@directus/api 19.1.1 → 19.2.0

package/dist/controllers/users.js

@@ -358,6 +358,7 @@ router.post('/:pk/tfa/disable', asyncHandler(async (req, _res, next) => {
 const registerSchema = Joi.object({
     email: Joi.string().email().required(),
     password: Joi.string().required(),
+    verification_url: Joi.string().uri(),
     first_name: Joi.string(),
     last_name: Joi.string(),
 });

package/dist/controllers/utils.js

@@ -12,13 +12,15 @@ import asyncHandler from '../utils/async-handler.js';
 import { generateHash } from '../utils/generate-hash.js';
 import { sanitizeQuery } from '../utils/sanitize-query.js';
 const router = Router();
+const randomStringSchema = Joi.object({
+    length: Joi.number().integer().min(1).max(500).default(32),
+});
 router.get('/random/string', asyncHandler(async (req, res) => {
     const { nanoid } = await import('nanoid');
-    if (req.query && req.query['length'] && Number(req.query['length']) > 500) {
-        throw new InvalidQueryError({ reason: `"length" can't be more than 500 characters` });
-    }
-    const string = nanoid(req.query?.['length'] ? Number(req.query['length']) : 32);
-    return res.json({ data: string });
+    const { error, value } = randomStringSchema.validate(req.query, { allowUnknown: true });
+    if (error)
+        throw new InvalidQueryError({ reason: error.message });
+    return res.json({ data: nanoid(value.length) });
 }));
 router.post('/hash/generate', asyncHandler(async (req, res) => {
     if (!req.body?.string) {

package/dist/services/extensions.js

@@ -188,16 +188,19 @@ export class ExtensionsService {
      *    - Entry status change resulted in all children being disabled then the parent bundle is disabled
      *    - Entry status change resulted in at least one child being enabled then the parent bundle is enabled
      */
-    async checkBundleAndSyncStatus(trx, bundleId, extension) {
+    async checkBundleAndSyncStatus(trx, extensionId, extension) {
         if (extension.bundle === null && extension.schema?.type === 'bundle') {
             // If extension is the parent bundle, set it and all nested extensions to enabled
             await trx('directus_extensions')
                 .update({ enabled: extension.meta.enabled })
-                .where({ bundle: bundleId })
-                .orWhere({ id: bundleId });
+                .where({ bundle: extensionId })
+                .orWhere({ id: extensionId });
             return;
         }
-        const parent = await this.readOne(bundleId);
+        const parentId = extension.bundle ?? extension.meta.bundle;
+        if (!parentId)
+            return;
+        const parent = await this.readOne(parentId);
         if (parent.schema?.type !== 'bundle') {
             return;
         }
@@ -207,14 +210,14 @@ export class ExtensionsService {
             });
         }
         const hasEnabledChildren = !!(await trx('directus_extensions')
-            .where({ bundle: bundleId })
+            .where({ bundle: parentId })
             .where({ enabled: true })
             .first());
         if (hasEnabledChildren) {
-            await trx('directus_extensions').update({ enabled: true }).where({ id: bundleId });
+            await trx('directus_extensions').update({ enabled: true }).where({ id: parentId });
         }
         else {
-            await trx('directus_extensions').update({ enabled: false }).where({ id: bundleId });
+            await trx('directus_extensions').update({ enabled: false }).where({ id: parentId });
         }
     }
 }

package/dist/services/graphql/index.js

@@ -47,6 +47,7 @@ import { GraphQLStringOrFloat } from './types/string-or-float.js';
 import { GraphQLVoid } from './types/void.js';
 import { addPathToValidationError } from './utils/add-path-to-validation-error.js';
 import processError from './utils/process-error.js';
+import { sanitizeGraphqlSchema } from './utils/sanitize-gql-schema.js';
 const env = useEnv();
 const validationRules = Array.from(specifiedRules);
 if (env['GRAPHQL_INTROSPECTION'] === false) {
@@ -115,19 +116,20 @@ export class GraphQLService {
         // eslint-disable-next-line @typescript-eslint/no-this-alias
         const self = this;
         const schemaComposer = new SchemaComposer();
+        const sanitizedSchema = sanitizeGraphqlSchema(this.schema);
         const schema = {
             read: this.accountability?.admin === true
-                ? this.schema
-                : reduceSchema(this.schema, this.accountability?.permissions || null, ['read']),
+                ? sanitizedSchema
+                : reduceSchema(sanitizedSchema, this.accountability?.permissions || null, ['read']),
             create: this.accountability?.admin === true
-                ? this.schema
-                : reduceSchema(this.schema, this.accountability?.permissions || null, ['create']),
+                ? sanitizedSchema
+                : reduceSchema(sanitizedSchema, this.accountability?.permissions || null, ['create']),
             update: this.accountability?.admin === true
-                ? this.schema
-                : reduceSchema(this.schema, this.accountability?.permissions || null, ['update']),
+                ? sanitizedSchema
+                : reduceSchema(sanitizedSchema, this.accountability?.permissions || null, ['update']),
             delete: this.accountability?.admin === true
-                ? this.schema
-                : reduceSchema(this.schema, this.accountability?.permissions || null, ['delete']),
+                ? sanitizedSchema
+                : reduceSchema(sanitizedSchema, this.accountability?.permissions || null, ['delete']),
         };
         const subscriptionEventType = schemaComposer.createEnumTC({
             name: 'EventEnum',
@@ -2074,10 +2076,10 @@ export class GraphQLService {
                 },
                 resolve: async (_, args) => {
                     const { nanoid } = await import('nanoid');
-                    if (args['length'] && Number(args['length']) > 500) {
-                        throw new InvalidPayloadError({ reason: `"length" can't be more than 500 characters` });
+                    if (args['length'] !== undefined && (args['length'] < 1 || args['length'] > 500)) {
+                        throw new InvalidPayloadError({ reason: `"length" must be between 1 and 500` });
                     }
-                    return nanoid(args['length'] ? Number(args['length']) : 32);
+                    return nanoid(args['length'] ? args['length'] : 32);
                 },
             },
             utils_hash_generate: {
@@ -2162,6 +2164,7 @@ export class GraphQLService {
                 args: {
                     email: new GraphQLNonNull(GraphQLString),
                     password: new GraphQLNonNull(GraphQLString),
+                    verification_url: GraphQLString,
                     first_name: GraphQLString,
                     last_name: GraphQLString,
                 },
@@ -2174,6 +2177,7 @@ export class GraphQLService {
                     await service.registerUser({
                         email: args.email,
                         password: args.password,
+                        verification_url: args.verification_url,
                         first_name: args.first_name,
                         last_name: args.last_name,
                     });

package/dist/services/graphql/utils/sanitize-gql-schema.d.ts

@@ -0,0 +1,8 @@
+import type { SchemaOverview } from '@directus/types';
+/**
+ * Filters out invalid collections to prevent graphql from errorring on schema generation
+ *
+ * @param schema
+ * @returns sanitized schema
+ */
+export declare function sanitizeGraphqlSchema(schema: SchemaOverview): SchemaOverview;

package/dist/services/graphql/utils/sanitize-gql-schema.js

@@ -0,0 +1,80 @@
+import { useLogger } from '../../../logger.js';
+/**
+ * Regex was taken from the spec
+ * https://spec.graphql.org/June2018/#sec-Names
+ */
+const GRAPHQL_NAME_REGEX = /^[_A-Za-z][_0-9A-Za-z]*$/;
+/**
+ * Manually curated list of GraphQL reserved names to cover the most likely naming footguns.
+ * This list is not exhaustive and does not cover generated type names.
+ */
+const GRAPHQL_RESERVED_NAMES = [
+    'Subscription',
+    'Query',
+    'Mutation',
+    'Int',
+    'Float',
+    'String',
+    'Boolean',
+    'DateTime',
+    'ID',
+    'uid',
+    'Point',
+    'PointList',
+    'Polygon',
+    'MultiPolygon',
+    'JSON',
+    'Hash',
+    'Date',
+    'Void',
+];
+/**
+ * Filters out invalid collections to prevent graphql from errorring on schema generation
+ *
+ * @param schema
+ * @returns sanitized schema
+ */
+export function sanitizeGraphqlSchema(schema) {
+    const logger = useLogger();
+    const collections = Object.entries(schema.collections).filter(([collectionName, _data]) => {
+        // double underscore __ is reserved for GraphQL introspection
+        if (collectionName.startsWith('__') || !collectionName.match(GRAPHQL_NAME_REGEX)) {
+            logger.warn(`GraphQL skipping collection "${collectionName}" because it is not a valid name matching /^[_A-Za-z][_0-9A-Za-z]*$/ or starts with __`);
+            return false;
+        }
+        if (GRAPHQL_RESERVED_NAMES.includes(collectionName)) {
+            logger.warn(`GraphQL skipping collection "${collectionName}" because it is a reserved keyword`);
+            return false;
+        }
+        return true;
+    });
+    schema.collections = Object.fromEntries(collections);
+    const collectionExists = (collection) => Boolean(schema.collections[collection]);
+    const skipRelation = (relation) => {
+        const relationName = relation.schema?.constraint_name ?? `${relation.collection}.${relation.field}`;
+        logger.warn(`GraphQL skipping relation "${relationName}" because it links to a non-existent or invalid collection.`);
+        return false;
+    };
+    schema.relations = schema.relations.filter((relation) => {
+        if (relation.collection && !collectionExists(relation.collection)) {
+            return skipRelation(relation);
+        }
+        if (relation.related_collection && !collectionExists(relation.related_collection)) {
+            return skipRelation(relation);
+        }
+        if (relation.meta) {
+            if (relation.meta.many_collection && !collectionExists(relation.meta.many_collection)) {
+                return skipRelation(relation);
+            }
+            if (relation.meta.one_collection && !collectionExists(relation.meta.one_collection)) {
+                return skipRelation(relation);
+            }
+            if (relation.meta.one_allowed_collections &&
+                relation.meta.one_allowed_collections.some((allowed_collection) => !collectionExists(allowed_collection))) {
+                return skipRelation(relation);
+            }
+        }
+        return true;
+    });
+    return schema;
+}

package/dist/services/users.d.ts

@@ -23,7 +23,7 @@ export declare class UsersService extends ItemsService {
      */
     private getUserByEmail;
     /**
-     * Create url for inviting users
+     * Create URL for inviting users
      */
     private inviteUrl;
     /**

package/dist/services/users.js

@@ -126,14 +126,14 @@ export class UsersService extends ItemsService {
             .first();
     }
     /**
-     * Create url for inviting users
+     * Create URL for inviting users
      */
     inviteUrl(email, url) {
         const payload = { email, scope: 'invite' };
         const token = jwt.sign(payload, getSecret(), { expiresIn: '7d', issuer: 'directus' });
-        const inviteURL = url ? new Url(url) : new Url(env['PUBLIC_URL']).addPath('admin', 'accept-invite');
-        inviteURL.setQuery('token', token);
-        return inviteURL.toString();
+        return (url ? new Url(url) : new Url(env['PUBLIC_URL']).addPath('admin', 'accept-invite'))
+            .setQuery('token', token)
+            .toString();
     }
     /**
      * Validate array of emails. Intended to be used with create/update users
@@ -314,7 +314,7 @@ export class UsersService extends ItemsService {
         const opts = {};
         try {
             if (url && isUrlAllowed(url, env['USER_INVITE_URL_ALLOW_LIST']) === false) {
-                throw new InvalidPayloadError({ reason: `Url "${url}" can't be used to invite users` });
+                throw new InvalidPayloadError({ reason: `URL "${url}" can't be used to invite users` });
             }
         }
         catch (err) {
@@ -373,6 +373,12 @@ export class UsersService extends ItemsService {
         await service.updateOne(user.id, { password, status: 'active' });
     }
     async registerUser(input) {
+        if (input.verification_url &&
+            isUrlAllowed(input.verification_url, env['USER_REGISTER_URL_ALLOW_LIST']) === false) {
+            throw new InvalidPayloadError({
+                reason: `URL "${input.verification_url}" can't be used to verify registered users`,
+            });
+        }
         const STALL_TIME = env['REGISTER_STALL_TIME'];
         const timeStart = performance.now();
         const serviceOptions = { accountability: this.accountability, schema: this.schema };
@@ -424,9 +430,11 @@ export class UsersService extends ItemsService {
                 expiresIn: env['EMAIL_VERIFICATION_TOKEN_TTL'],
                 issuer: 'directus',
             });
-            const verificationURL = new Url(env['PUBLIC_URL'])
-                .addPath('users', 'register', 'verify-email')
-                .setQuery('token', token);
+            const verificationUrl = (input.verification_url
+                ? new Url(input.verification_url)
+                : new Url(env['PUBLIC_URL']).addPath('users', 'register', 'verify-email'))
+                .setQuery('token', token)
+                .toString();
             mailService
                 .send({
                 to: input.email,
@@ -434,7 +442,7 @@ export class UsersService extends ItemsService {
                 template: {
                     name: 'user-registration',
                     data: {
-                        url: verificationURL.toString(),
+                        url: verificationUrl,
                         email: input.email,
                         first_name,
                         last_name,
@@ -467,7 +475,7 @@ export class UsersService extends ItemsService {
             throw new ForbiddenError();
         }
         if (url && isUrlAllowed(url, env['PASSWORD_RESET_URL_ALLOW_LIST']) === false) {
-            throw new InvalidPayloadError({ reason: `Url "${url}" can't be used to reset passwords` });
+            throw new InvalidPayloadError({ reason: `URL "${url}" can't be used to reset passwords` });
         }
         const mailService = new MailService({
             schema: this.schema,
@@ -476,9 +484,9 @@ export class UsersService extends ItemsService {
         });
         const payload = { email: user.email, scope: 'password-reset', hash: getSimpleHash('' + user.password) };
         const token = jwt.sign(payload, getSecret(), { expiresIn: '1d', issuer: 'directus' });
-        const acceptURL = url
-            ? new Url(url).setQuery('token', token).toString()
-            : new Url(env['PUBLIC_URL']).addPath('admin', 'reset-password').setQuery('token', token).toString();
+        const acceptUrl = (url ? new Url(url) : new Url(env['PUBLIC_URL']).addPath('admin', 'reset-password'))
+            .setQuery('token', token)
+            .toString();
         const subjectLine = subject ? subject : 'Password Reset Request';
         mailService
             .send({
@@ -487,7 +495,7 @@ export class UsersService extends ItemsService {
             template: {
                 name: 'password-reset',
                 data: {
-                    url: acceptURL,
+                    url: acceptUrl,
                     email: user.email,
                 },
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "19.1.1",
+  "version": "19.2.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "keywords": [
     "directus",
@@ -67,7 +67,7 @@
     "@types/cookie": "0.6.0",
     "argon2": "0.40.1",
     "async": "3.2.5",
-    "axios": "1.6.8",
+    "axios": "1.7.2",
     "busboy": "1.6.0",
     "bytes": "3.1.2",
     "camelcase": "8.0.0",
@@ -92,11 +92,11 @@
     "fs-extra": "11.2.0",
     "glob-to-regexp": "0.4.1",
     "graphql": "16.8.1",
-    "graphql-compose": "9.0.10",
+    "graphql-compose": "9.0.11",
     "graphql-ws": "5.16.0",
     "helmet": "7.1.0",
     "icc": "3.0.0",
-    "inquirer": "9.2.20",
+    "inquirer": "9.2.22",
     "ioredis": "5.4.1",
     "ip-matching": "2.1.2",
     "isolated-vm": "4.7.2",
@@ -146,29 +146,29 @@
     "ws": "8.17.0",
     "zod": "3.23.8",
     "zod-validation-error": "3.2.0",
+    "@directus/app": "12.1.2",
     "@directus/constants": "11.0.4",
-    "@directus/app": "12.1.1",
-    "@directus/extensions": "1.0.5",
-    "@directus/env": "1.1.4",
-    "@directus/extensions-registry": "1.0.5",
-    "@directus/errors": "0.3.0",
-    "@directus/format-title": "10.1.2",
-    "@directus/extensions-sdk": "11.0.5",
-    "@directus/memory": "1.0.7",
+    "@directus/env": "1.1.5",
+    "@directus/errors": "0.3.1",
+    "@directus/extensions": "1.0.6",
+    "@directus/extensions-registry": "1.0.6",
+    "@directus/extensions-sdk": "11.0.6",
+    "@directus/memory": "1.0.8",
     "@directus/pressure": "1.0.19",
     "@directus/schema": "11.0.2",
-    "@directus/storage": "10.0.12",
-    "@directus/storage-driver-azure": "10.0.20",
-    "@directus/storage-driver-cloudinary": "10.0.20",
-    "@directus/storage-driver-gcs": "10.0.21",
-    "@directus/storage-driver-local": "10.0.19",
     "@directus/specs": "10.2.9",
-    "@directus/storage-driver-s3": "10.0.21",
-    "@directus/storage-driver-supabase": "1.0.12",
+    "@directus/format-title": "10.1.2",
+    "@directus/storage": "10.0.13",
+    "@directus/storage-driver-cloudinary": "10.0.21",
+    "@directus/storage-driver-azure": "10.0.21",
+    "@directus/storage-driver-gcs": "10.0.22",
+    "@directus/storage-driver-local": "10.0.20",
+    "@directus/storage-driver-supabase": "1.0.13",
     "@directus/system-data": "1.0.3",
+    "@directus/storage-driver-s3": "10.0.22",
     "@directus/utils": "11.0.8",
-    "@directus/validation": "0.0.15",
-    "directus": "10.11.1"
+    "directus": "10.11.2",
+    "@directus/validation": "0.0.16"
   },
   "devDependencies": {
     "@ngneat/falso": "7.2.0",
@@ -210,8 +210,8 @@
     "typescript": "5.4.5",
     "vitest": "1.5.3",
     "@directus/random": "0.2.8",
-    "@directus/tsconfig": "1.0.1",
-    "@directus/types": "11.1.1"
+    "@directus/types": "11.1.2",
+    "@directus/tsconfig": "1.0.1"
   },
   "optionalDependencies": {
     "@keyv/redis": "2.8.4",