Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 54 additions & 3 deletions plugins/plugin-api-permissions/server/src/bootstrap.ts
Original file line number Diff line number Diff line change
Expand Up @@ -33,9 +33,10 @@ const RBAC_ACTIONS = [
];

export default async ({ strapi }: { strapi: Core.Strapi }) => {
await strapi
.service("admin::permission")
.actionProvider.registerMany(RBAC_ACTIONS);
const provider = strapi.service("admin::permission").actionProvider;

await provider.registerMany(RBAC_ACTIONS);
await manualPermissionOverride(strapi);

const roleCount = await strapi.documents(ROLE_UID).count({});

Expand All @@ -57,3 +58,53 @@ export default async ({ strapi }: { strapi: Core.Strapi }) => {
});
}
};

/**
* Manually override permissions for API Roles to ensure they are always in sync with Content Manager permissions.
* @param strapi The Strapi instance
*/
const manualPermissionOverride = async (strapi: Core.Strapi) => {
const provider = strapi.service("admin::permission").actionProvider;

for (const action of ["read", "create", "update", "delete"]) {
const adminString = `plugin::content-manager.explorer.${action}`;
const aliasString = `plugin::api-permissions.roles.${action}`;

const adminAction = provider.get(adminString);
const aliasAction = provider.get(aliasString);

if (adminAction) {
if (!adminAction.subjects) adminAction.subjects = [];

if (!adminAction.subjects.includes(ROLE_UID)) {
adminAction.subjects.push(ROLE_UID);
}
}

if (aliasAction) {
if (!aliasAction.aliases) aliasAction.aliases = [];

const exists = aliasAction.aliases.some(
({ actionId, subjects }: { actionId: string; subjects?: string[] }) => {
return actionId === adminString && subjects?.includes(ROLE_UID);
},
);

if (!exists) {
aliasAction.aliases.push({
actionId: adminString,
subjects: [ROLE_UID],
});
}
}
}

try {
await strapi.service("admin::role")?.resetSuperAdminPermissions?.();
} catch (err) {
strapi.log.error(
"Failed to sync Super Admin permissions for API Roles:",
err,
);
}
};
Loading