strapi get related objects of User

Question

I'm using strapi community edition v3.6.8. I have two different models ,User and CarModel. The User Model is strapi's integrated user model. The relation User: CarModel is 1:n

So I've got a profile page in which I want to fetch the User and their related CarModels. I can't get my head around how to achieve this. I've read several answers that include creating a service which then fetches the related CarModelobjects but I can't figure out what to put into the service.

So the conclusion I've reached so far is that it is probably best if I just create a custom endpoint which fetches the current user and related objects.

How do I go on about this? This is the code I currently have:

axios.get(`http://localhost:1337/users/currentUser`, {
      headers: {
        Authorization: `Bearer ${token}`
      }
    })

In extensions/users-permissions/config I've created a routes.json with this content:

  "method": "GET",
  "path": "/users/currentUser",
  "handler": "User.currentUser",
  "config": {
    "policies": ["policies.isAuthenticated"]
  }
}

in config/policies I've created a is-authenticated.js - File with the following content:

module.exports = async (ctx, next) => {
  if (ctx.state.user) {
    return await next();
  }

  ctx.unauthorized(`You're not logged in!`);
};

And lastly in extensions/users-permissions/controllers I've created a User.js file with the following content:

const { sanitizeEntity } = require('strapi-utils');
const sanitizeUser = user =>
  sanitizeEntity(user, {
    model: strapi.query('user', 'users-permissions').model,
  });

module.exports = {
  currentUser: async (ctx, next) => {
    strapi.query('user').find({id: ctx.id}, ['car-model']);
    await next();
  }
};

So now my questions would be:

1st: Something is wrong because when trying to GET /users/currentUser I get a 403. What exactly am I doing wrong?

2nd: Is this approach even valid in the first place?

And 3rd: What would be the correct approach to solving this problem? Because somewhere else I've read another approach which included writing a custom service which handles resolving the relation, but this looked very complicated imho, considering I'm simply trying to resolve a relation that already exists in the database.

I've also tried manipulating the users/me endpoint which didn't yield any results (and is probably also discouraged).

Interestingly: when the user logs in, I get the user object and all foreign key relations returned. Only when I query /users/me I get only the user data without relations. So I've read that this is a security feature, but what endpoint is used then, when posting to /auth/local and why does this endpoint return the user and related objects? Could I use this endpoint instead of /users/me?

Any help to this problem would be greatly appreciated, best regards,

deM

user_6516720 · Answer

So for anyone else looking for a solution, I figured it out. I added a custom route to currentUser as described above then I added a controller for this route in which I put the following code:

currentUser: async (ctx, next) => {
    let carModelsOfUser = await (strapi.query('user', 'users-permissions').findOne({id: ctx.state.user.id}, ['carModels', 'carModels.images', 'carModels.ratings.rating']));
    return carModelsOfUser;
  }

CAUTION! This also returns the user's hashed password and other potentially sensitive information. Strapi offers the sanitizeEntity function to remove sensitive information, but as of now I haven't figured out how to use this in that context, as I'm not using the "raw" user here but instead joining some fields.

strapi get related objects of User

1 Answers