@directus/api 19.1.0 → 19.1.1

package/dist/database/helpers/fn/types.js

@@ -14,13 +14,21 @@ export class FnHelper extends DatabaseHelper {
         if (!relation) {
             throw new Error(`Field ${collectionName}.${column} isn't a nested relational collection`);
         }
+        // generate a unique alias for the relation collection, to prevent collisions in self referencing relations
         const alias = generateAlias();
         let countQuery = this.knex
             .count('*')
             .from({ [alias]: relation.collection })
             .where(this.knex.raw(`??.??`, [alias, relation.field]), '=', this.knex.raw(`??.??`, [table, currentPrimary]));
         if (options?.query?.filter) {
-            countQuery = applyFilter(this.knex, this.schema, countQuery, options.query.filter, relation.collection, {}).query;
+            // set the newly aliased collection in the alias map as the default parent collection, indicated by '', for any nested filters
+            const aliasMap = {
+                '': {
+                    alias,
+                    collection: relation.collection,
+                },
+            };
+            countQuery = applyFilter(this.knex, this.schema, countQuery, options.query.filter, relation.collection, aliasMap).query;
         }
         return this.knex.raw('(' + countQuery.toQuery() + ')');
     }

package/dist/database/migrations/20240515A-add-session-window.d.ts

@@ -0,0 +1,3 @@
+import type { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20240515A-add-session-window.js

@@ -0,0 +1,10 @@
+export async function up(knex) {
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.string('next_token', 64).nullable();
+    });
+}
+export async function down(knex) {
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.dropColumn('next_token');
+    });
+}

package/dist/middleware/authenticate.d.ts

@@ -4,6 +4,6 @@ import type { NextFunction, Request, Response } from 'express';
 /**
  * Verify the passed JWT and assign the user ID and role to `req`
  */
-export declare const handler: (req: Request, _res: Response, next: NextFunction) => Promise<void>;
+export declare const handler: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 declare const _default: (req: Request<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
 export default _default;

package/dist/middleware/authenticate.js

@@ -4,10 +4,14 @@ import emitter from '../emitter.js';
 import asyncHandler from '../utils/async-handler.js';
 import { getAccountabilityForToken } from '../utils/get-accountability-for-token.js';
 import { getIPFromReq } from '../utils/get-ip-from-req.js';
+import { ErrorCode, isDirectusError } from '@directus/errors';
+import { useEnv } from '@directus/env';
+import { SESSION_COOKIE_OPTIONS } from '../constants.js';
 /**
  * Verify the passed JWT and assign the user ID and role to `req`
  */
-export const handler = async (req, _res, next) => {
+export const handler = async (req, res, next) => {
+    const env = useEnv();
     const defaultAccountability = {
         user: null,
         role: null,
@@ -33,7 +37,18 @@ export const handler = async (req, _res, next) => {
         req.accountability = customAccountability;
         return next();
     }
-    req.accountability = await getAccountabilityForToken(req.token, defaultAccountability);
+    try {
+        req.accountability = await getAccountabilityForToken(req.token, defaultAccountability);
+    }
+    catch (err) {
+        if (isDirectusError(err, ErrorCode.InvalidCredentials) || isDirectusError(err, ErrorCode.InvalidToken)) {
+            if (req.cookies[env['SESSION_COOKIE_NAME']] === req.token) {
+                // clear the session token if ended up in an invalid state
+                res.clearCookie(env['SESSION_COOKIE_NAME'], SESSION_COOKIE_OPTIONS);
+            }
+        }
+        throw err;
+    }
     return next();
 };
 export default asyncHandler(handler);

package/dist/services/authentication.d.ts

@@ -21,6 +21,7 @@ export declare class AuthenticationService {
     refresh(refreshToken: string, options?: Partial<{
         session: boolean;
     }>): Promise<LoginResult>;
+    private updateStatefulSession;
     logout(refreshToken: string): Promise<void>;
     verifyPassword(userID: string, password: string): Promise<void>;
 }

package/dist/services/authentication.js

@@ -207,6 +207,7 @@ export class AuthenticationService {
         const record = await this.knex
             .select({
             session_expires: 's.expires',
+            session_next_token: 's.next_token',
             user_id: 'u.id',
             user_first_name: 'u.first_name',
             user_last_name: 'u.last_name',
@@ -274,8 +275,9 @@ export class AuthenticationService {
                 admin_access: record.role_admin_access,
             });
         }
-        const newRefreshToken = nanoid(64);
-        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
+        let newRefreshToken = record.session_next_token ?? nanoid(64);
+        const sessionDuration = env[options?.session ? 'SESSION_COOKIE_TTL' : 'REFRESH_TOKEN_TTL'];
+        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(sessionDuration, 0));
         const tokenPayload = {
             id: record.user_id,
             role: record.role_id,
@@ -283,8 +285,18 @@ export class AuthenticationService {
             admin_access: record.role_admin_access,
         };
         if (options?.session) {
+            newRefreshToken = await this.updateStatefulSession(record, refreshToken, newRefreshToken, refreshTokenExpiration);
             tokenPayload.session = newRefreshToken;
         }
+        else {
+            // Original stateless token behavior
+            await this.knex('directus_sessions')
+                .update({
+                token: newRefreshToken,
+                expires: refreshTokenExpiration,
+            })
+                .where({ token: refreshToken });
+        }
         if (record.share_id) {
             tokenPayload.share = record.share_id;
             tokenPayload.role = record.share_role;
@@ -311,15 +323,14 @@ export class AuthenticationService {
             expiresIn: TTL,
             issuer: 'directus',
         });
-        await this.knex('directus_sessions')
-            .update({
-            token: newRefreshToken,
-            expires: refreshTokenExpiration,
-        })
-            .where({ token: refreshToken });
         if (record.user_id) {
             await this.knex('directus_users').update({ last_access: new Date() }).where({ id: record.user_id });
         }
+        // Clear expired sessions for the current user
+        await this.knex('directus_sessions')
+            .delete()
+            .where('user', '=', record.user_id)
+            .andWhere('expires', '<', new Date());
         return {
             accessToken,
             refreshToken: newRefreshToken,
@@ -327,6 +338,47 @@ export class AuthenticationService {
             id: record.user_id,
         };
     }
+    async updateStatefulSession(sessionRecord, oldSessionToken, newSessionToken, sessionExpiration) {
+        if (sessionRecord['session_next_token']) {
+            // The current session token was already refreshed and has a reference
+            // to the new session, update the new session timeout for the new refresh
+            await this.knex('directus_sessions')
+                .update({
+                expires: sessionExpiration,
+            })
+                .where({ token: newSessionToken });
+            return newSessionToken;
+        }
+        // Keep the old session active for a short period of time
+        const GRACE_PERIOD = getMilliseconds(env['SESSION_REFRESH_GRACE_PERIOD'], 10_000);
+        // Update the existing session record to have a short safety timeout
+        // before expiring, and add the reference to the new session token
+        const updatedSession = await this.knex('directus_sessions')
+            .update({
+            next_token: newSessionToken,
+            expires: new Date(Date.now() + GRACE_PERIOD),
+        }, ['next_token'])
+            .where({ token: oldSessionToken, next_token: null });
+        if (updatedSession.length === 0) {
+            // Don't create a new session record, we already have a "next_token" reference
+            const { next_token } = await this.knex('directus_sessions')
+                .select('next_token')
+                .where({ token: oldSessionToken })
+                .first();
+            return next_token;
+        }
+        // Instead of updating the current session record with a new token,
+        // create a new copy with the new token
+        await this.knex('directus_sessions').insert({
+            token: newSessionToken,
+            user: sessionRecord['user_id'],
+            expires: sessionExpiration,
+            ip: this.accountability?.ip,
+            user_agent: this.accountability?.userAgent,
+            origin: this.accountability?.origin,
+        });
+        return newSessionToken;
+    }
     async logout(refreshToken) {
         const record = await this.knex
             .select('u.id', 'u.first_name', 'u.last_name', 'u.email', 'u.password', 'u.status', 'u.role', 'u.provider', 'u.external_identifier', 'u.auth_data')

package/dist/utils/apply-query.js

@@ -347,7 +347,8 @@ export function applyFilter(knex, schema, rootQuery, rootFilter, collection, ali
             else {
                 const { type, special } = getFilterType(schema.collections[collection].fields, filterPath[0], collection);
                 validateFilterOperator(type, filterOperator, special);
-                applyFilterToQuery(`${collection}.${filterPath[0]}`, filterOperator, filterValue, logical);
+                const aliasedCollection = aliasMap['']?.alias || collection;
+                applyFilterToQuery(`${aliasedCollection}.${filterPath[0]}`, filterOperator, filterValue, logical, collection);
             }
         }
         function getFilterType(fields, key, collection = 'unknown') {
@@ -422,7 +423,7 @@ export function applyFilter(knex, schema, rootQuery, rootFilter, collection, ali
                 const functionName = column.split('(')[0];
                 const type = getOutputTypeForFunction(functionName);
                 if (['integer', 'float', 'decimal'].includes(type)) {
-                    compareValue = Number(compareValue);
+                    compareValue = Array.isArray(compareValue) ? compareValue.map(Number) : Number(compareValue);
                 }
             }
             // Cast filter value (compareValue) based on type of field being filtered against
@@ -520,19 +521,19 @@ export function applyFilter(knex, schema, rootQuery, rootFilter, collection, ali
                 dbQuery[logical].whereNotIn(selectionRaw, value);
             }
             if (operator === '_between') {
-                if (compareValue.length !== 2)
-                    return;
                 let value = compareValue;
                 if (typeof value === 'string')
                     value = value.split(',');
+                if (value.length !== 2)
+                    return;
                 dbQuery[logical].whereBetween(selectionRaw, value);
             }
             if (operator === '_nbetween') {
-                if (compareValue.length !== 2)
-                    return;
                 let value = compareValue;
                 if (typeof value === 'string')
                     value = value.split(',');
+                if (value.length !== 2)
+                    return;
                 dbQuery[logical].whereNotBetween(selectionRaw, value);
             }
             if (operator == '_intersects') {

package/dist/utils/verify-session-jwt.js

@@ -1,5 +1,5 @@
 import getDatabase from '../database/index.js';
-import { InvalidTokenError } from '@directus/errors';
+import { InvalidCredentialsError } from '@directus/errors';
 /**
  * Verifies the associated session is still available and valid.
  *
@@ -17,6 +17,6 @@ export async function verifySessionJWT(payload) {
         .andWhere('expires', '>=', new Date())
         .first();
     if (!session) {
-        throw new InvalidTokenError();
+        throw new InvalidCredentialsError();
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "19.1.0",
+  "version": "19.1.1",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "keywords": [
     "directus",
@@ -140,35 +140,35 @@
     "sharp": "0.33.3",
     "snappy": "7.2.2",
     "stream-json": "1.8.0",
-    "tar": "7.0.1",
+    "tar": "7.1.0",
     "tsx": "4.9.3",
     "wellknown": "0.5.0",
     "ws": "8.17.0",
-    "zod": "3.23.6",
+    "zod": "3.23.8",
     "zod-validation-error": "3.2.0",
-    "@directus/app": "12.1.0",
-    "@directus/env": "1.1.3",
-    "@directus/errors": "0.3.0",
-    "@directus/extensions": "1.0.4",
     "@directus/constants": "11.0.4",
-    "@directus/extensions-registry": "1.0.4",
-    "@directus/extensions-sdk": "11.0.4",
+    "@directus/app": "12.1.1",
+    "@directus/extensions": "1.0.5",
+    "@directus/env": "1.1.4",
+    "@directus/extensions-registry": "1.0.5",
+    "@directus/errors": "0.3.0",
     "@directus/format-title": "10.1.2",
+    "@directus/extensions-sdk": "11.0.5",
     "@directus/memory": "1.0.7",
     "@directus/pressure": "1.0.19",
-    "@directus/specs": "10.2.9",
     "@directus/schema": "11.0.2",
     "@directus/storage": "10.0.12",
     "@directus/storage-driver-azure": "10.0.20",
     "@directus/storage-driver-cloudinary": "10.0.20",
-    "@directus/storage-driver-gcs": "10.0.20",
+    "@directus/storage-driver-gcs": "10.0.21",
     "@directus/storage-driver-local": "10.0.19",
-    "@directus/storage-driver-supabase": "1.0.12",
+    "@directus/specs": "10.2.9",
     "@directus/storage-driver-s3": "10.0.21",
+    "@directus/storage-driver-supabase": "1.0.12",
     "@directus/system-data": "1.0.3",
     "@directus/utils": "11.0.8",
     "@directus/validation": "0.0.15",
-    "directus": "10.11.0"
+    "directus": "10.11.1"
   },
   "devDependencies": {
     "@ngneat/falso": "7.2.0",
@@ -193,7 +193,7 @@
     "@types/lodash-es": "4.17.12",
     "@types/mime-types": "2.1.4",
     "@types/ms": "0.7.34",
-    "@types/node": "18.19.31",
+    "@types/node": "18.19.33",
     "@types/node-schedule": "2.1.7",
     "@types/nodemailer": "6.4.15",
     "@types/object-hash": "3.0.6",