Strapi plugin upload-permission

A plugin for Strapi that provides the ability to secure the public route upload/(*)

🚀   Overview

this plugin gives the possibility to protect the file download route which is normally public.

Test : 4.25.1 => ok | 4.3.6 => ok (node18 | node16)

⏳   Installation

With npm:

npm install strapi-upload-permission

With yarn:

yarn add strapi-upload-permission

✨   Getting Started

// config/plugins.js
'upload-permission': {
    enabled: true,
    config: {
      "content-manager-visible": { // tab "Content Manager" @optionnal
        'file': true, // add the file collection
        'folder': true, // add the folder collection
      },
      "content-type-builder": { // tab "Content-Type Builder" @optionnal
        'file': true, // add the file collection
        'folder': true, // add the folder collection
      },
      "downloadCallback": async (ctx, next) => { 
        // callback from middleware on /upload/(*)
        // you have a full access like a normal middleware
        if (ctx.state.user) { // you have the user in ctx.state.user (if token)
          return await next(); // return this to accept the download
        }
        return ctx.unauthorized('You are not allowed to download this file'); // denied
      }
    }
  },

🐛   Bugs

If any bugs are found please report them as a Github Issue