Merge branch 'main' into patch-1

brunoocasali · web-flow · commit 2ab9478d5e2e · 2024-02-19T18:36:56.000-03:00
diff --git a/.github/workflows/beta-tests.yml b/.github/workflows/beta-tests.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           cache: yarn
           node-version: ${{ matrix.node }}
@@ -36,7 +36,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           cache: yarn
           node-version: ${{ matrix.node }}
@@ -50,7 +50,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           cache: yarn
           node-version: ${{ matrix.node }}
diff --git a/.github/workflows/pre-release-tests.yml b/.github/workflows/pre-release-tests.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           cache: yarn
           node-version: ${{ matrix.node }}
@@ -36,7 +36,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           cache: yarn
           node-version: ${{ matrix.node }}
@@ -50,7 +50,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           cache: yarn
           node-version: ${{ matrix.node }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 14
           registry-url: https://registry.npmjs.org/
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
       - name: Cache dependencies
@@ -45,7 +45,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
       - name: Cache dependencies
@@ -70,7 +70,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: '18.x'
       - name: Cache dependencies
diff --git a/LICENSE b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021-2022 Meili SAS
+Copyright (c) 2021-2024 Meili SAS
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/README.md b/README.md
@@ -28,13 +28,7 @@ Meilisearch is an open-source search engine. [Discover what Meilisearch is!](htt
 
 Add your Strapi content-types into a Meilisearch instance. The plugin listens to modifications made on your content-types and updates Meilisearch accordingly.
 
----
-
-### 🔥 On November 2nd, we are hosting our first-ever live demo and product updates for [Meilisearch Cloud](https://www.meilisearch.com/cloud?utm_campaign=oss&utm_source=github&utm_medium=meilisearch). Make sure to [register here](https://us06web.zoom.us/meeting/register/tZMlc-mqrjIsH912-HTRe-AaT-pp41bDe81a#/registration) and bring your questions for live Q&A!
-
----
-
-## Table of Contents <!-- omit in toc -->
+## Table of Contents <!-- omit in TOC -->
 
 - [📖 Documentation](#-documentation)
 - [⚡ Supercharge your Meilisearch experience](#-supercharge-your-meilisearch-experience)
@@ -217,6 +211,7 @@ Settings:
 - [🤚 Filter entries](#-filter-entries)
 - [🏗 Add Meilisearch settings](#-add-meilisearch-settings)
 - [🔎 Entries query](#-entries-query)
+- [🔐 Selectively index private fields](#-selectively-index-private-fields)
 
 ### 🏷 Custom index name
 
@@ -418,6 +413,27 @@ module.exports = {
 
 [See resources](./resources/entries-query) for more entriesQuery examples.
 
+### 🔐 Selectively index private fields
+
+Private fields are sanitized by default to prevent data leaks. However, you might want to allow some of these private fields to be used for `search`, `filter` or `sort`. This is possible with the `noSanitizePrivateFields`. For example, if you have a private field called `internal_notes` in your content-type schema that you wish to include in searching, you can add it to the `noSanitizePrivateFields` array to allow it to be indexed.
+
+```js
+// config/plugins.js
+
+module.exports = {
+  meilisearch: {
+    config: {
+      restaurant: {
+        noSanitizePrivateFields: ["internal_notes"], // All attributes: ["*"]
+        settings:  {
+          "searchableAttributes": ["internal_notes"],
+        }
+      },
+    },
+  },
+}
+```
+
 ### 🕵️‍♀️ Start Searching <!-- omit in toc -->
 
 Once you have a content-type indexed in Meilisearch, you can [start searching](https://www.meilisearch.com/docs/learn/getting_started/quick_start.html#search).
diff --git a/package.json b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "@strapi/utils": "^4.14.4",
     "@strapi/icons": "^1.12.2",
-    "@strapi/design-system": "^1.12.2",
+    "@strapi/design-system": "^1.13.2",
     "meilisearch": "^0.35.0"
   },
   "peerDependencies": {
diff --git a/playground/package.json b/playground/package.json
@@ -14,7 +14,7 @@
     "@strapi/plugin-users-permissions": "^4.14.4",
     "@strapi/strapi": "^4.14.4",
     "@strapi/utils": "^4.14.4",
-    "meilisearch": "^0.35.0",
+    "meilisearch": "^0.36.0",
     "sqlite3": "^5.1.4"
   },
   "author": {
diff --git a/playground/yarn.lock b/playground/yarn.lock
@@ -1847,9 +1847,9 @@
     typescript "5.2.2"
 
 "@strapi/ui-primitives@^1.12.0":
-  version "1.12.2"
-  resolved "https://registry.yarnpkg.com/@strapi/ui-primitives/-/ui-primitives-1.12.2.tgz#50e06514dd8b9e9cb8ef779a6cb63e4885098b32"
-  integrity sha512-yQCUp2N+SsXnW/lIldyll3OAdMSLGLLEUmDXmCL+6NnmjkXwPTVoxj+EZCXHal3NTDWKDjuLlS9C7Wc0oayefQ==
+  version "1.13.2"
+  resolved "https://registry.yarnpkg.com/@strapi/ui-primitives/-/ui-primitives-1.13.2.tgz#8e510bc56944d8bf93581fdc7934f77a76d17e3a"
+  integrity sha512-Koaun6riXoTOvvlKNgFy44BVUfLfchgpabRhrNH/KfmBQQlhLCqJDQu023FcFQDQQ4XFO3DpvzDk8pCbmva7oQ==
   dependencies:
     "@radix-ui/number" "^1.0.1"
     "@radix-ui/primitive" "^1.0.1"
@@ -1871,7 +1871,7 @@
     "@radix-ui/react-use-previous" "^1.0.1"
     "@radix-ui/react-visually-hidden" "^1.0.3"
     aria-hidden "^1.2.3"
-    react-remove-scroll "^2.5.6"
+    react-remove-scroll "^2.5.7"
 
 "@strapi/utils@4.14.4", "@strapi/utils@^4.14.4":
   version "4.14.4"
@@ -6395,10 +6395,10 @@ media-typer@0.3.0:
   resolved "https://registry.yarnpkg.com/media-typer/-/media-typer-0.3.0.tgz#8710d7af0aa626f8fffa1ce00168545263255748"
   integrity sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==
 
-meilisearch@^0.35.0:
-  version "0.35.0"
-  resolved "https://registry.yarnpkg.com/meilisearch/-/meilisearch-0.35.0.tgz#c94d5f266e39ad5ed5a666782e729805a4e8a956"
-  integrity sha512-gF1I6K5/Wpe7BWfjBnG+o19y/FIpJ9HbN+byON6CB9U3uE7qc6GvwUbjKOllh7LKXQVVxH/kCu7Jn0ODCUwqbQ==
+meilisearch@^0.36.0:
+  version "0.36.0"
+  resolved "https://registry.yarnpkg.com/meilisearch/-/meilisearch-0.36.0.tgz#b2d1f6b342aabc89557832638a6ce2a6a7c6bf64"
+  integrity sha512-swcvEYrct0/zsGj3jlbPm1OYxbH14IURnlysKlXywNicIQ5EMkSYLYCLCwOuBKAaGcdISWdgdylH9TXVLegmOQ==
   dependencies:
     cross-fetch "^3.1.6"
 
@@ -7709,7 +7709,7 @@ react-remove-scroll@2.5.5:
     use-callback-ref "^1.3.0"
     use-sidecar "^1.1.2"
 
-react-remove-scroll@^2.5.6:
+react-remove-scroll@^2.5.6, react-remove-scroll@^2.5.7:
   version "2.5.7"
   resolved "https://registry.yarnpkg.com/react-remove-scroll/-/react-remove-scroll-2.5.7.tgz#15a1fd038e8497f65a695bf26a4a57970cac1ccb"
   integrity sha512-FnrTWO4L7/Bhhf3CYBNArEG/yROV0tKmTv7/3h9QCFvH6sndeFf1wPqOcbFVu5VAulS5dV1wGT3GZZ/1GawqiA==
diff --git a/server/__tests__/configuration-validation.test.js b/server/__tests__/configuration-validation.test.js
@@ -245,6 +245,41 @@ describe('Test plugin configuration', () => {
     expect(strapiMock.log.error).toHaveBeenCalledTimes(0)
   })
 
+  test('Test noSanitizePrivateFields with wrong type', async () => {
+    validatePluginConfig({
+      restaurant: {
+        noSanitizePrivateFields: 0,
+      },
+    })
+    expect(strapiMock.log.warn).toHaveBeenCalledTimes(0)
+    expect(strapiMock.log.error).toHaveBeenCalledTimes(1)
+    expect(strapiMock.log.error).toHaveBeenCalledWith(
+      'The "noSanitizePrivateFields" option of "restaurant" should be an array of strings.'
+    )
+  })
+
+  test('Test noSanitizePrivateFields with array of strings', async () => {
+    const configuration = validatePluginConfig({
+      restaurant: {
+        noSanitizePrivateFields: ['test'],
+      },
+    })
+    expect(strapiMock.log.warn).toHaveBeenCalledTimes(0)
+    expect(strapiMock.log.error).toHaveBeenCalledTimes(0)
+    expect(configuration.restaurant.noSanitizePrivateFields).toEqual(['test'])
+  })
+
+  test('Test noSanitizePrivateFields with undefined', async () => {
+    validatePluginConfig({
+      restaurant: {
+        noSanitizePrivateFields: undefined,
+      },
+    })
+
+    expect(strapiMock.log.warn).toHaveBeenCalledTimes(0)
+    expect(strapiMock.log.error).toHaveBeenCalledTimes(0)
+  })
+
   test('Test configuration with random field ', async () => {
     validatePluginConfig({
       restaurant: {
diff --git a/server/__tests__/meilisearch.test.js b/server/__tests__/meilisearch.test.js
@@ -119,16 +119,26 @@ describe('Tests content types', () => {
     )
   })
 
-  test('sanitizes the private fields from the entries', async () => {
+  test('selectively sanitizes the private fields from the entries', async () => {
     const pluginMock = jest.fn(() => ({
       // This rewrites only the needed methods to reach the system under test (removeSensitiveFields)
       service: jest.fn().mockImplementation(() => {
         return {
           async actionInBatches({ contentType = 'restaurant', callback }) {
             await callback({
               entries: [
-                { id: 1, title: 'title', secret: '123' },
-                { id: 2, title: 'abc', secret: '234' },
+                {
+                  id: 1,
+                  title: 'title',
+                  internal_notes: 'note123',
+                  secret: '123',
+                },
+                {
+                  id: 2,
+                  title: 'abc',
+                  internal_notes: 'note234',
+                  secret: '234',
+                },
               ],
               contentType,
             })
@@ -149,11 +159,18 @@ describe('Tests content types', () => {
             attributes: {
               id: { private: false },
               title: { private: false },
+              internal_notes: { private: true },
               secret: { private: true },
             },
           },
         },
-        config: { get: jest.fn(() => ({ restaurant: jest.fn() })) },
+        config: {
+          get: jest.fn(() => ({
+            restaurant: {
+              noSanitizePrivateFields: ['internal_notes'],
+            },
+          })),
+        },
         log: mockLogger,
       },
     })
@@ -169,11 +186,13 @@ describe('Tests content types', () => {
           _meilisearch_id: 'restaurant-1',
           id: 1,
           title: 'title',
+          internal_notes: 'note123',
         },
         {
           _meilisearch_id: 'restaurant-2',
           id: 2,
           title: 'abc',
+          internal_notes: 'note234',
         },
       ],
       { primaryKey: '_meilisearch_id' }
diff --git a/server/configuration-validation.js b/server/configuration-validation.js
@@ -175,6 +175,7 @@ function CollectionConfig({ collectionName, configuration }) {
     filterEntry,
     settings,
     entriesQuery,
+    noSanitizePrivateFields,
     ...unknownFields
   } = configuration
   const options = {}
@@ -262,6 +263,21 @@ function CollectionConfig({ collectionName, configuration }) {
 
       return this
     },
+    validateNoSanitizePrivateFields() {
+      // noSanitizePrivateFields is either undefined or an array
+      if (
+        noSanitizePrivateFields !== undefined &&
+        !Array.isArray(noSanitizePrivateFields)
+      ) {
+        log.error(
+          `The "noSanitizePrivateFields" option of "${collectionName}" should be an array of strings.`
+        )
+      } else if (noSanitizePrivateFields !== undefined) {
+        options.noSanitizePrivateFields = noSanitizePrivateFields
+      }
+
+      return this
+    },
 
     validateNoInvalidKeys() {
       // Keys that should not be present in the configuration
@@ -323,8 +339,9 @@ function PluginConfig({ configuration }) {
             .validateFilterEntry()
             .validateTransformEntry()
             .validateMeilisearchSettings()
-            .validateNoInvalidKeys()
             .validateEntriesQuery()
+            .validateNoSanitizePrivateFields()
+            .validateNoInvalidKeys()
             .get()
         }
       }
diff --git a/server/services/meilisearch/config.js b/server/services/meilisearch/config.js
@@ -189,10 +189,22 @@ module.exports = ({ strapi }) => {
      * @return {Array<Object>} - Entries
      */
     removeSensitiveFields: function ({ contentType, entries }) {
+      const collection = contentTypeService.getCollectionName({ contentType })
+      const contentTypeConfig = meilisearchConfig[collection] || {}
+
+      const noSanitizePrivateFields =
+        contentTypeConfig.noSanitizePrivateFields || []
+
+      if (noSanitizePrivateFields.includes('*')) {
+        return entries
+      }
+
       // TODO: should be persisted somewhere to make it more performant
       const attrs = strapi.contentTypes[contentType].attributes
       const privateFields = Object.entries(attrs).map(([field, schema]) =>
-        schema.private ? field : false
+        schema.private && !noSanitizePrivateFields.includes(field)
+          ? field
+          : false
       )
 
       return entries.map(entry => {
diff --git a/yarn.lock b/yarn.lock
