@directus/api 35.0.2 → 35.1.0

package/dist/auth/drivers/ldap.js

@@ -24,14 +24,13 @@ var LDAPAuthDriver = class extends AuthDriver {
 		super(options, config);
 		const logger = useLogger();
 		const { bindDn, bindPassword, userDn, provider, clientUrl } = config;
-		if (bindDn === undefined || bindPassword === undefined || !userDn || !provider || !clientUrl && !config["client"]?.socketPath) {
+		if (bindDn === void 0 || bindPassword === void 0 || !userDn || !provider || !clientUrl && !config["client"]?.socketPath) {
 			logger.error("Invalid provider config");
 			throw new InvalidProviderConfigError({ provider });
 		}
-		const clientConfig = typeof config["client"] === "object" ? config["client"] : {};
 		this.bindClient = new Client({
 			url: clientUrl,
-			...clientConfig
+			...typeof config["client"] === "object" ? config["client"] : {}
 		});
 		this.config = config;
 	}
@@ -67,12 +66,10 @@ var LDAPAuthDriver = class extends AuthDriver {
 				mailAttribute,
 				"userAccountControl"
 			] };
-			if (filter !== undefined) searchOptions.filter = filter;
-			if (scope !== undefined) searchOptions.scope = scope;
+			if (filter !== void 0) searchOptions.filter = filter;
+			if (scope !== void 0) searchOptions.scope = scope;
 			const { searchEntries } = await this.bindClient.search(baseDn, searchOptions);
-			if (searchEntries.length === 0) {
-				return undefined;
-			}
+			if (searchEntries.length === 0) return;
 			const entry = searchEntries[0];
 			const user = {
 				dn: entry["dn"],
@@ -94,17 +91,14 @@ var LDAPAuthDriver = class extends AuthDriver {
 	async fetchUserGroups(baseDn, filter, scope) {
 		try {
 			const searchOptions = { attributes: ["cn"] };
-			if (filter !== undefined) searchOptions.filter = filter;
-			if (scope !== undefined) searchOptions.scope = scope;
+			if (filter !== void 0) searchOptions.filter = filter;
+			if (scope !== void 0) searchOptions.scope = scope;
 			const { searchEntries } = await this.bindClient.search(baseDn, searchOptions);
 			const userGroups = [];
 			for (const entry of searchEntries) {
 				const cn = entry["cn"];
-				if (Array.isArray(cn)) {
-					userGroups.push(...cn.map((v) => String(v)));
-				} else if (cn) {
-					userGroups.push(String(cn));
-				}
+				if (Array.isArray(cn)) userGroups.push(...cn.map((v) => String(v)));
+				else if (cn) userGroups.push(String(cn));
 			}
 			return userGroups;
 		} catch (err) {
@@ -112,43 +106,32 @@ var LDAPAuthDriver = class extends AuthDriver {
 		}
 	}
 	async fetchUserId(userDn) {
-		const user = await this.knex.select("id").from("directus_users").orWhereRaw("LOWER(??) = ?", ["external_identifier", userDn.toLowerCase()]).first();
-		return user?.id;
+		return (await this.knex.select("id").from("directus_users").orWhereRaw("LOWER(??) = ?", ["external_identifier", userDn.toLowerCase()]).first())?.id;
 	}
 	async getUserID(payload) {
-		if (!payload["identifier"]) {
-			throw new InvalidCredentialsError();
-		}
+		if (!payload["identifier"]) throw new InvalidCredentialsError();
 		const logger = useLogger();
 		await this.validateBindClient();
 		const { userDn, userScope, userAttribute, groupDn, groupScope, groupAttribute, defaultRoleId, syncUserInfo } = this.config;
 		const userInfo = await this.fetchUserInfo(userDn, `(${validateLDAPAttribute(userAttribute ?? "cn")}=${escapeFilterValue(payload["identifier"])})`, userScope ?? "one");
-		if (!userInfo?.dn) {
-			throw new InvalidCredentialsError();
-		}
+		if (!userInfo?.dn) throw new InvalidCredentialsError();
 		let userRole;
 		if (groupDn) {
 			const groupAttr = groupAttribute ?? "member";
 			const memberValue = groupAttr.toLowerCase() === "memberuid" && userInfo.uid ? userInfo.uid : userInfo.dn;
 			const userGroups = await this.fetchUserGroups(groupDn, `(${validateLDAPAttribute(groupAttr)}=${escapeFilterValue(memberValue)})`, groupScope ?? "one");
-			if (userGroups.length) {
-				userRole = await this.knex.select("id").from("directus_roles").whereRaw(`LOWER(??) IN (${userGroups.map(() => "?")})`, ["name", ...userGroups.map((group) => group.toLowerCase())]).first();
-			}
+			if (userGroups.length) userRole = await this.knex.select("id").from("directus_roles").whereRaw(`LOWER(??) IN (${userGroups.map(() => "?")})`, ["name", ...userGroups.map((group) => group.toLowerCase())]).first();
 		}
 		const userId = await this.fetchUserId(userInfo.dn);
 		if (userId) {
 			let emitPayload = {};
-			if (groupDn) {
-				emitPayload = { role: userRole?.id ?? defaultRoleId ?? null };
-			}
-			if (syncUserInfo) {
-				emitPayload = {
-					...emitPayload,
-					first_name: userInfo.firstName,
-					last_name: userInfo.lastName,
-					email: userInfo.email
-				};
-			}
+			if (groupDn) emitPayload = { role: userRole?.id ?? defaultRoleId ?? null };
+			if (syncUserInfo) emitPayload = {
+				...emitPayload,
+				first_name: userInfo.firstName,
+				last_name: userInfo.lastName,
+				email: userInfo.email
+			};
 			const schema$1 = await getSchema();
 			const updatedUserPayload$1 = await emitter_default.emitFilter(`auth.update`, emitPayload, {
 				identifier: userInfo.dn,
@@ -162,13 +145,10 @@ var LDAPAuthDriver = class extends AuthDriver {
 				schema: schema$1,
 				accountability: null
 			});
-			const usersService = this.getUsersService(schema$1);
-			await usersService.updateOne(userId, updatedUserPayload$1);
+			await this.getUsersService(schema$1).updateOne(userId, updatedUserPayload$1);
 			return userId;
 		}
-		if (!userInfo) {
-			throw new InvalidCredentialsError();
-		}
+		if (!userInfo) throw new InvalidCredentialsError();
 		const userPayload = {
 			provider: this.config["provider"],
 			first_name: userInfo.firstName,
@@ -191,8 +171,7 @@ var LDAPAuthDriver = class extends AuthDriver {
 			accountability: null
 		});
 		try {
-			const usersService = this.getUsersService(schema);
-			await usersService.createOne(updatedUserPayload);
+			await this.getUsersService(schema).createOne(updatedUserPayload);
 		} catch (e) {
 			if (isDirectusError(e, ErrorCode.RecordNotUnique)) {
 				logger.warn(e, "[LDAP] Failed to register user. User not unique");
@@ -203,9 +182,7 @@ var LDAPAuthDriver = class extends AuthDriver {
 		return await this.fetchUserId(userInfo.dn);
 	}
 	async verify(user, password) {
-		if (!user.external_identifier || !password) {
-			throw new InvalidCredentialsError();
-		}
+		if (!user.external_identifier || !password) throw new InvalidCredentialsError();
 		const clientConfig = typeof this.config["client"] === "object" ? this.config["client"] : {};
 		const client = new Client({
 			url: this.config["clientUrl"],
@@ -224,37 +201,27 @@ var LDAPAuthDriver = class extends AuthDriver {
 	}
 	async refresh(user) {
 		await this.validateBindClient();
-		const userInfo = await this.fetchUserInfo(user.external_identifier, undefined, "base");
-		if (userInfo?.userAccountControl && userInfo.userAccountControl & INVALID_ACCOUNT_FLAGS) {
-			throw new InvalidCredentialsError();
-		}
+		const userInfo = await this.fetchUserInfo(user.external_identifier, void 0, "base");
+		if (userInfo?.userAccountControl && userInfo.userAccountControl & INVALID_ACCOUNT_FLAGS) throw new InvalidCredentialsError();
 	}
 };
 const handleError = (e) => {
-	if (e instanceof InappropriateAuthError || e instanceof InvalidCredentialsError$1 || e instanceof InsufficientAccessError) {
-		return new InvalidCredentialsError();
-	}
-	if (e instanceof Error) {
-		return new ServiceUnavailableError({
-			service: "ldap",
-			reason: `Service returned unexpected error: ${e.message}`
-		});
-	}
+	if (e instanceof InappropriateAuthError || e instanceof InvalidCredentialsError$1 || e instanceof InsufficientAccessError) return new InvalidCredentialsError();
+	if (e instanceof Error) return new ServiceUnavailableError({
+		service: "ldap",
+		reason: `Service returned unexpected error: ${e.message}`
+	});
 	return new ServiceUnavailableError({
 		service: "ldap",
 		reason: "Service returned unexpected error"
 	});
 };
 const getEntryValue = (value) => {
-	if (value === undefined) return undefined;
-	if (Buffer.isBuffer(value)) {
-		return value.toString();
-	}
+	if (value === void 0) return void 0;
+	if (Buffer.isBuffer(value)) return value.toString();
 	if (Array.isArray(value)) {
 		const first = value[0];
-		if (Buffer.isBuffer(first)) {
-			return first.toString();
-		}
+		if (Buffer.isBuffer(first)) return first.toString();
 		return first;
 	}
 	return value;
@@ -269,9 +236,7 @@ const escapeFilterValue = (value) => {
 * Validate LDAP attribute name according to RFC 4512
 */
 const validateLDAPAttribute = (name) => {
-	if (/^[a-zA-Z][a-zA-Z0-9-]*$/.test(name) === false) {
-		throw new Error(`Invalid LDAP attribute name: "${name}"`);
-	}
+	if (/^[a-zA-Z][a-zA-Z0-9-]*$/.test(name) === false) throw new Error(`Invalid LDAP attribute name: "${name}"`);
 	return name;
 };
 function createLDAPAuthRouter(provider) {
@@ -294,9 +259,7 @@ function createLDAPAuthRouter(provider) {
 			schema: req.schema
 		});
 		const { error } = loginSchema.validate(req.body);
-		if (error) {
-			throw new InvalidPayloadError({ reason: error.message });
-		}
+		if (error) throw new InvalidPayloadError({ reason: error.message });
 		const mode = req.body.mode ?? "json";
 		const { accessToken, refreshToken, expires } = await authenticationService.login(provider, req.body, {
 			session: mode === "session",
@@ -306,15 +269,9 @@ function createLDAPAuthRouter(provider) {
 			access_token: accessToken,
 			expires
 		};
-		if (mode === "json") {
-			payload.refresh_token = refreshToken;
-		}
-		if (mode === "cookie") {
-			res.cookie(env["REFRESH_TOKEN_COOKIE_NAME"], refreshToken, REFRESH_COOKIE_OPTIONS);
-		}
-		if (mode === "session") {
-			res.cookie(env["SESSION_COOKIE_NAME"], accessToken, SESSION_COOKIE_OPTIONS);
-		}
+		if (mode === "json") payload.refresh_token = refreshToken;
+		if (mode === "cookie") res.cookie(env["REFRESH_TOKEN_COOKIE_NAME"], refreshToken, REFRESH_COOKIE_OPTIONS);
+		if (mode === "session") res.cookie(env["SESSION_COOKIE_NAME"], accessToken, SESSION_COOKIE_OPTIONS);
 		res.locals["payload"] = { data: payload };
 		return next();
 	}), respond);

package/dist/auth/drivers/local.js

@@ -16,19 +16,13 @@ import argon2 from "argon2";
 //#region src/auth/drivers/local.ts
 var LocalAuthDriver = class extends AuthDriver {
 	async getUserID(payload) {
-		if (!payload["email"]) {
-			throw new InvalidCredentialsError();
-		}
+		if (!payload["email"]) throw new InvalidCredentialsError();
 		const user = await this.knex.select("id").from("directus_users").whereRaw("LOWER(??) = ?", ["email", payload["email"].toLowerCase()]).first();
-		if (!user) {
-			throw new InvalidCredentialsError();
-		}
+		if (!user) throw new InvalidCredentialsError();
 		return user.id;
 	}
 	async verify(user, password) {
-		if (!user.password || !await argon2.verify(user.password, password)) {
-			throw new InvalidCredentialsError();
-		}
+		if (!user.password || !await argon2.verify(user.password, password)) throw new InvalidCredentialsError();
 	}
 	async login(user, payload) {
 		await this.verify(user, payload["password"]);
@@ -74,9 +68,7 @@ function createLocalAuthRouter(provider) {
 			res.cookie(env["REFRESH_TOKEN_COOKIE_NAME"], refreshToken, REFRESH_COOKIE_OPTIONS);
 			payload.access_token = accessToken;
 		}
-		if (mode === "session") {
-			res.cookie(env["SESSION_COOKIE_NAME"], accessToken, SESSION_COOKIE_OPTIONS);
-		}
+		if (mode === "session") res.cookie(env["SESSION_COOKIE_NAME"], accessToken, SESSION_COOKIE_OPTIONS);
 		res.locals["payload"] = { data: payload };
 		return next();
 	}), respond);

package/dist/auth/drivers/oauth2.js

@@ -44,9 +44,7 @@ var OAuth2AuthDriver = class extends LocalAuthDriver {
 			logger.error("[OAuth2] Expected a JSON-Object as role mapping, got an Array instead. Make sure you declare the variable with 'json:' prefix.");
 			throw new InvalidProviderError();
 		}
-		if (roleMapping) {
-			this.roleMap = roleMapping;
-		}
+		if (roleMapping) this.roleMap = roleMapping;
 		const issuer = new Issuer({
 			authorization_endpoint: authorizeUrl,
 			token_endpoint: accessUrl,
@@ -75,7 +73,7 @@ var OAuth2AuthDriver = class extends LocalAuthDriver {
 			return this.client.authorizationUrl({
 				scope: this.config["scope"] ?? "email",
 				access_type: "offline",
-				prompt: prompt ? "consent" : undefined,
+				prompt: prompt ? "consent" : void 0,
 				...paramsConfig,
 				code_challenge: codeChallenge,
 				code_challenge_method: plainCodeChallenge ? "plain" : "S256",
@@ -87,8 +85,7 @@ var OAuth2AuthDriver = class extends LocalAuthDriver {
 		}
 	}
 	async fetchUserId(identifier) {
-		const user = await this.knex.select("id").from("directus_users").whereRaw("LOWER(??) = ?", ["external_identifier", identifier.toLowerCase()]).first();
-		return user?.id;
+		return (await this.knex.select("id").from("directus_users").whereRaw("LOWER(??) = ?", ["external_identifier", identifier.toLowerCase()]).first())?.id;
 	}
 	async getUserID(payload) {
 		const logger = useLogger();
@@ -116,18 +113,14 @@ var OAuth2AuthDriver = class extends LocalAuthDriver {
 		const groupClaimName = this.config["groupClaimName"] ?? "groups";
 		const groups = userInfo[groupClaimName] ? toArray(userInfo[groupClaimName]) : [];
 		if (groups.length > 0) {
-			for (const key in this.roleMap) {
-				if (groups.includes(key)) {
-					role = this.roleMap[key];
-					break;
-				}
+			for (const key in this.roleMap) if (groups.includes(key)) {
+				role = this.roleMap[key];
+				break;
 			}
-		} else if (Object.keys(this.roleMap).length > 0) {
-			logger.debug(`[OAuth2] Configured group claim with name "${groupClaimName}" does not exist or is empty.`);
-		}
+		} else if (Object.keys(this.roleMap).length > 0) logger.debug(`[OAuth2] Configured group claim with name "${groupClaimName}" does not exist or is empty.`);
 		userInfo = flatten(userInfo);
 		const { provider, emailKey, identifierKey, allowPublicRegistration, syncUserInfo } = this.config;
-		const email = userInfo[emailKey ?? "email"] ? String(userInfo[emailKey ?? "email"]) : undefined;
+		const email = userInfo[emailKey ?? "email"] ? String(userInfo[emailKey ?? "email"]) : void 0;
 		const identifier = userInfo[identifierKey] ? String(userInfo[identifierKey]) : email;
 		if (!identifier) {
 			logger.warn(`[OAuth2] Failed to find user identifier for provider "${provider}"`);
@@ -145,17 +138,13 @@ var OAuth2AuthDriver = class extends LocalAuthDriver {
 		const userId = await this.fetchUserId(identifier);
 		if (userId) {
 			let emitPayload = { auth_data: userPayload.auth_data };
-			if (this.config["roleMapping"]) {
-				emitPayload["role"] = role;
-			}
-			if (syncUserInfo) {
-				emitPayload = {
-					...emitPayload,
-					first_name: userPayload.first_name,
-					last_name: userPayload.last_name,
-					email: userPayload.email
-				};
-			}
+			if (this.config["roleMapping"]) emitPayload["role"] = role;
+			if (syncUserInfo) emitPayload = {
+				...emitPayload,
+				first_name: userPayload.first_name,
+				last_name: userPayload.last_name,
+				email: userPayload.email
+			};
 			const schema$1 = await getSchema();
 			const updatedUserPayload$1 = await emitter_default.emitFilter(`auth.update`, emitPayload, {
 				identifier,
@@ -170,10 +159,7 @@ var OAuth2AuthDriver = class extends LocalAuthDriver {
 				schema: schema$1,
 				accountability: null
 			});
-			if (Object.values(updatedUserPayload$1).some((value) => value !== undefined)) {
-				const usersService = this.getUsersService(schema$1);
-				await usersService.updateOne(userId, updatedUserPayload$1);
-			}
+			if (Object.values(updatedUserPayload$1).some((value) => value !== void 0)) await this.getUsersService(schema$1).updateOne(userId, updatedUserPayload$1);
 			return userId;
 		}
 		if (!allowPublicRegistration) {
@@ -195,8 +181,7 @@ var OAuth2AuthDriver = class extends LocalAuthDriver {
 			accountability: null
 		});
 		try {
-			const usersService = this.getUsersService(schema);
-			await usersService.createOne(updatedUserPayload);
+			await this.getUsersService(schema).createOne(updatedUserPayload);
 		} catch (e) {
 			if (isDirectusError(e, ErrorCode.RecordNotUnique)) {
 				logger.warn(e, "[OAuth2] Failed to register user. User not unique");
@@ -212,23 +197,16 @@ var OAuth2AuthDriver = class extends LocalAuthDriver {
 	async refresh(user) {
 		const logger = useLogger();
 		let authData = user.auth_data;
-		if (typeof authData === "string") {
-			try {
-				authData = parseJSON(authData);
-			} catch {
-				logger.warn(`[OAuth2] Session data isn't valid JSON: ${authData}`);
-			}
+		if (typeof authData === "string") try {
+			authData = parseJSON(authData);
+		} catch {
+			logger.warn(`[OAuth2] Session data isn't valid JSON: ${authData}`);
 		}
-		if (authData?.["refreshToken"]) {
-			try {
-				const tokenSet = await this.client.refresh(authData["refreshToken"]);
-				if (tokenSet.refresh_token) {
-					const usersService = this.getUsersService(await getSchema());
-					await usersService.updateOne(user.id, { auth_data: JSON.stringify({ refreshToken: tokenSet.refresh_token }) });
-				}
-			} catch (e) {
-				throw handleError(e);
-			}
+		if (authData?.["refreshToken"]) try {
+			const tokenSet = await this.client.refresh(authData["refreshToken"]);
+			if (tokenSet.refresh_token) await this.getUsersService(await getSchema()).updateOne(user.id, { auth_data: JSON.stringify({ refreshToken: tokenSet.refresh_token }) });
+		} catch (e) {
+			throw handleError(e);
 		}
 	}
 };
@@ -321,16 +299,11 @@ function createOAuth2AuthRouter(providerName) {
 				...otp ? { otp: String(otp) } : {}
 			});
 		} catch (error) {
-			if (isDirectusError(error, ErrorCode.InvalidToken) && !prompt) {
-				return res.redirect(`./?${redirect ? `redirect=${redirect}&` : ""}prompt=true`);
-			}
+			if (isDirectusError(error, ErrorCode.InvalidToken) && !prompt) return res.redirect(`./?${redirect ? `redirect=${redirect}&` : ""}prompt=true`);
 			if (redirect) {
 				let reason = "UNKNOWN_EXCEPTION";
-				if (isDirectusError(error)) {
-					reason = error.code;
-				} else {
-					logger.warn(error, `[OAuth2] Unexpected error during OAuth2 login`);
-				}
+				if (isDirectusError(error)) reason = error.code;
+				else logger.warn(error, `[OAuth2] Unexpected error during OAuth2 login`);
 				return res.redirect(`${redirect.split("?")[0]}?reason=${reason}`);
 			}
 			logger.warn(error, `[OAuth2] Unexpected error during OAuth2 login`);
@@ -338,8 +311,7 @@ function createOAuth2AuthRouter(providerName) {
 		}
 		const { accessToken, refreshToken, expires } = authResponse;
 		try {
-			const claims = verifyJWT(accessToken, getSecret());
-			if (claims?.enforce_tfa === true) {
+			if (verifyJWT(accessToken, getSecret())?.enforce_tfa === true) {
 				const url = new Url(env["PUBLIC_URL"]).addPath("admin", "tfa-setup");
 				if (redirect) {
 					url.setQuery("redirect", redirect);
@@ -351,11 +323,8 @@ function createOAuth2AuthRouter(providerName) {
 			logger.warn(e, `[OAuth2] Unexpected error during OAuth2 login`);
 		}
 		if (redirect) {
-			if (authMode === "session") {
-				res.cookie(env["SESSION_COOKIE_NAME"], accessToken, SESSION_COOKIE_OPTIONS);
-			} else {
-				res.cookie(env["REFRESH_TOKEN_COOKIE_NAME"], refreshToken, REFRESH_COOKIE_OPTIONS);
-			}
+			if (authMode === "session") res.cookie(env["SESSION_COOKIE_NAME"], accessToken, SESSION_COOKIE_OPTIONS);
+			else res.cookie(env["REFRESH_TOKEN_COOKIE_NAME"], refreshToken, REFRESH_COOKIE_OPTIONS);
 			return res.redirect(redirect);
 		}
 		res.locals["payload"] = { data: {