From 3f4fb48a418243b6a6850aa61361bb1f47d9c1ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20de=20Juvigny?= <remi.dejuvigny@strapi.io>
Date: Mon, 25 Oct 2021 12:30:53 +0200
Subject: [PATCH] Add semver template check

---
 .../app/lib/utils/merge-template.js           | 31 +++++++++++++------
 packages/generators/app/package.json          |  2 ++
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/packages/generators/app/lib/utils/merge-template.js b/packages/generators/app/lib/utils/merge-template.js
index fa3bd93562..fe9defdd4a 100644
--- a/packages/generators/app/lib/utils/merge-template.js
+++ b/packages/generators/app/lib/utils/merge-template.js
@@ -5,6 +5,7 @@ const path = require('path');
 const fse = require('fs-extra');
 const _ = require('lodash');
 const chalk = require('chalk');
+const semver = require('semver');
 const { getTemplatePackageInfo, downloadNpmTemplate } = require('./fetch-npm-template');
 
 // Specify all the files and directories a template can have
@@ -14,16 +15,7 @@ const allowedTemplateContents = {
   'README.md': allowFile,
   '.env.example': allowFile,
   'package.json': allowFile,
-  src: {
-    'index.js': allowFile,
-    'bootstrap.js': allowFile,
-    admin: allowChildren,
-    api: allowChildren,
-    components: allowChildren,
-    middlewares: allowChildren,
-    policies: allowChildren,
-    plugins: allowChildren,
-  },
+  src: allowChildren,
   data: allowChildren,
   database: allowChildren,
   public: allowChildren,
@@ -55,6 +47,9 @@ module.exports = async function mergeTemplate(scope, rootPath) {
     templatePath = downloadNpmTemplate(templatePackageInfo, templateParentPath);
   }
 
+  // Make sure the template is compatible with this version of strapi
+  checkTemplateCompat(rootPath, scope.strapiVersion);
+
   // Make sure the downloaded template matches the required format
   const { templateConfig } = await checkTemplateRootStructure(templatePath, scope);
   await checkTemplateContentsStructure(path.resolve(templatePath, 'template'));
@@ -69,6 +64,22 @@ module.exports = async function mergeTemplate(scope, rootPath) {
   }
 };
 
+function checkTemplateCompat({ rootPath, strapiVersion, templatePackageInfo }) {
+  const packageJSON = require(path.resolve(rootPath, 'package.json'));
+  const compatibleStrapiRange = packageJSON.strapi;
+  // Throw error if not compatible
+  const isCompatible = semver.satisfies(strapiVersion, compatibleStrapiRange);
+  if (!isCompatible) {
+    const { name, version } = templatePackageInfo;
+    throw new Error(`
+      The template ${chalk.green(
+        `${name}@${version}`
+      )} is not compatible with Strapi version ${strapiVersion}.
+      It will only work with Strapi versions in the range ${chalk.green(compatibleStrapiRange)}.
+    `);
+  }
+}
+
 /**
  * Make sure the template has the required top-level structure
  * @param {string} templatePath - Path of the locally downloaded template
diff --git a/packages/generators/app/package.json b/packages/generators/app/package.json
index efaf9f0337..c2df2c839e 100644
--- a/packages/generators/app/package.json
+++ b/packages/generators/app/package.json
@@ -22,6 +22,8 @@
     "node-fetch": "^2.6.1",
     "node-machine-id": "^1.1.10",
     "ora": "^5.4.0",
+    "semver": "7.3.5",
+    "tar": "6.1.11",
     "uuid": "^3.3.2"
   },
   "scripts": {