refactor: extraire la vérification JWT/payload en policy partagée

src/policies/__tests__/is-payload-owner.test.js

@@ -0,0 +1,68 @@
+import {describe, it, expect, vi} from 'vitest'
+
+const {default: isPayloadOwner} = await import('../is-payload-owner.js')
+
+function buildStrapi(jwtUserId) {
+  return {
+    plugins: {
+      'users-permissions': {
+        services: {
+          jwt: {
+            getToken: vi.fn(async () => ({id: jwtUserId}))
+          }
+        }
+      }
+    }
+  }
+}
+
+function buildPolicyContext({authorization, payloadUserId}) {
+  return {
+    request: {
+      header: authorization ? {authorization} : {},
+      body: {data: {user: {id: payloadUserId}}}
+    }
+  }
+}
+
+describe('is-payload-owner policy', () => {
+  it("autorise quand aucun en-tête d'autorisation n'est présent", async () => {
+    const strapi = buildStrapi(999)
+    const policyContext = buildPolicyContext({authorization: undefined, payloadUserId: 1})
+
+    await expect(isPayloadOwner(policyContext, {}, {strapi})).resolves.toBe(true)
+  })
+
+  it('autorise quand le user du JWT correspond au user du payload', async () => {
+    const strapi = buildStrapi(1)
+    const policyContext = buildPolicyContext({authorization: 'Bearer faketoken', payloadUserId: 1})
+
+    await expect(isPayloadOwner(policyContext, {}, {strapi})).resolves.toBe(true)
+  })
+
+  it('refuse quand le user du JWT ne correspond pas au user du payload', async () => {
+    const strapi = buildStrapi(999)
+    const policyContext = buildPolicyContext({authorization: 'Bearer faketoken', payloadUserId: 1})
+
+    await expect(isPayloadOwner(policyContext, {}, {strapi})).rejects.toThrow('Opération non autorisée')
+  })
+
+  it('refuse quand le token est invalide', async () => {
+    const strapi = {
+      plugins: {
+        'users-permissions': {
+          services: {
+            jwt: {
+              getToken: vi.fn(async () => {
+                throw new Error('Invalid token.')
+              })
+            }
+          }
+        }
+      }
+    }
+    const policyContext = buildPolicyContext({authorization: 'Bearer faketoken', payloadUserId: 1})
+
+    await expect(isPayloadOwner(policyContext, {}, {strapi})).rejects.toThrow('Opération non autorisée')
+  })
+})

src/policies/is-payload-owner.js

@@ -0,0 +1,23 @@
+'use strict';
+
+const { UnauthorizedError } = require('@strapi/utils').errors
+
+module.exports = async (policyContext, config, {strapi}) => {
+  const {request} = policyContext
+
+  if (!request?.header?.authorization) {
+    return true
+  }
+
+  try {
+    const {id} = await strapi.plugins['users-permissions'].services.jwt.getToken(policyContext)
+
+    if (id !== request.body?.data?.user?.id) {
+      throw new UnauthorizedError('Opération non autorisée')
+    }
+  } catch (err) {
+    throw new UnauthorizedError('Opération non autorisée')
+  }
+
+  return true
+}