@directus/api 9.25.0

package/dist/rate-limiter.js

@@ -0,0 +1,33 @@
+import { merge } from 'lodash-es';
+import { RateLimiterMemcache, RateLimiterMemory, RateLimiterRedis, } from 'rate-limiter-flexible';
+import env from './env.js';
+import { getConfigFromEnv } from './utils/get-config-from-env.js';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+export function createRateLimiter(configPrefix = 'RATE_LIMITER', configOverrides) {
+    switch (env['RATE_LIMITER_STORE']) {
+        case 'redis':
+            return new RateLimiterRedis(getConfig('redis', configPrefix, configOverrides));
+        case 'memcache':
+            return new RateLimiterMemcache(getConfig('memcache', configPrefix, configOverrides));
+        case 'memory':
+        default:
+            return new RateLimiterMemory(getConfig('memory', configPrefix, configOverrides));
+    }
+}
+function getConfig(store = 'memory', configPrefix = 'RATE_LIMITER', overrides) {
+    const config = getConfigFromEnv(`${configPrefix}_`, `${configPrefix}_${store}_`);
+    if (store === 'redis') {
+        const Redis = require('ioredis');
+        delete config.redis;
+        config.storeClient = new Redis(env[`${configPrefix}_REDIS`] || getConfigFromEnv(`${configPrefix}_REDIS_`));
+    }
+    if (store === 'memcache') {
+        const Memcached = require('memcached');
+        config.storeClient = new Memcached(env[`${configPrefix}_MEMCACHE`], getConfigFromEnv(`${configPrefix}_MEMCACHE_`));
+    }
+    delete config.enabled;
+    delete config.store;
+    merge(config, overrides || {});
+    return config;
+}

package/dist/request/index.d.ts

@@ -0,0 +1,5 @@
+import type { AxiosInstance } from 'axios';
+export declare const _cache: {
+    axiosInstance: AxiosInstance | null;
+};
+export declare function getAxios(): Promise<AxiosInstance>;

package/dist/request/index.js

@@ -0,0 +1,14 @@
+import { requestInterceptor } from './request-interceptor.js';
+import { responseInterceptor } from './response-interceptor.js';
+export const _cache = {
+    axiosInstance: null,
+};
+export async function getAxios() {
+    if (!_cache.axiosInstance) {
+        const axios = (await import('axios')).default;
+        _cache.axiosInstance = axios.create();
+        _cache.axiosInstance.interceptors.request.use(requestInterceptor);
+        _cache.axiosInstance.interceptors.response.use(responseInterceptor);
+    }
+    return _cache.axiosInstance;
+}

package/dist/request/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/request/request-interceptor.d.ts

@@ -0,0 +1,2 @@
+import type { InternalAxiosRequestConfig } from 'axios';
+export declare const requestInterceptor: (config: InternalAxiosRequestConfig) => Promise<InternalAxiosRequestConfig<any>>;

package/dist/request/request-interceptor.js

@@ -0,0 +1,26 @@
+import axios from 'axios';
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { URL } from 'node:url';
+import logger from '../logger.js';
+import { validateIP } from './validate-ip.js';
+export const requestInterceptor = async (config) => {
+    const uri = axios.getUri(config);
+    const { hostname } = new URL(uri);
+    let ip;
+    if (isIP(hostname) === 0) {
+        try {
+            const dns = await lookup(hostname);
+            ip = dns.address;
+        }
+        catch (err) {
+            logger.warn(err, `Couldn't lookup the DNS for url "${uri}"`);
+            throw new Error(`Requested URL "${uri}" resolves to a denied IP address`);
+        }
+    }
+    else {
+        ip = hostname;
+    }
+    await validateIP(ip, uri);
+    return config;
+};

package/dist/request/request-interceptor.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/request/response-interceptor.d.ts

@@ -0,0 +1,2 @@
+import type { AxiosResponse } from 'axios';
+export declare const responseInterceptor: (config: AxiosResponse<any, any>) => Promise<AxiosResponse<any, any>>;

package/dist/request/response-interceptor.js

@@ -0,0 +1,5 @@
+import { validateIP } from './validate-ip.js';
+export const responseInterceptor = async (config) => {
+    await validateIP(config.request.socket.remoteAddress, config.request.url);
+    return config;
+};

package/dist/request/response-interceptor.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/request/validate-ip.d.ts

@@ -0,0 +1 @@
+export declare const validateIP: (ip: string, url: string) => Promise<void>;

package/dist/request/validate-ip.js

@@ -0,0 +1,20 @@
+import os from 'node:os';
+import { getEnv } from '../env.js';
+export const validateIP = async (ip, url) => {
+    const env = getEnv();
+    if (env['IMPORT_IP_DENY_LIST'].includes(ip)) {
+        throw new Error(`Requested URL "${url}" resolves to a denied IP address`);
+    }
+    if (env['IMPORT_IP_DENY_LIST'].includes('0.0.0.0')) {
+        const networkInterfaces = os.networkInterfaces();
+        for (const networkInfo of Object.values(networkInterfaces)) {
+            if (!networkInfo)
+                continue;
+            for (const info of networkInfo) {
+                if (info.address === ip) {
+                    throw new Error(`Requested URL "${url}" resolves to a denied IP address`);
+                }
+            }
+        }
+    }
+};

package/dist/request/validate-ip.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server.d.ts

@@ -0,0 +1,5 @@
+/// <reference types="node" resolution-mode="require"/>
+import * as http from 'http';
+export declare let SERVER_ONLINE: boolean;
+export declare function createServer(): Promise<http.Server>;
+export declare function startServer(): Promise<void>;

package/dist/server.js

@@ -0,0 +1,135 @@
+import { createTerminus } from '@godaddy/terminus';
+import * as http from 'http';
+import * as https from 'https';
+import { once } from 'lodash-es';
+import qs from 'qs';
+import { isUpToDate } from '@directus/update-check';
+import url from 'url';
+import * as pkg from './utils/package.js';
+import createApp from './app.js';
+import getDatabase from './database/index.js';
+import emitter from './emitter.js';
+import env from './env.js';
+import logger from './logger.js';
+import { getConfigFromEnv } from './utils/get-config-from-env.js';
+export let SERVER_ONLINE = true;
+export async function createServer() {
+    const server = http.createServer(await createApp());
+    Object.assign(server, getConfigFromEnv('SERVER_'));
+    server.on('request', function (req, res) {
+        const startTime = process.hrtime();
+        const complete = once(function (finished) {
+            const elapsedTime = process.hrtime(startTime);
+            const elapsedNanoseconds = elapsedTime[0] * 1e9 + elapsedTime[1];
+            const elapsedMilliseconds = elapsedNanoseconds / 1e6;
+            const previousIn = req.socket._metrics?.in || 0;
+            const previousOut = req.socket._metrics?.out || 0;
+            const metrics = {
+                in: req.socket.bytesRead - previousIn,
+                out: req.socket.bytesWritten - previousOut,
+            };
+            req.socket._metrics = {
+                in: req.socket.bytesRead,
+                out: req.socket.bytesWritten,
+            };
+            // Compatibility when supporting serving with certificates
+            const protocol = server instanceof https.Server ? 'https' : 'http';
+            // Rely on url.parse for path extraction
+            // Doesn't break on illegal URLs
+            const urlInfo = url.parse(req.originalUrl || req.url);
+            const info = {
+                finished,
+                request: {
+                    aborted: req.aborted,
+                    completed: req.complete,
+                    method: req.method,
+                    url: urlInfo.href,
+                    path: urlInfo.pathname,
+                    protocol,
+                    host: req.headers.host,
+                    size: metrics.in,
+                    query: urlInfo.query ? qs.parse(urlInfo.query) : {},
+                    headers: req.headers,
+                },
+                response: {
+                    status: res.statusCode,
+                    size: metrics.out,
+                    headers: res.getHeaders(),
+                },
+                ip: req.headers['x-forwarded-for'] || req.socket?.remoteAddress,
+                duration: elapsedMilliseconds.toFixed(),
+            };
+            emitter.emitAction('response', info, {
+                database: getDatabase(),
+                schema: req.schema,
+                accountability: req.accountability ?? null,
+            });
+        });
+        res.once('finish', complete.bind(null, true));
+        res.once('close', complete.bind(null, false));
+    });
+    const terminusOptions = {
+        timeout: env['SERVER_SHUTDOWN_TIMEOUT'] >= 0 && env['SERVER_SHUTDOWN_TIMEOUT'] < Infinity
+            ? env['SERVER_SHUTDOWN_TIMEOUT']
+            : 1000,
+        signals: ['SIGINT', 'SIGTERM', 'SIGHUP'],
+        beforeShutdown,
+        onSignal,
+        onShutdown,
+    };
+    createTerminus(server, terminusOptions);
+    return server;
+    async function beforeShutdown() {
+        if (env['NODE_ENV'] !== 'development') {
+            logger.info('Shutting down...');
+        }
+        SERVER_ONLINE = false;
+    }
+    async function onSignal() {
+        const database = getDatabase();
+        await database.destroy();
+        logger.info('Database connections destroyed');
+    }
+    async function onShutdown() {
+        emitter.emitAction('server.stop', { server }, {
+            database: getDatabase(),
+            schema: null,
+            accountability: null,
+        });
+        if (env['NODE_ENV'] !== 'development') {
+            logger.info('Directus shut down OK. Bye bye!');
+        }
+    }
+}
+export async function startServer() {
+    const server = await createServer();
+    const host = env['HOST'];
+    const port = env['PORT'];
+    server
+        .listen(port, host, () => {
+        isUpToDate(pkg.name, pkg.version)
+            .then((update) => {
+            if (update) {
+                logger.warn(`Update available: ${pkg.version} -> ${update}`);
+            }
+        })
+            .catch(() => {
+            // No need to log/warn here. The update message is only an informative nice-to-have
+        });
+        logger.info(`Server started at http://${host}:${port}`);
+        emitter.emitAction('server.start', { server }, {
+            database: getDatabase(),
+            schema: null,
+            accountability: null,
+        });
+    })
+        .once('error', (err) => {
+        if (err?.code === 'EADDRINUSE') {
+            logger.error(`Port ${port} is already in use`);
+            process.exit(1);
+        }
+        else {
+            throw err;
+        }
+    });
+}

package/dist/services/activity.d.ts

@@ -0,0 +1,10 @@
+import type { AbstractServiceOptions, Item, MutationOptions, PrimaryKey } from '../types/index.js';
+import { ItemsService } from './items.js';
+import { NotificationsService } from './notifications.js';
+import { UsersService } from './users.js';
+export declare class ActivityService extends ItemsService {
+    notificationsService: NotificationsService;
+    usersService: UsersService;
+    constructor(options: AbstractServiceOptions);
+    createOne(data: Partial<Item>, opts?: MutationOptions): Promise<PrimaryKey>;
+}

package/dist/services/activity.js

@@ -0,0 +1,94 @@
+import { Action } from '@directus/constants';
+import { uniq } from 'lodash-es';
+import validateUUID from 'uuid-validate';
+import env from '../env.js';
+import { ForbiddenException } from '../exceptions/forbidden.js';
+import logger from '../logger.js';
+import { getPermissions } from '../utils/get-permissions.js';
+import { Url } from '../utils/url.js';
+import { userName } from '../utils/user-name.js';
+import { AuthorizationService } from './authorization.js';
+import { ItemsService } from './items.js';
+import { NotificationsService } from './notifications.js';
+import { UsersService } from './users.js';
+export class ActivityService extends ItemsService {
+    notificationsService;
+    usersService;
+    constructor(options) {
+        super('directus_activity', options);
+        this.notificationsService = new NotificationsService({ schema: this.schema });
+        this.usersService = new UsersService({ schema: this.schema });
+    }
+    async createOne(data, opts) {
+        if (data['action'] === Action.COMMENT && typeof data['comment'] === 'string') {
+            const usersRegExp = new RegExp(/@[0-9A-F]{8}-[0-9A-F]{4}-4[0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}/gi);
+            const mentions = uniq(data['comment'].match(usersRegExp) ?? []);
+            const sender = await this.usersService.readOne(this.accountability.user, {
+                fields: ['id', 'first_name', 'last_name', 'email'],
+            });
+            for (const mention of mentions) {
+                const userID = mention.substring(1);
+                const user = await this.usersService.readOne(userID, {
+                    fields: ['id', 'first_name', 'last_name', 'email', 'role.id', 'role.admin_access', 'role.app_access'],
+                });
+                const accountability = {
+                    user: userID,
+                    role: user['role']?.id ?? null,
+                    admin: user['role']?.admin_access ?? null,
+                    app: user['role']?.app_access ?? null,
+                };
+                accountability.permissions = await getPermissions(accountability, this.schema);
+                const authorizationService = new AuthorizationService({ schema: this.schema, accountability });
+                const usersService = new UsersService({ schema: this.schema, accountability });
+                try {
+                    await authorizationService.checkAccess('read', data['collection'], data['item']);
+                    const templateData = await usersService.readByQuery({
+                        fields: ['id', 'first_name', 'last_name', 'email'],
+                        filter: { id: { _in: mentions.map((mention) => mention.substring(1)) } },
+                    });
+                    const userPreviews = templateData.reduce((acc, user) => {
+                        acc[user['id']] = `<em>${userName(user)}</em>`;
+                        return acc;
+                    }, {});
+                    let comment = data['comment'];
+                    for (const mention of mentions) {
+                        const uuid = mention.substring(1);
+                        // We only match on UUIDs in the first place. This is just an extra sanity check
+                        if (validateUUID(uuid) === false)
+                            continue;
+                        comment = comment.replace(new RegExp(mention, 'gm'), userPreviews[uuid] ?? '@Unknown User');
+                    }
+                    comment = `> ${comment.replace(/\n+/gm, '\n> ')}`;
+                    const message = `
+Hello ${userName(user)},
+
+${userName(sender)} has mentioned you in a comment:
+
+${comment}
+
+<a href="${new Url(env['PUBLIC_URL'])
+                        .addPath('admin', 'content', data['collection'], data['item'])
+                        .toString()}">Click here to view.</a>
+`;
+                    await this.notificationsService.createOne({
+                        recipient: userID,
+                        sender: sender['id'],
+                        subject: `You were mentioned in ${data['collection']}`,
+                        message,
+                        collection: data['collection'],
+                        item: data['item'],
+                    });
+                }
+                catch (err) {
+                    if (err instanceof ForbiddenException) {
+                        logger.warn(`User ${userID} doesn't have proper permissions to receive notification for this item.`);
+                    }
+                    else {
+                        throw err;
+                    }
+                }
+            }
+        }
+        return super.createOne(data, opts);
+    }
+}

package/dist/services/assets.d.ts

@@ -0,0 +1,18 @@
+/// <reference types="node" resolution-mode="require"/>
+import type { Range, Stat } from '@directus/storage';
+import type { Accountability } from '@directus/types';
+import type { Knex } from 'knex';
+import type { Readable } from 'node:stream';
+import type { AbstractServiceOptions, TransformationParams } from '../types/index.js';
+import { AuthorizationService } from './authorization.js';
+export declare class AssetsService {
+    knex: Knex;
+    accountability: Accountability | null;
+    authorizationService: AuthorizationService;
+    constructor(options: AbstractServiceOptions);
+    getAsset(id: string, transformation: TransformationParams, range?: Range): Promise<{
+        stream: Readable;
+        file: any;
+        stat: Stat;
+    }>;
+}

package/dist/services/assets.js

@@ -0,0 +1,151 @@
+import { clamp } from 'lodash-es';
+import { contentType } from 'mime-types';
+import hash from 'object-hash';
+import path from 'path';
+import sharp from 'sharp';
+import validateUUID from 'uuid-validate';
+import { SUPPORTED_IMAGE_TRANSFORM_FORMATS } from '../constants.js';
+import getDatabase from '../database/index.js';
+import env from '../env.js';
+import { ForbiddenException } from '../exceptions/forbidden.js';
+import { IllegalAssetTransformation } from '../exceptions/illegal-asset-transformation.js';
+import { RangeNotSatisfiableException } from '../exceptions/range-not-satisfiable.js';
+import { ServiceUnavailableException } from '../exceptions/service-unavailable.js';
+import logger from '../logger.js';
+import { getStorage } from '../storage/index.js';
+import { getMilliseconds } from '../utils/get-milliseconds.js';
+import * as TransformationUtils from '../utils/transformations.js';
+import { AuthorizationService } from './authorization.js';
+export class AssetsService {
+    knex;
+    accountability;
+    authorizationService;
+    constructor(options) {
+        this.knex = options.knex || getDatabase();
+        this.accountability = options.accountability || null;
+        this.authorizationService = new AuthorizationService(options);
+    }
+    async getAsset(id, transformation, range) {
+        const storage = await getStorage();
+        const publicSettings = await this.knex
+            .select('project_logo', 'public_background', 'public_foreground')
+            .from('directus_settings')
+            .first();
+        const systemPublicKeys = Object.values(publicSettings || {});
+        /**
+         * This is a little annoying. Postgres will error out if you're trying to search in `where`
+         * with a wrong type. In case of directus_files where id is a uuid, we'll have to verify the
+         * validity of the uuid ahead of time.
+         */
+        const isValidUUID = validateUUID(id, 4);
+        if (isValidUUID === false)
+            throw new ForbiddenException();
+        if (systemPublicKeys.includes(id) === false && this.accountability?.admin !== true) {
+            await this.authorizationService.checkAccess('read', 'directus_files', id);
+        }
+        const file = (await this.knex.select('*').from('directus_files').where({ id }).first());
+        if (!file)
+            throw new ForbiddenException();
+        const exists = await storage.location(file.storage).exists(file.filename_disk);
+        if (!exists)
+            throw new ForbiddenException();
+        if (range) {
+            const missingRangeLimits = range.start === undefined && range.end === undefined;
+            const endBeforeStart = range.start !== undefined && range.end !== undefined && range.end <= range.start;
+            const startOverflow = range.start !== undefined && range.start >= file.filesize;
+            const endUnderflow = range.end !== undefined && range.end <= 0;
+            if (missingRangeLimits || endBeforeStart || startOverflow || endUnderflow) {
+                throw new RangeNotSatisfiableException(range);
+            }
+            const lastByte = file.filesize - 1;
+            if (range.end) {
+                if (range.start === undefined) {
+                    // fetch chunk from tail
+                    range.start = file.filesize - range.end;
+                    range.end = lastByte;
+                }
+                if (range.end >= file.filesize) {
+                    // fetch entire file
+                    range.end = lastByte;
+                }
+            }
+            if (range.start) {
+                if (range.end === undefined) {
+                    // fetch entire file
+                    range.end = lastByte;
+                }
+                if (range.start < 0) {
+                    // fetch file from head
+                    range.start = 0;
+                }
+            }
+        }
+        const type = file.type;
+        const transforms = TransformationUtils.resolvePreset(transformation, file);
+        if (type && transforms.length > 0 && SUPPORTED_IMAGE_TRANSFORM_FORMATS.includes(type)) {
+            const maybeNewFormat = TransformationUtils.maybeExtractFormat(transforms);
+            const assetFilename = path.basename(file.filename_disk, path.extname(file.filename_disk)) +
+                getAssetSuffix(transforms) +
+                (maybeNewFormat ? `.${maybeNewFormat}` : path.extname(file.filename_disk));
+            const exists = await storage.location(file.storage).exists(assetFilename);
+            if (maybeNewFormat) {
+                file.type = contentType(assetFilename) || null;
+            }
+            if (exists) {
+                return {
+                    stream: await storage.location(file.storage).read(assetFilename, range),
+                    file,
+                    stat: await storage.location(file.storage).stat(assetFilename),
+                };
+            }
+            // Check image size before transforming. Processing an image that's too large for the
+            // system memory will kill the API. Sharp technically checks for this too in it's
+            // limitInputPixels, but we should have that check applied before starting the read streams
+            const { width, height } = file;
+            if (!width ||
+                !height ||
+                width > env['ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION'] ||
+                height > env['ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION']) {
+                throw new IllegalAssetTransformation(`Image is too large to be transformed, or image size couldn't be determined.`);
+            }
+            const { queue, process } = sharp.counters();
+            if (queue + process > env['ASSETS_TRANSFORM_MAX_CONCURRENT']) {
+                throw new ServiceUnavailableException('Server too busy', {
+                    service: 'files',
+                });
+            }
+            const readStream = await storage.location(file.storage).read(file.filename_disk, range);
+            const transformer = sharp({
+                limitInputPixels: Math.pow(env['ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION'], 2),
+                sequentialRead: true,
+                failOn: env['ASSETS_INVALID_IMAGE_SENSITIVITY_LEVEL'],
+            });
+            transformer.timeout({
+                seconds: clamp(Math.round(getMilliseconds(env['ASSETS_TRANSFORM_TIMEOUT'], 0) / 1000), 1, 3600),
+            });
+            if (transforms.find((transform) => transform[0] === 'rotate') === undefined)
+                transformer.rotate();
+            transforms.forEach(([method, ...args]) => transformer[method].apply(transformer, args));
+            readStream.on('error', (e) => {
+                logger.error(e, `Couldn't transform file ${file.id}`);
+                readStream.unpipe(transformer);
+            });
+            await storage.location(file.storage).write(assetFilename, readStream.pipe(transformer), type);
+            return {
+                stream: await storage.location(file.storage).read(assetFilename, range),
+                stat: await storage.location(file.storage).stat(assetFilename),
+                file,
+            };
+        }
+        else {
+            const readStream = await storage.location(file.storage).read(file.filename_disk, range);
+            const stat = await storage.location(file.storage).stat(file.filename_disk);
+            return { stream: readStream, file, stat };
+        }
+    }
+}
+const getAssetSuffix = (transforms) => {
+    if (Object.keys(transforms).length === 0)
+        return '';
+    return `__${hash(transforms)}`;
+};

package/dist/services/authentication.d.ts

@@ -0,0 +1,21 @@
+import type { Accountability, SchemaOverview } from '@directus/types';
+import type { Knex } from 'knex';
+import type { AbstractServiceOptions, LoginResult } from '../types/index.js';
+import { ActivityService } from './activity.js';
+export declare class AuthenticationService {
+    knex: Knex;
+    accountability: Accountability | null;
+    activityService: ActivityService;
+    schema: SchemaOverview;
+    constructor(options: AbstractServiceOptions);
+    /**
+     * Retrieve the tokens for a given user email.
+     *
+     * Password is optional to allow usage of this function within the SSO flow and extensions. Make sure
+     * to handle password existence checks elsewhere
+     */
+    login(providerName: string | undefined, payload: Record<string, any>, otp?: string): Promise<LoginResult>;
+    refresh(refreshToken: string): Promise<Record<string, any>>;
+    logout(refreshToken: string): Promise<void>;
+    verifyPassword(userID: string, password: string): Promise<void>;
+}