@directus/api 35.0.2 → 35.1.0

package/dist/services/authentication.js

@@ -65,7 +65,7 @@ var AuthenticationService = class {
 		try {
 			userId = await provider.getUserID(cloneDeep(payload));
 		} catch (err) {
-			emitStatus("fail", payload, undefined, err);
+			emitStatus("fail", payload, void 0, err);
 			await stall(STALL_TIME, timeStart);
 			throw err;
 		}
@@ -85,11 +85,10 @@ var AuthenticationService = class {
 			await stall(STALL_TIME, timeStart);
 			throw loginError;
 		}
-		const settingsService = new SettingsService({
+		const { auth_login_attempts: allowedAttempts } = await new SettingsService({
 			knex: this.knex,
 			schema: this.schema
-		});
-		const { auth_login_attempts: allowedAttempts } = await settingsService.readSingleton({ fields: ["auth_login_attempts"] });
+		}).readSingleton({ fields: ["auth_login_attempts"] });
 		if (allowedAttempts !== null) {
 			loginAttemptsLimiter.points = allowedAttempts;
 			try {
@@ -126,12 +125,10 @@ var AuthenticationService = class {
 					}
 					user.status = "suspended";
 					await loginAttemptsLimiter.set(user.id, 0, 0);
-				} else {
-					throw new ServiceUnavailableError({
-						service: "authentication",
-						reason: "Rate limiter unreachable"
-					});
-				}
+				} else throw new ServiceUnavailableError({
+					service: "authentication",
+					reason: "Rate limiter unreachable"
+				});
 			}
 		}
 		try {
@@ -148,21 +145,18 @@ var AuthenticationService = class {
 			throw loginError;
 		}
 		if (user.tfa_secret && options?.otp) {
-			const tfaService = new TFAService({
+			if (await new TFAService({
 				knex: this.knex,
 				schema: this.schema
-			});
-			const otpValid = await tfaService.verifyOTP(user.id, options?.otp);
-			if (otpValid === false) {
+			}).verifyOTP(user.id, options?.otp) === false) {
 				const loginError = new InvalidOtpError();
 				emitStatus("fail", updatedPayload, user, loginError);
 				await stall(STALL_TIME, timeStart);
 				throw loginError;
 			}
 		}
-		const roles = await fetchRolesTree(user.role, { knex: this.knex });
 		const globalAccess = await fetchGlobalAccess({
-			roles,
+			roles: await fetchRolesTree(user.role, { knex: this.knex }),
 			user: user.id,
 			ip: this.accountability?.ip ?? null
 		}, { knex: this.knex });
@@ -173,16 +167,11 @@ var AuthenticationService = class {
 			admin_access: globalAccess.admin
 		};
 		if (!user.tfa_secret) {
-			const roleEnforcement = await this.knex.select("directus_policies.enforce_tfa").from("directus_users").leftJoin("directus_roles", "directus_users.role", "directus_roles.id").leftJoin("directus_access", "directus_roles.id", "directus_access.role").leftJoin("directus_policies", "directus_access.policy", "directus_policies.id").where("directus_users.id", user.id).where("directus_policies.enforce_tfa", true).first();
-			if (roleEnforcement) {
-				tokenPayload.enforce_tfa = true;
-			}
+			if (await this.knex.select("directus_policies.enforce_tfa").from("directus_users").leftJoin("directus_roles", "directus_users.role", "directus_roles.id").leftJoin("directus_access", "directus_roles.id", "directus_access.role").leftJoin("directus_policies", "directus_access.policy", "directus_policies.id").where("directus_users.id", user.id).where("directus_policies.enforce_tfa", true).first()) tokenPayload.enforce_tfa = true;
 		}
 		const refreshToken = nanoid(64);
 		const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env["REFRESH_TOKEN_TTL"], 0));
-		if (options?.session) {
-			tokenPayload.session = refreshToken;
-		}
+		if (options?.session) tokenPayload.session = refreshToken;
 		const customClaims = await emitter_default.emitFilter("auth.jwt", tokenPayload, {
 			status: "pending",
 			user: user?.id,
@@ -206,23 +195,19 @@ var AuthenticationService = class {
 			user_agent: this.accountability?.userAgent,
 			origin: this.accountability?.origin
 		});
-		await this.knex("directus_sessions").delete().where("expires", "<", new Date());
-		if (this.accountability) {
-			await this.activityService.createOne({
-				action: Action.LOGIN,
-				user: user.id,
-				ip: this.accountability.ip,
-				user_agent: this.accountability.userAgent,
-				origin: this.accountability.origin,
-				collection: "directus_users",
-				item: user.id
-			});
-		}
-		await this.knex("directus_users").update({ last_access: new Date() }).where({ id: user.id });
+		await this.knex("directus_sessions").delete().where("expires", "<", /* @__PURE__ */ new Date());
+		if (this.accountability) await this.activityService.createOne({
+			action: Action.LOGIN,
+			user: user.id,
+			ip: this.accountability.ip,
+			user_agent: this.accountability.userAgent,
+			origin: this.accountability.origin,
+			collection: "directus_users",
+			item: user.id
+		});
+		await this.knex("directus_users").update({ last_access: /* @__PURE__ */ new Date() }).where({ id: user.id });
 		emitStatus("success", updatedPayload, user);
-		if (allowedAttempts !== null) {
-			await loginAttemptsLimiter.set(user.id, 0, 0);
-		}
+		if (allowedAttempts !== null) await loginAttemptsLimiter.set(user.id, 0, 0);
 		await stall(STALL_TIME, timeStart);
 		return {
 			accessToken,
@@ -235,9 +220,7 @@ var AuthenticationService = class {
 		const { nanoid } = await import("nanoid");
 		const STALL_TIME = env["LOGIN_STALL_TIME"];
 		const timeStart = performance.now();
-		if (!refreshToken) {
-			throw new InvalidCredentialsError();
-		}
+		if (!refreshToken) throw new InvalidCredentialsError();
 		const record = await this.knex.select({
 			session_expires: "s.expires",
 			session_next_token: "s.next_token",
@@ -254,14 +237,12 @@ var AuthenticationService = class {
 			share_id: "d.id",
 			share_start: "d.date_start",
 			share_end: "d.date_end"
-		}).from("directus_sessions AS s").leftJoin("directus_users AS u", "s.user", "u.id").leftJoin("directus_shares AS d", "s.share", "d.id").where("s.token", refreshToken).andWhere("s.expires", ">=", new Date()).andWhere((subQuery) => {
-			subQuery.whereNull("d.date_end").orWhere("d.date_end", ">=", new Date());
+		}).from("directus_sessions AS s").leftJoin("directus_users AS u", "s.user", "u.id").leftJoin("directus_shares AS d", "s.share", "d.id").where("s.token", refreshToken).andWhere("s.expires", ">=", /* @__PURE__ */ new Date()).andWhere((subQuery) => {
+			subQuery.whereNull("d.date_end").orWhere("d.date_end", ">=", /* @__PURE__ */ new Date());
 		}).andWhere((subQuery) => {
-			subQuery.whereNull("d.date_start").orWhere("d.date_start", "<=", new Date());
+			subQuery.whereNull("d.date_start").orWhere("d.date_start", "<=", /* @__PURE__ */ new Date());
 		}).first();
-		if (!record || !record.share_id && !record.user_id) {
-			throw new InvalidCredentialsError();
-		}
+		if (!record || !record.share_id && !record.user_id) throw new InvalidCredentialsError();
 		if (record.user_id && record.user_status !== "active") {
 			await this.knex("directus_sessions").where({ token: refreshToken }).del();
 			if (record.user_status === "suspended") {
@@ -278,23 +259,20 @@ var AuthenticationService = class {
 			roles,
 			ip: this.accountability?.ip ?? null
 		}, { knex: this.knex });
-		if (record.user_id) {
-			const provider = getAuthProvider(record.user_provider);
-			await provider.refresh({
-				id: record.user_id,
-				first_name: record.user_first_name,
-				last_name: record.user_last_name,
-				email: record.user_email,
-				password: record.user_password,
-				status: record.user_status,
-				provider: record.user_provider,
-				external_identifier: record.user_external_identifier,
-				auth_data: record.user_auth_data,
-				role: record.user_role,
-				app_access: globalAccess.app,
-				admin_access: globalAccess.admin
-			});
-		}
+		if (record.user_id) await getAuthProvider(record.user_provider).refresh({
+			id: record.user_id,
+			first_name: record.user_first_name,
+			last_name: record.user_last_name,
+			email: record.user_email,
+			password: record.user_password,
+			status: record.user_status,
+			provider: record.user_provider,
+			external_identifier: record.user_external_identifier,
+			auth_data: record.user_auth_data,
+			role: record.user_role,
+			app_access: globalAccess.app,
+			admin_access: globalAccess.admin
+		});
 		let newRefreshToken = record.session_next_token ?? nanoid(64);
 		const sessionDuration = env[options?.session ? "SESSION_COOKIE_TTL" : "REFRESH_TOKEN_TTL"];
 		const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(sessionDuration, 0));
@@ -307,12 +285,10 @@ var AuthenticationService = class {
 		if (options?.session) {
 			newRefreshToken = await this.updateStatefulSession(record, refreshToken, newRefreshToken, refreshTokenExpiration);
 			tokenPayload.session = newRefreshToken;
-		} else {
-			await this.knex("directus_sessions").update({
-				token: newRefreshToken,
-				expires: refreshTokenExpiration
-			}).where({ token: refreshToken });
-		}
+		} else await this.knex("directus_sessions").update({
+			token: newRefreshToken,
+			expires: refreshTokenExpiration
+		}).where({ token: refreshToken });
 		if (record.share_id) {
 			tokenPayload.share = record.share_id;
 			tokenPayload.role = null;
@@ -335,13 +311,11 @@ var AuthenticationService = class {
 			expiresIn: TTL,
 			issuer: "directus"
 		});
-		if (record.user_id) {
-			await this.knex("directus_users").update({ last_access: new Date() }).where({ id: record.user_id });
-		}
+		if (record.user_id) await this.knex("directus_users").update({ last_access: /* @__PURE__ */ new Date() }).where({ id: record.user_id });
 		await this.knex("directus_sessions").delete().where({
 			user: record.user_id,
 			share: record.share_id
-		}).andWhere("expires", "<", new Date());
+		}).andWhere("expires", "<", /* @__PURE__ */ new Date());
 		return {
 			accessToken,
 			refreshToken: newRefreshToken,
@@ -355,14 +329,13 @@ var AuthenticationService = class {
 			return newSessionToken;
 		}
 		const GRACE_PERIOD = getMilliseconds(env["SESSION_REFRESH_GRACE_PERIOD"], 1e4);
-		const updatedSession = await this.knex("directus_sessions").update({
+		if ((await this.knex("directus_sessions").update({
 			next_token: newSessionToken,
 			expires: new Date(Date.now() + GRACE_PERIOD)
 		}, ["next_token"]).where({
 			token: oldSessionToken,
 			next_token: null
-		});
-		if (updatedSession.length === 0) {
+		})).length === 0) {
 			const { next_token } = await this.knex("directus_sessions").select("next_token").where({ token: oldSessionToken }).first();
 			return next_token;
 		}
@@ -381,29 +354,23 @@ var AuthenticationService = class {
 		const record = await this.knex.select("u.id", "u.first_name", "u.last_name", "u.email", "u.password", "u.status", "u.role", "u.provider", "u.external_identifier", "u.auth_data").from("directus_sessions as s").innerJoin("directus_users as u", "s.user", "u.id").where("s.token", refreshToken).first();
 		if (record) {
 			const user = record;
-			const provider = getAuthProvider(user.provider);
-			await provider.logout(clone(user));
-			if (this.accountability) {
-				await this.activityService.createOne({
-					action: Action.LOGOUT,
-					user: user.id,
-					ip: this.accountability.ip,
-					user_agent: this.accountability.userAgent,
-					origin: this.accountability.origin,
-					collection: "directus_users",
-					item: user.id
-				});
-			}
+			await getAuthProvider(user.provider).logout(clone(user));
+			if (this.accountability) await this.activityService.createOne({
+				action: Action.LOGOUT,
+				user: user.id,
+				ip: this.accountability.ip,
+				user_agent: this.accountability.userAgent,
+				origin: this.accountability.origin,
+				collection: "directus_users",
+				item: user.id
+			});
 			await this.knex.delete().from("directus_sessions").where("token", refreshToken);
 		}
 	}
 	async verifyPassword(userID, password) {
 		const user = await this.knex.select("id", "first_name", "last_name", "email", "password", "status", "role", "provider", "external_identifier", "auth_data").from("directus_users").where("id", userID).first();
-		if (!user) {
-			throw new InvalidCredentialsError();
-		}
-		const provider = getAuthProvider(user.provider);
-		await provider.verify(clone(user), password);
+		if (!user) throw new InvalidCredentialsError();
+		await getAuthProvider(user.provider).verify(clone(user), password);
 	}
 };