all repos — caroster @ be8f93ea0966f0bc0587c2c127ee1ba15594a049

[Octree] Group carpool to your event https://caroster.io

🔒️ Fix REST & GQL endpoints auth
Tim Izzo tim@octree.ch
Tue, 18 Oct 2022 18:41:14 +0200
commit

be8f93ea0966f0bc0587c2c127ee1ba15594a049

parent

ea92a9b15855405d1763060205707af3b3745c02

M backend/config/permissions.tsbackend/config/permissions.ts

@@ -2,25 +2,20 @@ const publicPerms = [

"api::travel.travel.create", "api::travel.travel.delete", "api::travel.travel.update", - "api::vehicle.vehicle.create", "api::vehicle.vehicle.delete", "api::vehicle.vehicle.update", - "api::event.event.create", "api::event.event.findOne", "api::event.event.update", - "api::passenger.passenger.create", "api::passenger.passenger.delete", "api::passenger.passenger.update", - "api::page.page.find", "api::page.page.findOne", - "api::setting.setting.find", - // GraphQL disabled at load + // // GraphQL disabled at load "api::travel.travel.find", "api::passenger.passenger.find", "api::event.event.find",
M backend/src/api/event/routes/event.tsbackend/src/api/event/routes/event.ts

@@ -1,6 +1,3 @@

import { factories } from "@strapi/strapi"; -export default factories.createCoreRouter("api::event.event", { - only: ["findOne", "create"], - config: {}, -}); +export default factories.createCoreRouter("api::event.event");
D backend/src/api/page/services/page.js

@@ -1,8 +0,0 @@

-'use strict'; - -/** - * Read the documentation (https://strapi.io/documentation/v3.x/concepts/services.html#core-services) - * to customize this service - */ - -module.exports = {};
A backend/src/api/page/services/page.ts

@@ -0,0 +1,3 @@

+import { factories } from "@strapi/strapi"; + +export default factories.createCoreService("api::page.page");
M backend/src/api/passenger/routes/passenger.tsbackend/src/api/passenger/routes/passenger.ts

@@ -1,3 +1,3 @@

-export default { - routes: [], -}; +import { factories } from "@strapi/strapi"; + +export default factories.createCoreRouter("api::passenger.passenger");
D backend/src/api/passenger/services/passenger.js

@@ -1,8 +0,0 @@

-'use strict'; - -/** - * Read the documentation (https://strapi.io/documentation/developer-docs/latest/development/backend-customization.html#core-services) - * to customize this service - */ - -module.exports = {};
A backend/src/api/passenger/services/passenger.ts

@@ -0,0 +1,3 @@

+import { factories } from "@strapi/strapi"; + +export default factories.createCoreService("api::passenger.passenger");
M backend/src/api/setting/routes/setting.tsbackend/src/api/setting/routes/setting.ts

@@ -1,3 +1,3 @@

-export default { - routes: [], -}; +import { factories } from "@strapi/strapi"; + +export default factories.createCoreRouter("api::setting.setting");
M backend/src/api/travel/routes/travel.tsbackend/src/api/travel/routes/travel.ts

@@ -1,3 +1,3 @@

-export default { - routes: [], -}; +import { factories } from "@strapi/strapi"; + +export default factories.createCoreRouter("api::travel.travel");
D backend/src/api/travel/services/travel.js

@@ -1,8 +0,0 @@

-'use strict'; - -/** - * Read the documentation (https://strapi.io/documentation/developer-docs/latest/development/backend-customization.html#core-services) - * to customize this service - */ - -module.exports = {};
A backend/src/api/travel/services/travel.ts

@@ -0,0 +1,3 @@

+import { factories } from "@strapi/strapi"; + +export default factories.createCoreService("api::travel.travel");
M backend/src/api/vehicle/routes/vehicles.tsbackend/src/api/vehicle/routes/vehicles.ts

@@ -1,3 +1,3 @@

-export default { - routes: [], -}; +import { factories } from "@strapi/strapi"; + +export default factories.createCoreRouter("api::vehicle.vehicle");
M backend/src/index.tsbackend/src/index.ts

@@ -11,8 +11,17 @@ */

register(context) { graphqlExtends(context); - // Disable /users find REST endpoint - context.strapi.controller("plugin::users-permissions.user").find = () => {}; + // Disable REST endpoints + context.strapi.controller("api::event.event").find = (ctx) => + ctx.unauthorized(); + context.strapi.controller("api::passenger.passenger").find = (ctx) => + ctx.unauthorized(); + context.strapi.controller("api::travel.travel").find = (ctx) => + ctx.unauthorized(); + context.strapi.controller("api::vehicle.vehicle").find = (ctx) => + ctx.unauthorized(); + context.strapi.controller("plugin::users-permissions.user").find = (ctx) => + ctx.unauthorized(); }, /**