) => rs.name === strategy);
-
-          if (routeStrategy) {
-            acc.push(routeStrategy);
-          }
-        }
-
-        // Use the given strategy as is
-        else if (typeof strategy === 'object') {
-          validStrategy(strategy);
-
-          acc.push(strategy);
-        }
-
-        return acc;
-      }, []);
-
-      for (const strategy of strategiesToUse) {
-        const result = await strategy.authenticate(ctx);
-
-        const { authenticated = false, credentials, ability = null, error = null } = result || {};
-
-        if (error !== null) {
-          return ctx.unauthorized(error);
-        }
-
-        if (authenticated) {
-          ctx.state.isAuthenticated = true;
-          ctx.state.auth = {
-            strategy,
-            credentials,
-            ability,
-          };
-
-          return next();
-        }
-      }
-
-      return ctx.unauthorized('Missing or invalid credentials');
-    },
-
-    async verify(auth, config = {}) {
-      if (config === false) {
-        return;
-      }
-
-      if (!auth) {
-        throw new UnauthorizedError();
-      }
-
-      if (typeof auth.strategy.verify === 'function') {
-        return auth.strategy.verify(auth, config);
-      }
-    },
-  };
-};
-
-module.exports = createAuthentication;

package/lib/services/content-api/index.js

@@ -1,74 +0,0 @@
-'use strict';
-
-const _ = require('lodash');
-const instantiatePermissionsUtilities = require('./permissions');
-
-const transformRoutePrefixFor = (pluginName) => (route) => {
-  const prefix = route.config && route.config.prefix;
-  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;
-
-  return {
-    ...route,
-    path,
-  };
-};
-
-/**
- * Create a content API container that holds logic, tools and utils. (eg: permissions, ...)
- */
-const createContentAPI = (strapi) => {
-  const getRoutesMap = async () => {
-    const routesMap = {};
-
-    _.forEach(strapi.api, (api, apiName) => {
-      const routes = _.flatMap(api.routes, (route) => {
-        if (_.has(route, 'routes')) {
-          return route.routes;
-        }
-
-        return route;
-      }).filter((route) => route.info.type === 'content-api');
-
-      if (routes.length === 0) {
-        return;
-      }
-
-      const apiPrefix = strapi.config.get('api.rest.prefix');
-      routesMap[`api::${apiName}`] = routes.map((route) => ({
-        ...route,
-        path: `${apiPrefix}${route.path}`,
-      }));
-    });
-
-    _.forEach(strapi.plugins, (plugin, pluginName) => {
-      const transformPrefix = transformRoutePrefixFor(pluginName);
-
-      const routes = _.flatMap(plugin.routes, (route) => {
-        if (_.has(route, 'routes')) {
-          return route.routes.map(transformPrefix);
-        }
-
-        return transformPrefix(route);
-      }).filter((route) => route.info.type === 'content-api');
-
-      if (routes.length === 0) {
-        return;
-      }
-
-      const apiPrefix = strapi.config.get('api.rest.prefix');
-      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({
-        ...route,
-        path: `${apiPrefix}${route.path}`,
-      }));
-    });
-
-    return routesMap;
-  };
-
-  return {
-    permissions: instantiatePermissionsUtilities(strapi),
-    getRoutesMap,
-  };
-};
-
-module.exports = createContentAPI;

package/lib/services/content-api/permissions/engine.js

@@ -1,5 +0,0 @@
-'use strict';
-
-const permissions = require('@strapi/permissions');
-
-module.exports = ({ providers }) => permissions.engine.new({ providers });

package/lib/services/content-api/permissions/index.js

@@ -1,148 +0,0 @@
-'use strict';
-
-const _ = require('lodash');
-const { createActionProvider, createConditionProvider } = require('./providers');
-const createPermissionEngine = require('./engine');
-
-/**
- * Creates an handler that checks if the permission's action exists in the action registry
- */
-const createValidatePermissionHandler =
-  (actionProvider) =>
-  ({ permission }) => {
-    const action = actionProvider.get(permission.action);
-
-    // If the action isn't registered into the action provider, then ignore the permission and warn the user
-    if (!action) {
-      strapi.log.debug(
-        `Unknown action "${permission.action}" supplied when registering a new permission`
-      );
-      return false;
-    }
-  };
-
-/**
- * Create instances of providers and permission engine for the core content-API service.
- * Also, expose utilities to get informations about available actions and such.
- *
- * @param {Strapi.Strapi} strapi
- */
-module.exports = (strapi) => {
-  // NOTE: Here we define both an action and condition provider,
-  // but at the moment, we're only using the action one.
-  const providers = {
-    action: createActionProvider(),
-    condition: createConditionProvider(),
-  };
-
-  /**
-   * Get a tree representation of the available Content API actions
-   * based on the methods of the Content API controllers.
-   *
-   * @note Only actions bound to a content-API route are returned.
-   *
-   * @return {{ [api: string]: { [controller: string]: string[] }}}
-   */
-  const getActionsMap = () => {
-    const actionMap = {};
-
-    /**
-     * Check if a controller's action is bound to the
-     * content-api by looking at a potential __type__ symbol
-     *
-     * @param {object} action
-     *
-     * @return {boolean}
-     */
-    const isContentApi = (action) => {
-      if (!_.has(action, Symbol.for('__type__'))) {
-        return false;
-      }
-
-      return action[Symbol.for('__type__')].includes('content-api');
-    };
-
-    /**
-     * Register actions from a specific API source into the result tree
-     *
-     * @param {{ [apiName]: { controllers: { [controller]: object } }}} apis The API container
-     * @param {string} source The prefix to use in front the API name
-     *
-     * @return {void}
-     */
-    const registerAPIsActions = (apis, source) => {
-      _.forEach(apis, (api, apiName) => {
-        const controllers = _.reduce(
-          api.controllers,
-          (acc, controller, controllerName) => {
-            const contentApiActions = _.pickBy(controller, isContentApi);
-
-            if (_.isEmpty(contentApiActions)) {
-              return acc;
-            }
-
-            acc[controllerName] = Object.keys(contentApiActions);
-
-            return acc;
-          },
-          {}
-        );
-
-        if (!_.isEmpty(controllers)) {
-          actionMap[`${source}::${apiName}`] = { controllers };
-        }
-      });
-    };
-
-    registerAPIsActions(strapi.api, 'api');
-    registerAPIsActions(strapi.plugins, 'plugin');
-
-    return actionMap;
-  };
-
-  /**
-   * Register all the content-API's controllers actions into the action provider.
-   * This method make use of the {@link getActionsMap} to generate the list of actions to register.
-   *
-   * @return {void}
-   */
-  const registerActions = async () => {
-    const actionsMap = getActionsMap();
-
-    // For each API
-    for (const [api, value] of Object.entries(actionsMap)) {
-      const { controllers } = value;
-
-      // Register controllers methods as actions
-      for (const [controller, actions] of Object.entries(controllers)) {
-        // Register each action individually
-        await Promise.all(
-          actions.map((action) => {
-            const actionUID = `${api}.${controller}.${action}`;
-
-            return providers.action.register(actionUID, {
-              api,
-              controller,
-              action,
-              uid: actionUID,
-            });
-          })
-        );
-      }
-    }
-  };
-
-  // Create an instance of a content-API permission engine
-  // and binds a custom validation handler to it
-  const engine = createPermissionEngine({ providers }).on(
-    'before-format::validate.permission',
-    createValidatePermissionHandler(providers.action)
-  );
-
-  return {
-    engine,
-    providers,
-    registerActions,
-    getActionsMap,
-  };
-};