Update transfer services, fix api tests

packages/core/admin/server/bootstrap.js

@@ -96,6 +96,4 @@ module.exports = async () => {
   apiTokenService.checkSaltIsDefined();
   transferService.token.checkSaltIsDefined();
   tokenService.checkSecretIsDefined();
-
-  transferService.permission.init();
 };

packages/core/admin/server/routes/transfer.js

@@ -18,7 +18,8 @@ module.exports = [
           return next();
         },
       ],
-      auth: { strategies: [dataTransferAuthStrategy] },
+      // TODO: Allow not passing any scope <> Add a way to prevent assigning one by default
+      auth: { strategies: [dataTransferAuthStrategy], scope: ['push'] },
     },
   },
   // Transfer Tokens

packages/core/admin/server/services/transfer/permission.js

@@ -5,44 +5,18 @@ const { providerFactory } = require('@strapi/utils');
 
 const DEFAULT_TRANSFER_ACTIONS = ['push'];
 
-const createPermissionService = () => {
-  const state = {
-    engine: null,
-
-    providers: {
-      action: null,
-      condition: null,
-    },
-  };
-
-  const registerTransferActions = () => {
-    if (!state.providers.action) {
-      return;
-    }
-
-    DEFAULT_TRANSFER_ACTIONS.forEach((action) => {
-      state.providers.action.register(action, { action });
-    });
-  };
-
-  return {
-    get engine() {
-      return state.engine;
-    },
-
-    get providers() {
-      return state.providers;
-    },
-
-    init() {
-      state.providers.action = providerFactory();
-      state.providers.condition = providerFactory();
-
-      registerTransferActions();
-
-      state.engine = permissions.engine.new({ providers: state.providers });
-    },
-  };
+const providers = {
+  action: providerFactory(),
+  condition: providerFactory(),
 };
 
-module.exports = createPermissionService();
+DEFAULT_TRANSFER_ACTIONS.forEach((action) => {
+  providers.action.register(action, { action });
+});
+
+const engine = permissions.engine.new({ providers });
+
+module.exports = {
+  engine,
+  providers,
+};

packages/core/admin/server/services/transfer/token.js

@@ -139,7 +139,7 @@ const update = async (id, attributes) => {
   assertTokenPermissionsValidity(attributes);
   assertValidLifespan(attributes);
 
-  const updatedToken = await strapi.db.transaction(async () => {
+  return strapi.db.transaction(async () => {
     const updatedToken = await strapi.query(TRANSFER_TOKEN_UID).update({
       select: SELECT_FIELDS,
       where: { id },
@@ -148,24 +148,50 @@ const update = async (id, attributes) => {
       },
     });
 
-    await strapi.query(TRANSFER_TOKEN_PERMISSION_UID).delete({
-      where: { token: id },
-    });
+    const currentPermissionsResult = await strapi.entityService.load(
+      TRANSFER_TOKEN_UID,
+      updatedToken,
+      'permissions'
+    );
 
-    return updatedToken;
+    const currentPermissions = map('action', currentPermissionsResult || []);
+    const newPermissions = uniq(attributes.permissions);
+
+    const actionsToDelete = difference(currentPermissions, newPermissions);
+    const actionsToAdd = difference(newPermissions, currentPermissions);
+
+    // TODO: improve efficiency here
+    // method using a loop -- works but very inefficient
+    await Promise.all(
+      actionsToDelete.map((action) =>
+        strapi.query(TRANSFER_TOKEN_PERMISSION_UID).delete({
+          where: { action, token: id },
+        })
+      )
+    );
+
+    // TODO: improve efficiency here
+    // using a loop -- works but very inefficient
+    await Promise.all(
+      actionsToAdd.map((action) =>
+        strapi.query(TRANSFER_TOKEN_PERMISSION_UID).create({
+          data: { action, token: id },
+        })
+      )
+    );
+
+    // retrieve permissions
+    const permissionsFromDb = await strapi.entityService.load(
+      TRANSFER_TOKEN_UID,
+      updatedToken,
+      'permissions'
+    );
+
+    return {
+      ...updatedToken,
+      permissions: permissionsFromDb ? permissionsFromDb.map((p) => p.action) : undefined,
+    };
   });
-
-  // retrieve permissions
-  const permissionsFromDb = await strapi.entityService.load(
-    'admin::transfer-token',
-    updatedToken,
-    'permissions'
-  );
-
-  return {
-    ...updatedToken,
-    permissions: permissionsFromDb ? permissionsFromDb.map((p) => p.action) : undefined,
-  };
 };
 
 /**
@@ -341,7 +367,7 @@ const flattenTokenPermissions = (token) => {
  * @param {TransferToken} token
  */
 const assertTokenPermissionsValidity = (attributes) => {
-  const { permission: permissionService } = strapi.admin.services.transfer;
+  const permissionService = strapi.admin.services.transfer.permission;
   const validPermissions = permissionService.providers.action.keys();
   const invalidPermissions = difference(attributes.permissions, validPermissions);
 

packages/core/admin/server/strategies/data-transfer.js

@@ -59,7 +59,7 @@ const authenticate = async (ctx) => {
   });
 
   // Generate an ability based on the token permissions
-  const ability = getService('transfer').permission.engine.generateAbility(
+  const ability = await getService('transfer').permission.engine.generateAbility(
     transferToken.permissions.map((action) => ({ action }))
   );
 

packages/core/data-transfer/src/strapi/providers/remote-destination/utils.ts

@@ -1,4 +1,3 @@
-import { set } from 'lodash/fp';
 import { v4 } from 'uuid';
 import { RawData, WebSocket } from 'ws';
 

packages/core/data-transfer/src/strapi/remote/constants.ts

@@ -1,2 +1,2 @@
-export const TRANSFER_PATH = '/transfer';
+export const TRANSFER_PATH = '/transfer/runner/connect';
 export const TRANSFER_METHODS = ['push', 'pull'];