refactor: extraire la vérification JWT/payload en policy partagée

src/api/commentaire/controllers/__tests__/commentaire.test.js

@@ -5,7 +5,7 @@ const {default: createController} = await import('../commentaire.js')
 const dbUser = {id: 1, username: 'foo', email: 'foo@bar.com'}
 const dbParole = {id: 7, documentId: 'parole-doc-7'}
 
-function buildStrapi({jwtUserId, existingParole = dbParole}) {
+function buildStrapi({existingParole = dbParole} = {}) {
   const commentaireDocuments = {
     create: vi.fn(async ({data}) => ({id: 99, ...data}))
   }
@@ -21,15 +21,6 @@ function buildStrapi({jwtUserId, existingParole = dbParole}) {
 
   const strapi = {
     contentType: vi.fn(() => ({uid: 'api::commentaire.commentaire', kind: 'collectionType'})),
-    plugins: {
-      'users-permissions': {
-        services: {
-          jwt: {
-            getToken: vi.fn(async () => ({id: jwtUserId}))
-          }
-        }
-      }
-    },
     db: {
       query: vi.fn(uid => {
         if (uid === 'plugin::users-permissions.user') return userDbQuery
@@ -68,7 +59,7 @@ function buildData(overrides = {}) {
 
 describe('commentaire.create', () => {
   it('retrouve la parole par son id (pas par le documentId du user) et l\'associe correctement', async () => {
-    const {strapi, commentaireDocuments, paroleDocuments, paroleDbQuery} = buildStrapi({jwtUserId: dbUser.id})
+    const {strapi, commentaireDocuments, paroleDocuments, paroleDbQuery} = buildStrapi()
     const controller = createController({strapi})
     const ctx = buildCtx(buildData())
 
@@ -83,7 +74,7 @@ describe('commentaire.create', () => {
   })
 
   it('rejette quand la parole ciblée n\'existe pas', async () => {
-    const {strapi, commentaireDocuments} = buildStrapi({jwtUserId: dbUser.id, existingParole: null})
+    const {strapi, commentaireDocuments} = buildStrapi({existingParole: null})
     const controller = createController({strapi})
     const ctx = buildCtx(buildData())
 

src/api/commentaire/controllers/commentaire.js

@@ -1,26 +1,13 @@
 'use strict';
 
 const { createCoreController } = require('@strapi/strapi').factories;
-const { ApplicationError, NotFoundError, UnauthorizedError } = require("@strapi/utils").errors
+const { ApplicationError, NotFoundError } = require("@strapi/utils").errors
 
 module.exports = createCoreController('api::commentaire.commentaire', ({strapi}) => ({
   async create(ctx) {
     const {body} = ctx.request
     let {data} = body
 
-    if (ctx.request && ctx.request.header && ctx.request.header.authorization) {
-      try {
-        const {id} = await strapi.plugins[
-          'users-permissions'
-        ].services.jwt.getToken(ctx)
-
-        if (id !== data.user.id) {
-          throw new UnauthorizedError('Opération non autorisée')
-        }
-      } catch (err) {
-        throw new UnauthorizedError(ctx, err, 'Opération non autorisée')
-      }
-    }
     const user = await strapi.db.query('plugin::users-permissions.user').findOne({
       where: {id: data.user.id}
     })

src/api/commentaire/routes/commentaire.js

@@ -2,4 +2,10 @@
 
 const { createCoreRouter } = require('@strapi/strapi').factories;
 
-module.exports = createCoreRouter('api::commentaire.commentaire')
+module.exports = createCoreRouter('api::commentaire.commentaire', {
+  config: {
+    create: {
+      policies: ['global::is-payload-owner']
+    }
+  }
+})