/users/me endpoint is missing many-to-many relation objects in the response

[raspi0124]

Bug report

Describe the bug

/users/me endpoint is returning a response missing many-to-many relation objects while /users/_id returns a expected response which includes many-to-many relation objects.

Steps to reproduce the behavior

1. Create many-to-many relation on Users model
2. Add some random entries and relate them to the user
3. Send API requests to /users/me and /users/_id using the user's jwt token

Expected behavior

/users/me and /users/_id returns exactly same value, both including many-to-many relation objects.

System

• Node.js version: v14.15.1
• NPM version: 7.5.2
• Strapi version: v3.5.4
• Database: Reproduced on both MySQL/SQLite
• Operating system: Reproduced on both Windows and Ubuntu

[kasonde]

Hi @raspi0124 this is the intended action, if you take a look here, you'll notice /me returns the ctx.state.user. This contains information relevant to identify users. If instead the user object from the model was returned in the request context, it could create the possibility of the size request context growing as the user data increases.

To extend the functionality of the user controller (and the /me controller function specifically), you can do the following:

1. Create a new folder inside your project/extensions/users-permissions/ called controllers
2. Create a new file in that folder called User.js
3. Copy the code at this link and paste it into the file you just created.
4. Edit this line to say:

const user = strapi.query("user", "users-permissions").findOne({id: ctx.state.user.id})

5. Save your file and you should have the fields you require.

More information about extended plugins can be found here.

[raspi0124]

Thank you for very reasonable explanation and detailed solution! That really made sense to me.

[derrickmehaffy]

This issue has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/help-getting-started-with-expanding-the-users/5000/4

[kalnode]

Consider if you really actually must extend the output of users/me.

What is your use case exactly?

In my app, I only needed extra user fields in a few key places (e.g. "My Profile" page). On such pages it's much better if I simply do a regular query for a full user object (e.g. api/users/<user id>) just like any other details page, and leave users/me untouched and avoid whatever performance implications there could be.

[DanielMuellner]

@TheMangoTrain correct me if i am wrong but opening the api/users/<user id> route with "find" or "findone" would enable every user to access any other user and poses potential security risks?

[alloyking1]

The page here is missing here is missing @kasonde. I have a similar problem and I am trying to fix it following your steps above but the page cant be found.

[DanielMuellner]

@alloyking1 what is your goal and what have you already tried? keep in mind these tipps here are for strapi v3 and v4 got released in dec 2021

[alloyking1]

First I have Strapi v4, In my app I have a user model with a one to many relationship to merchant model. I want to return all merchants belonging to a user. It returns only the user data without the relationship. I have tried using the users/me?populate=*, did not work. I also tried userd/id?populate=* same result. It returns the user without the relationships. I read about extending the users-permissions plugin, trying to implement that. Any help would be appreciated. @DanielMuellner

[DanielMuellner]

check you strapi version - there is 4.04 out already - get the latest to be sure you have the latest hotfixes. Additionally you could try to set your related merchant model permissions for "find" and "findone" for authenticated/public (as you wish) users to true.

[alloyking1]

I created a new controller and route where i queried the merchant table to return all merchants where users_permissions_user === user_id. This is a long process and possible not the best way to do this but it works. Regardless, Ill revisit the code again and try to implement it the right way. Thanks @DanielMuellner Ill check the permissions too.

[jumptrnr]

any luck here? /api/users/_id also doesn't return the relationship fields.