@directus/api 9.25.0

package/README.md

@@ -0,0 +1,89 @@
+<p>&nbsp;</p>
+
+<a href="https://directus.io" target="_blank" rel="noopener noreferrer"><img width="250" alt="Logo" src="https://user-images.githubusercontent.com/9141017/88821768-0dc99800-d191-11ea-8c66-09c55ab451a2.png"></a>
+
+<p>&nbsp;</p>
+
+## Introduction
+
+**Directus is a free and open-source data platform for headless content management**. It can be installed on top of any
+new or existing SQL database, instantly providing a dynamic API (REST+GraphQL) and accompanying App for managing
+content. Built entirely in TypeScript (in Node and Vue), Directus is completely modular and end-to-end extensible...
+with absolutely no paywalls or artificial limitations.
+
+Modern and intuitive, the Directus App enables no-code data discovery, allowing for even the most non-technical users to
+view, author, and manage your raw database content. Our performant and flexible API is able to adapt to any relational
+schema, and includes rule-based permissions, event/web hooks, custom endpoints, numerous auth options, configurable
+storage adapters, and much more.
+
+Current database support includes: PostgreSQL, MySQL, SQLite, MS-SQL Server, OracleDB, MariaDB, and variants such as AWS
+Aurora/Redshift or Google Cloud Platform SQL.
+
+Learn more at...
+
+- [Website](https://directus.io/)
+- [GitHub](https://github.com/directus/directus)
+- [Documentation](https://docs.directus.io/)
+- [Community](https://directus.chat/)
+- [Twitter](https://twitter.com/directus)
+- [Cloud](https://directus.cloud/)
+- [Marketplace](https://directus.market/)
+
+<p>&nbsp;</p>
+
+## Installing
+
+Directus requires NodeJS 10+. Create a new project with our simple CLI tool:
+
+```
+npm init directus-project my-project
+```
+
+Or using yarn:
+
+```
+yarn create directus-project my-project
+```
+
+The above command will create a directory with your project name, then walk you through the database configuration and
+creation of your first admin user.
+
+<p>&nbsp;</p>
+
+## Updating
+
+To update an existing Directus project, navigate to your project directory and run:
+
+```
+npm update
+```
+
+<p>&nbsp;</p>
+
+## Contributing
+
+Please report any and all issues [on our GitHub](https://github.com/directus/directus/issues/new).
+
+Pull-requests are more than welcome, and always appreciated. Please be sure to read our
+[Contributors Guide](https://docs.directus.io/contributing/introduction/) before starting work on a new feature/fix, or
+reach out a member of the Core Team via [GitHub](https://github.com/directus/directus/discussions) or
+[Discord](https://directus.chat) with any questions.
+
+<p>&nbsp;</p>
+
+## Supporting
+
+Directus is a free and open-source project with development made possible by support from our passionate core team,
+amazing contributors, and generous sponsors. It's not easy building premium open-source software; if you would like to
+help ensure Directus stays free, please consider becoming a sponsor.
+
+- [Support us through GitHub Sponsors](https://github.com/sponsors/directus)
+- [One-time donation through PayPal](https://www.paypal.me/supportdirectus)
+- [Backing Directus](https://docs.directus.io/getting-started/backing-directus/)
+
+<p>&nbsp;</p>
+
+## License
+
+Directus is released under the [GPLv3 license](./license). Monospace Inc owns all Directus trademarks, logos, and
+intellectual property on behalf of our project's community. Copyright © 2004-2020, Monospace Inc.

package/dist/app.d.ts

@@ -0,0 +1,2 @@
+import express from 'express';
+export default function createApp(): Promise<express.Application>;

package/dist/app.js

@@ -0,0 +1,223 @@
+import cookieParser from 'cookie-parser';
+import express from 'express';
+import { merge } from 'lodash-es';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import path from 'path';
+import qs from 'qs';
+import { registerAuthProviders } from './auth.js';
+import { flushCaches } from './cache.js';
+import activityRouter from './controllers/activity.js';
+import assetsRouter from './controllers/assets.js';
+import authRouter from './controllers/auth.js';
+import collectionsRouter from './controllers/collections.js';
+import dashboardsRouter from './controllers/dashboards.js';
+import extensionsRouter from './controllers/extensions.js';
+import fieldsRouter from './controllers/fields.js';
+import filesRouter from './controllers/files.js';
+import flowsRouter from './controllers/flows.js';
+import foldersRouter from './controllers/folders.js';
+import graphqlRouter from './controllers/graphql.js';
+import itemsRouter from './controllers/items.js';
+import notFoundHandler from './controllers/not-found.js';
+import notificationsRouter from './controllers/notifications.js';
+import operationsRouter from './controllers/operations.js';
+import panelsRouter from './controllers/panels.js';
+import permissionsRouter from './controllers/permissions.js';
+import presetsRouter from './controllers/presets.js';
+import relationsRouter from './controllers/relations.js';
+import revisionsRouter from './controllers/revisions.js';
+import rolesRouter from './controllers/roles.js';
+import schemaRouter from './controllers/schema.js';
+import serverRouter from './controllers/server.js';
+import settingsRouter from './controllers/settings.js';
+import sharesRouter from './controllers/shares.js';
+import usersRouter from './controllers/users.js';
+import utilsRouter from './controllers/utils.js';
+import webhooksRouter from './controllers/webhooks.js';
+import { isInstalled, validateDatabaseConnection, validateDatabaseExtensions, validateMigrations, } from './database/index.js';
+import emitter from './emitter.js';
+import env from './env.js';
+import { InvalidPayloadException } from './exceptions/invalid-payload.js';
+import { getExtensionManager } from './extensions.js';
+import { getFlowManager } from './flows.js';
+import logger, { expressLogger } from './logger.js';
+import authenticate from './middleware/authenticate.js';
+import cache from './middleware/cache.js';
+import { checkIP } from './middleware/check-ip.js';
+import cors from './middleware/cors.js';
+import errorHandler from './middleware/error-handler.js';
+import extractToken from './middleware/extract-token.js';
+import getPermissions from './middleware/get-permissions.js';
+import rateLimiterGlobal from './middleware/rate-limiter-global.js';
+import rateLimiter from './middleware/rate-limiter-ip.js';
+import sanitizeQuery from './middleware/sanitize-query.js';
+import schema from './middleware/schema.js';
+import { getConfigFromEnv } from './utils/get-config-from-env.js';
+import { collectTelemetry } from './utils/telemetry.js';
+import { Url } from './utils/url.js';
+import { validateEnv } from './utils/validate-env.js';
+import { validateStorage } from './utils/validate-storage.js';
+import { init as initWebhooks } from './webhooks.js';
+const require = createRequire(import.meta.url);
+export default async function createApp() {
+    const helmet = await import('helmet');
+    validateEnv(['KEY', 'SECRET']);
+    if (!new Url(env['PUBLIC_URL']).isAbsolute()) {
+        logger.warn('PUBLIC_URL should be a full URL');
+    }
+    await validateStorage();
+    await validateDatabaseConnection();
+    await validateDatabaseExtensions();
+    if ((await isInstalled()) === false) {
+        logger.error(`Database doesn't have Directus tables installed.`);
+        process.exit(1);
+    }
+    if ((await validateMigrations()) === false) {
+        logger.warn(`Database migrations have not all been run`);
+    }
+    await flushCaches();
+    await registerAuthProviders();
+    const extensionManager = getExtensionManager();
+    const flowManager = getFlowManager();
+    await extensionManager.initialize();
+    await flowManager.initialize();
+    const app = express();
+    app.disable('x-powered-by');
+    app.set('trust proxy', env['IP_TRUST_PROXY']);
+    app.set('query parser', (str) => qs.parse(str, { depth: 10 }));
+    app.use(helmet.contentSecurityPolicy(merge({
+        useDefaults: true,
+        directives: {
+            // Unsafe-eval is required for vue3 / vue-i18n / app extensions
+            scriptSrc: ["'self'", "'unsafe-eval'"],
+            // Even though this is recommended to have enabled, it breaks most local
+            // installations. Making this opt-in rather than opt-out is a little more
+            // friendly. Ref #10806
+            upgradeInsecureRequests: null,
+            // These are required for MapLibre
+            // https://cdn.directus.io is required for images/videos in the official docs
+            workerSrc: ["'self'", 'blob:'],
+            childSrc: ["'self'", 'blob:'],
+            imgSrc: ["'self'", 'data:', 'blob:', 'https://cdn.directus.io'],
+            mediaSrc: ["'self'", 'https://cdn.directus.io'],
+            connectSrc: ["'self'", 'https://*'],
+        },
+    }, getConfigFromEnv('CONTENT_SECURITY_POLICY_'))));
+    if (env['HSTS_ENABLED']) {
+        app.use(helmet.hsts(getConfigFromEnv('HSTS_', ['HSTS_ENABLED'])));
+    }
+    await emitter.emitInit('app.before', { app });
+    await emitter.emitInit('middlewares.before', { app });
+    app.use(expressLogger);
+    app.use((_req, res, next) => {
+        res.setHeader('X-Powered-By', 'Directus');
+        next();
+    });
+    if (env['CORS_ENABLED'] === true) {
+        app.use(cors);
+    }
+    app.use((req, res, next) => {
+        express.json({
+            limit: env['MAX_PAYLOAD_SIZE'],
+        })(req, res, (err) => {
+            if (err) {
+                return next(new InvalidPayloadException(err.message));
+            }
+            return next();
+        });
+    });
+    app.use(cookieParser());
+    app.use(extractToken);
+    app.get('/', (_req, res, next) => {
+        if (env['ROOT_REDIRECT']) {
+            res.redirect(env['ROOT_REDIRECT']);
+        }
+        else {
+            next();
+        }
+    });
+    app.get('/robots.txt', (_, res) => {
+        res.set('Content-Type', 'text/plain');
+        res.status(200);
+        res.send(env['ROBOTS_TXT']);
+    });
+    if (env['SERVE_APP']) {
+        const adminPath = require.resolve('@directus/app');
+        const adminUrl = new Url(env['PUBLIC_URL']).addPath('admin');
+        const embeds = extensionManager.getEmbeds();
+        // Set the App's base path according to the APIs public URL
+        const html = await readFile(adminPath, 'utf8');
+        const htmlWithVars = html
+            .replace(/<base \/>/, `<base href="${adminUrl.toString({ rootRelative: true })}/" />`)
+            .replace(/<embed-head \/>/, embeds.head)
+            .replace(/<embed-body \/>/, embeds.body);
+        const sendHtml = (_req, res) => {
+            res.setHeader('Cache-Control', 'no-cache');
+            res.setHeader('Vary', 'Origin, Cache-Control');
+            res.send(htmlWithVars);
+        };
+        const setStaticHeaders = (res) => {
+            res.setHeader('Cache-Control', 'max-age=31536000, immutable');
+            res.setHeader('Vary', 'Origin, Cache-Control');
+        };
+        app.get('/admin', sendHtml);
+        app.use('/admin', express.static(path.join(adminPath, '..'), { setHeaders: setStaticHeaders }));
+        app.use('/admin/*', sendHtml);
+    }
+    // use the rate limiter - all routes for now
+    if (env['RATE_LIMITER_GLOBAL_ENABLED'] === true) {
+        app.use(rateLimiterGlobal);
+    }
+    if (env['RATE_LIMITER_ENABLED'] === true) {
+        app.use(rateLimiter);
+    }
+    app.get('/server/ping', (_req, res) => res.send('pong'));
+    app.use(authenticate);
+    app.use(checkIP);
+    app.use(sanitizeQuery);
+    app.use(cache);
+    app.use(schema);
+    app.use(getPermissions);
+    await emitter.emitInit('middlewares.after', { app });
+    await emitter.emitInit('routes.before', { app });
+    app.use('/auth', authRouter);
+    app.use('/graphql', graphqlRouter);
+    app.use('/activity', activityRouter);
+    app.use('/assets', assetsRouter);
+    app.use('/collections', collectionsRouter);
+    app.use('/dashboards', dashboardsRouter);
+    app.use('/extensions', extensionsRouter);
+    app.use('/fields', fieldsRouter);
+    app.use('/files', filesRouter);
+    app.use('/flows', flowsRouter);
+    app.use('/folders', foldersRouter);
+    app.use('/items', itemsRouter);
+    app.use('/notifications', notificationsRouter);
+    app.use('/operations', operationsRouter);
+    app.use('/panels', panelsRouter);
+    app.use('/permissions', permissionsRouter);
+    app.use('/presets', presetsRouter);
+    app.use('/relations', relationsRouter);
+    app.use('/revisions', revisionsRouter);
+    app.use('/roles', rolesRouter);
+    app.use('/schema', schemaRouter);
+    app.use('/server', serverRouter);
+    app.use('/settings', settingsRouter);
+    app.use('/shares', sharesRouter);
+    app.use('/users', usersRouter);
+    app.use('/utils', utilsRouter);
+    app.use('/webhooks', webhooksRouter);
+    // Register custom endpoints
+    await emitter.emitInit('routes.custom.before', { app });
+    app.use(extensionManager.getEndpointRouter());
+    await emitter.emitInit('routes.custom.after', { app });
+    app.use(notFoundHandler);
+    app.use(errorHandler);
+    await emitter.emitInit('routes.after', { app });
+    // Register all webhooks
+    await initWebhooks();
+    collectTelemetry();
+    await emitter.emitInit('app.after', { app });
+    return app;
+}

package/dist/app.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/auth.d.ts

@@ -0,0 +1,46 @@
+import type { SchemaOverview } from '@directus/types';
+import type { Knex } from 'knex';
+import type { AuthDriverOptions, User } from '../types/index.js';
+export declare abstract class AuthDriver {
+    knex: Knex;
+    schema: SchemaOverview;
+    constructor(options: AuthDriverOptions, _config: Record<string, any>);
+    /**
+     * Get user id for a given provider payload
+     *
+     * @param payload Any data that the user might've provided
+     * @throws InvalidCredentialsException
+     * @return User id of the identifier
+     */
+    abstract getUserID(payload: Record<string, any>): Promise<string>;
+    /**
+     * Verify user password
+     *
+     * @param user User information
+     * @param password User password
+     * @throws InvalidCredentialsException
+     */
+    abstract verify(user: User, password?: string): Promise<void>;
+    /**
+     * Check with the (external) provider if the user is allowed entry to Directus
+     *
+     * @param _user User information
+     * @param _payload Any data that the user might've provided
+     * @throws InvalidCredentialsException
+     * @returns Data to be stored with the session
+     */
+    login(_user: User, _payload: Record<string, any>): Promise<void>;
+    /**
+     * Handle user session refresh
+     *
+     * @param _user User information
+     * @throws InvalidCredentialsException
+     */
+    refresh(_user: User): Promise<void>;
+    /**
+     * Handle user session termination
+     *
+     * @param _user User information
+     */
+    logout(_user: User): Promise<void>;
+}

package/dist/auth/auth.js

@@ -0,0 +1,36 @@
+export class AuthDriver {
+    knex;
+    schema;
+    constructor(options, _config) {
+        this.knex = options.knex;
+        this.schema = options.schema;
+    }
+    /**
+     * Check with the (external) provider if the user is allowed entry to Directus
+     *
+     * @param _user User information
+     * @param _payload Any data that the user might've provided
+     * @throws InvalidCredentialsException
+     * @returns Data to be stored with the session
+     */
+    async login(_user, _payload) {
+        return;
+    }
+    /**
+     * Handle user session refresh
+     *
+     * @param _user User information
+     * @throws InvalidCredentialsException
+     */
+    async refresh(_user) {
+        return;
+    }
+    /**
+     * Handle user session termination
+     *
+     * @param _user User information
+     */
+    async logout(_user) {
+        return;
+    }
+}

package/dist/auth/drivers/index.d.ts

@@ -0,0 +1,5 @@
+export * from './local.js';
+export * from './oauth2.js';
+export * from './openid.js';
+export * from './ldap.js';
+export * from './saml.js';

package/dist/auth/drivers/index.js

@@ -0,0 +1,5 @@
+export * from './local.js';
+export * from './oauth2.js';
+export * from './openid.js';
+export * from './ldap.js';
+export * from './saml.js';

package/dist/auth/drivers/ldap.d.ts

@@ -0,0 +1,20 @@
+import { Router } from 'express';
+import type { Client } from 'ldapjs';
+import { UsersService } from '../../services/users.js';
+import type { AuthDriverOptions, User } from '../../types/index.js';
+import { AuthDriver } from '../auth.js';
+export declare class LDAPAuthDriver extends AuthDriver {
+    bindClient: Client;
+    usersService: UsersService;
+    config: Record<string, any>;
+    constructor(options: AuthDriverOptions, config: Record<string, any>);
+    private validateBindClient;
+    private fetchUserInfo;
+    private fetchUserGroups;
+    private fetchUserId;
+    getUserID(payload: Record<string, any>): Promise<string>;
+    verify(user: User, password?: string): Promise<void>;
+    login(user: User, payload: Record<string, any>): Promise<void>;
+    refresh(user: User): Promise<void>;
+}
+export declare function createLDAPAuthRouter(provider: string): Router;