@wbce-d9/api 10.3.1 → 10.6.0

package/dist/app.js

@@ -108,10 +108,12 @@ export default async function createApp() {
     await emitter.emitInit('app.before', { app });
     await emitter.emitInit('middlewares.before', { app });
     app.use(expressLogger);
-    app.use((_req, res, next) => {
-        res.setHeader('X-Powered-By', 'Directus');
-        next();
-    });
+    if (env['X_POWERED_BY_ENABLED'] === true) {
+        app.use((_req, res, next) => {
+            res.setHeader('X-Powered-By', 'Directus');
+            next();
+        });
+    }
     if (env['CORS_ENABLED'] === true) {
         app.use(cors);
     }

package/dist/auth/drivers/saml.js

@@ -3,7 +3,7 @@ import { BaseException } from '@wbce-d9/exceptions';
 import express, { Router } from 'express';
 import * as samlify from 'samlify';
 import { getAuthProvider } from '../../auth.js';
-import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
+import { ACCESS_COOKIE_CLEAR_OPTIONS, ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_CLEAR_OPTIONS, REFRESH_COOKIE_OPTIONS, } from '../../constants.js';
 import getDatabase from '../../database/index.js';
 import emitter from '../../emitter.js';
 import env from '../../env.js';
@@ -103,13 +103,13 @@ export function createSAMLAuthRouter(providerName) {
         const { context } = sp.createLogoutRequest(idp, 'redirect', req.body);
         const authService = new AuthenticationService({ accountability: req.accountability, schema: req.schema });
         if (req.cookies[env['ACCESS_TOKEN_COOKIE_NAME']]) {
-            res.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_OPTIONS);
+            res.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_CLEAR_OPTIONS);
         }
         if (req.cookies[env['REFRESH_TOKEN_COOKIE_NAME']]) {
             const currentRefreshToken = req.cookies[env['REFRESH_TOKEN_COOKIE_NAME']];
             if (currentRefreshToken) {
                 await authService.logout(currentRefreshToken);
-                res.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_OPTIONS);
+                res.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_CLEAR_OPTIONS);
             }
         }
         return res.redirect(context);

package/dist/cli/utils/create-env/env-stub.liquid

@@ -230,6 +230,9 @@ REFRESH_TOKEN_COOKIE_NAME="directus_refresh_token"
 # and it should be greater than the time taken for a login request with an invalid password [500]
 # LOGIN_STALL_TIME=500
 
+# Whether or not to enable the X-Powered-By Header [true]
+X_POWERED_BY_ENABLED=false
+
 # Whether or not to enable the CORS headers [false]
 CORS_ENABLED=true
 

package/dist/constants.d.ts

@@ -9,8 +9,10 @@ export declare const COLUMN_TRANSFORMS: string[];
 export declare const GENERATE_SPECIAL: string[];
 export declare const UUID_REGEX = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 export declare const REFRESH_COOKIE_OPTIONS: CookieOptions;
+export declare const REFRESH_COOKIE_CLEAR_OPTIONS: CookieOptions;
 export declare const GET_SET_HEADER: (cookieValue: string) => string;
 export declare const ACCESS_COOKIE_OPTIONS: CookieOptions;
+export declare const ACCESS_COOKIE_CLEAR_OPTIONS: CookieOptions;
 export declare const OAS_REQUIRED_SCHEMAS: string[];
 /** Formats from which transformation is supported */
 export declare const SUPPORTED_IMAGE_TRANSFORM_FORMATS: string[];

package/dist/constants.js

@@ -56,6 +56,8 @@ export const REFRESH_COOKIE_OPTIONS = {
     sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
     path: '/auth',
 };
+const { maxAge: refreshCookieMaxAge, expires: refreshCookieExpires, ...refresh_cookie_clear_options } = REFRESH_COOKIE_OPTIONS;
+export const REFRESH_COOKIE_CLEAR_OPTIONS = refresh_cookie_clear_options;
 export const GET_SET_HEADER = (cookieValue) => {
     const domainHeader = env['REFRESH_TOKEN_COOKIE_DOMAIN'] ? ` Domain=${env['REFRESH_TOKEN_COOKIE_DOMAIN']};` : '';
     const partitionedHeader = env['REFRESH_TOKEN_COOKIE_PARTITIONED'] == true ? ' Partitioned;' : '';
@@ -70,6 +72,8 @@ export const ACCESS_COOKIE_OPTIONS = {
     sameSite: env['ACCESS_TOKEN_COOKIE_SAME_SITE'] || 'strict',
     path: '/',
 };
+const { maxAge: accessCookieMaxAge, expires: accessCookieExpires, ...access_cookie_clear_options } = ACCESS_COOKIE_OPTIONS;
+export const ACCESS_COOKIE_CLEAR_OPTIONS = access_cookie_clear_options;
 export const OAS_REQUIRED_SCHEMAS = ['Diff', 'Schema', 'Query', 'x-metadata'];
 /** Formats from which transformation is supported */
 export const SUPPORTED_IMAGE_TRANSFORM_FORMATS = ['image/jpeg', 'image/png', 'image/webp', 'image/tiff', 'image/avif'];

package/dist/controllers/auth.js

@@ -1,6 +1,6 @@
 import { Router } from 'express';
 import { createLDAPAuthRouter, createLocalAuthRouter, createOAuth2AuthRouter, createOpenIDAuthRouter, createSAMLAuthRouter, } from '../auth/drivers/index.js';
-import { ACCESS_COOKIE_OPTIONS, DEFAULT_AUTH_PROVIDER, REFRESH_COOKIE_OPTIONS } from '../constants.js';
+import { ACCESS_COOKIE_CLEAR_OPTIONS, ACCESS_COOKIE_OPTIONS, DEFAULT_AUTH_PROVIDER, REFRESH_COOKIE_CLEAR_OPTIONS, REFRESH_COOKIE_OPTIONS, } from '../constants.js';
 import env from '../env.js';
 import { InvalidPayloadException } from '../exceptions/index.js';
 import logger from '../logger.js';
@@ -55,6 +55,9 @@ router.post('/refresh', asyncHandler(async (req, res, next) => {
         accountability: accountability,
         schema: req.schema,
     });
+    if (req.cookies[env['ACCESS_TOKEN_COOKIE_NAME']]) {
+        res.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_CLEAR_OPTIONS);
+    }
     const currentRefreshToken = req.body.refresh_token || req.cookies[env['REFRESH_TOKEN_COOKIE_NAME']];
     if (!currentRefreshToken) {
         throw new InvalidPayloadException(`"refresh_token" is required in either the JSON payload or Cookie`);
@@ -95,10 +98,10 @@ router.post('/logout', asyncHandler(async (req, res, next) => {
     }
     await authenticationService.logout(currentRefreshToken);
     if (req.cookies[env['ACCESS_TOKEN_COOKIE_NAME']]) {
-        res.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_OPTIONS);
+        res.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_CLEAR_OPTIONS);
     }
     if (req.cookies[env['REFRESH_TOKEN_COOKIE_NAME']]) {
-        res.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_OPTIONS);
+        res.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_CLEAR_OPTIONS);
     }
     return next();
 }), respond);

package/dist/controllers/utils.js

@@ -13,11 +13,15 @@ import asyncHandler from '../utils/async-handler.js';
 import { generateHash } from '../utils/generate-hash.js';
 import { sanitizeQuery } from '../utils/sanitize-query.js';
 const router = Router();
+const randomStringSchemaDesc = Joi.object({
+    length: Joi.number().integer().min(1).max(500).default(32),
+});
 router.get('/random/string', asyncHandler(async (req, res) => {
     const { nanoid } = await import('nanoid');
-    if (req.query && req.query['length'] && Number(req.query['length']) > 500)
-        throw new InvalidQueryException(`"length" can't be more than 500 characters`);
-    const string = nanoid(req.query?.['length'] ? Number(req.query['length']) : 32);
+    const { error, value } = randomStringSchemaDesc.validate(req.query, { allowUnknown: true });
+    if (error)
+        throw new InvalidQueryException(error.message);
+    const string = nanoid(value.length);
     return res.json({ data: string });
 }));
 router.post('/hash/generate', asyncHandler(async (req, res) => {

package/dist/database/run-ast.js

@@ -35,7 +35,7 @@ export default async function runAST(originalAST, schema, options) {
             return null;
         // Run the items through the special transforms
         const payloadService = new PayloadService(collection, { knex, schema });
-        let items = await payloadService.processValues('read', rawItems);
+        let items = await payloadService.processValues('read', rawItems, query.alias ?? {});
         if (!items || (Array.isArray(items) && items.length === 0))
             return items;
         // Apply the `_in` filters to the nested collection batches

package/dist/database/system-data/app-access-permissions/app-access-permissions.yaml

@@ -41,6 +41,9 @@
   permissions:
     user:
       _eq: $CURRENT_USER
+  validation:
+    user:
+      _eq: $CURRENT_USER
 
 - collection: directus_presets
   action: delete

package/dist/env.js

@@ -54,6 +54,7 @@ const allowedEnvironmentVars = [
     'HSTS_.+',
     // hashing
     'HASH_.+',
+    'X_POWERED_BY_ENABLED',
     // cors
     'CORS_ENABLED',
     'CORS_ORIGIN',
@@ -226,6 +227,7 @@ const defaults = {
     LOGIN_STALL_TIME: 500,
     SERVER_SHUTDOWN_TIMEOUT: 1000,
     ROOT_REDIRECT: './admin',
+    X_POWERED_BY_ENABLED: true,
     CORS_ENABLED: false,
     CORS_ORIGIN: false,
     CORS_METHODS: 'GET,POST,PATCH,DELETE',

package/dist/mailer.js

@@ -55,10 +55,18 @@ export default function getMailer() {
         }));
     }
     else if (transportName === 'sendgrid') {
-        const sg = require('nodemailer-sendgrid');
-        transporter = nodemailer.createTransport(sg({
-            apiKey: env['EMAIL_SENDGRID_API_KEY'],
-        }));
+        let auth = false;
+        if (env['EMAIL_SENDGRID_API_KEY'] || env['EMAIL_SMTP_PASSWORD']) {
+            auth = {
+                user: 'apikey',
+                pass: env['EMAIL_SENDGRID_API_KEY'],
+            };
+        }
+        transporter = nodemailer.createTransport({
+            host: 'smtp.sendgrid.net',
+            port: 587,
+            auth,
+        });
     }
     else {
         logger.warn('Illegal transport given for email. Check the EMAIL_TRANSPORT env var.');

package/dist/middleware/authenticate.js

@@ -2,7 +2,7 @@ import { isEqual } from 'lodash-es';
 import getDatabase from '../database/index.js';
 import emitter from '../emitter.js';
 import env from '../env.js';
-import { InvalidCredentialsException } from '../exceptions/index.js';
+import { InvalidCredentialsException, TokenExpiredException } from '../exceptions/index.js';
 import asyncHandler from '../utils/async-handler.js';
 import { getIPFromReq } from '../utils/get-ip-from-req.js';
 import isDirectusJWT from '../utils/is-directus-jwt.js';
@@ -40,6 +40,20 @@ export const handler = async (req, _res, next) => {
     if (req.token) {
         if (isDirectusJWT(req.token)) {
             const payload = verifyAccessJWT(req.token, env['SECRET']);
+            // Try finding the user with a valid refresh token stored in the access token
+            const user = await database
+                .select({
+                session_expires: 's.expires',
+                user_id: 'u.id',
+            })
+                .from('directus_sessions AS s')
+                .leftJoin('directus_users AS u', 's.user', 'u.id')
+                .where('s.token', payload.refresh_token)
+                .andWhere('s.expires', '>=', new Date())
+                .first();
+            if (!user) {
+                throw new TokenExpiredException();
+            }
             req.accountability.role = payload.role;
             req.accountability.admin = payload.admin_access === true || payload.admin_access == 1;
             req.accountability.app = payload.app_access === true || payload.app_access == 1;

package/dist/middleware/respond.js

@@ -22,7 +22,8 @@ export const respond = asyncHandler(async (req, res) => {
         cache &&
         !req.sanitizedQuery.export &&
         res.locals['cache'] !== false &&
-        exceedsMaxSize === false) {
+        exceedsMaxSize === false &&
+        req.originalUrl?.startsWith('/auth')) {
         const key = getCacheKey(req);
         try {
             await setCacheValue(cache, key, res.locals['payload'], getMilliseconds(env['CACHE_TTL']));

package/dist/services/authentication.js

@@ -7,7 +7,7 @@ import { DEFAULT_AUTH_PROVIDER } from '../constants.js';
 import getDatabase from '../database/index.js';
 import emitter from '../emitter.js';
 import env from '../env.js';
-import { InvalidCredentialsException, InvalidOTPException, InvalidProviderException, UserSuspendedException, } from '../exceptions/index.js';
+import { InvalidCredentialsException, InvalidOTPException, UserSuspendedException } from '../exceptions/index.js';
 import { createRateLimiter } from '../rate-limiter.js';
 import { getMilliseconds } from '../utils/get-milliseconds.js';
 import { stall } from '../utils/stall.js';
@@ -72,20 +72,10 @@ export class AuthenticationService {
                 accountability: this.accountability,
             });
         };
-        if (user?.status !== 'active') {
+        if (user?.status !== 'active' || user.provider.toLowerCase() !== providerName.toLowerCase()) {
             emitStatus('fail');
-            if (user?.status === 'suspended') {
-                await stall(STALL_TIME, timeStart);
-                throw new UserSuspendedException();
-            }
-            else {
-                await stall(STALL_TIME, timeStart);
-                throw new InvalidCredentialsException();
-            }
-        }
-        else if (user.provider.toLowerCase() !== providerName.toLowerCase()) {
             await stall(STALL_TIME, timeStart);
-            throw new InvalidProviderException();
+            throw new InvalidCredentialsException();
         }
         const settingsService = new SettingsService({
             knex: this.knex,
@@ -128,11 +118,22 @@ export class AuthenticationService {
                 throw new InvalidOTPException(`"otp" is invalid`);
             }
         }
+        const refreshToken = nanoid(64);
+        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
+        await this.knex('directus_sessions').insert({
+            token: refreshToken,
+            user: user.id,
+            expires: refreshTokenExpiration,
+            ip: this.accountability?.ip,
+            user_agent: this.accountability?.userAgent,
+            origin: this.accountability?.origin,
+        });
         const tokenPayload = {
             id: user.id,
             role: user.role,
             app_access: user.app_access,
             admin_access: user.admin_access,
+            refresh_token: refreshToken,
         };
         const customClaims = await emitter.emitFilter('auth.jwt', tokenPayload, {
             status: 'pending',
@@ -148,16 +149,6 @@ export class AuthenticationService {
             expiresIn: env['ACCESS_TOKEN_TTL'],
             issuer: 'directus',
         });
-        const refreshToken = nanoid(64);
-        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
-        await this.knex('directus_sessions').insert({
-            token: refreshToken,
-            user: user.id,
-            expires: refreshTokenExpiration,
-            ip: this.accountability?.ip,
-            user_agent: this.accountability?.userAgent,
-            origin: this.accountability?.origin,
-        });
         await this.knex('directus_sessions').delete().where('expires', '<', new Date());
         if (this.accountability) {
             await this.activityService.createOne({
@@ -260,11 +251,20 @@ export class AuthenticationService {
                 admin_access: record.role_admin_access,
             });
         }
+        const newRefreshToken = nanoid(64);
+        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
+        await this.knex('directus_sessions')
+            .update({
+            token: newRefreshToken,
+            expires: refreshTokenExpiration,
+        })
+            .where({ token: refreshToken });
         const tokenPayload = {
             id: record.user_id,
             role: record.role_id,
             app_access: record.role_app_access,
             admin_access: record.role_admin_access,
+            refresh_token: newRefreshToken,
         };
         if (record.share_id) {
             tokenPayload.share = record.share_id;
@@ -291,14 +291,6 @@ export class AuthenticationService {
             expiresIn: env['ACCESS_TOKEN_TTL'],
             issuer: 'directus',
         });
-        const newRefreshToken = nanoid(64);
-        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
-        await this.knex('directus_sessions')
-            .update({
-            token: newRefreshToken,
-            expires: refreshTokenExpiration,
-        })
-            .where({ token: refreshToken });
         if (record.user_id) {
             await this.knex('directus_users').update({ last_access: new Date() }).where({ id: record.user_id });
         }

package/dist/services/graphql/index.js

@@ -5,7 +5,7 @@ import { GraphQLBoolean, GraphQLEnumType, GraphQLError, GraphQLFloat, GraphQLID,
 import { GraphQLJSON, InputTypeComposer, ObjectTypeComposer, SchemaComposer, toInputObjectType } from 'graphql-compose';
 import { flatten, get, mapKeys, merge, omit, pick, set, transform, uniq } from 'lodash-es';
 import { clearSystemCache, getCache } from '../../cache.js';
-import { ACCESS_COOKIE_OPTIONS, DEFAULT_AUTH_PROVIDER, GENERATE_SPECIAL, REFRESH_COOKIE_OPTIONS, } from '../../constants.js';
+import { ACCESS_COOKIE_CLEAR_OPTIONS, ACCESS_COOKIE_OPTIONS, DEFAULT_AUTH_PROVIDER, GENERATE_SPECIAL, REFRESH_COOKIE_CLEAR_OPTIONS, REFRESH_COOKIE_OPTIONS, } from '../../constants.js';
 import getDatabase from '../../database/index.js';
 import env from '../../env.js';
 import { ForbiddenException, GraphQLValidationException, InvalidPayloadException } from '../../exceptions/index.js';
@@ -1766,10 +1766,10 @@ export class GraphQLService {
                     }
                     await authenticationService.logout(currentRefreshToken);
                     if (req?.cookies?.[env['ACCESS_TOKEN_COOKIE_NAME']]) {
-                        res?.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_OPTIONS);
+                        res?.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_CLEAR_OPTIONS);
                     }
                     if (req?.cookies?.[env['REFRESH_TOKEN_COOKIE_NAME']]) {
-                        res?.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_OPTIONS);
+                        res?.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_CLEAR_OPTIONS);
                     }
                     return true;
                 },
@@ -1894,10 +1894,10 @@ export class GraphQLService {
                 },
                 resolve: async (_, args) => {
                     const { nanoid } = await import('nanoid');
-                    if (args['length'] && Number(args['length']) > 500) {
-                        throw new InvalidPayloadException(`"length" can't be more than 500 characters`);
+                    if (args['length'] !== undefined && (args['length'] < 1 || args['length'] > 500)) {
+                        throw new InvalidPayloadException(`"length" must be between 1 and 500`);
                     }
-                    return nanoid(args['length'] ? Number(args['length']) : 32);
+                    return nanoid(args['length'] ? args['length'] : 32);
                 },
             },
             utils_hash_generate: {

package/dist/services/payload.d.ts

@@ -27,6 +27,8 @@ export declare class PayloadService {
     transformers: Transformers;
     processValues(action: Action, payloads: Partial<Item>[]): Promise<Partial<Item>[]>;
     processValues(action: Action, payload: Partial<Item>): Promise<Partial<Item>>;
+    processValues(action: Action, payloads: Partial<Item>[], aliasMap: Record<string, string>): Promise<Partial<Item>[]>;
+    processValues(action: Action, payload: Partial<Item>, aliasMap: Record<string, string>): Promise<Partial<Item>>;
     processAggregates(payload: Partial<Item>[]): void;
     processField(field: SchemaOverview['collections'][string]['fields'][string], payload: Partial<Item>, action: Action, accountability: Accountability | null): Promise<any>;
     /**

package/dist/services/payload.js

@@ -121,12 +121,20 @@ export class PayloadService {
             return value;
         },
     };
-    async processValues(action, payload) {
+    async processValues(action, payload, aliasMap = {}) {
         const processedPayload = toArray(payload);
         if (processedPayload.length === 0)
             return [];
         const fieldsInPayload = Object.keys(processedPayload[0]);
         let specialFieldsInCollection = Object.entries(this.schema.collections[this.collection].fields).filter(([_name, field]) => field.special && field.special.length > 0);
+        const aliasEntries = Object.entries(aliasMap);
+        for (const [name, field] of specialFieldsInCollection) {
+            for (const [aliasName, fieldName] of aliasEntries) {
+                if (fieldName === name) {
+                    specialFieldsInCollection.push([aliasName, { ...field, field: aliasName }]);
+                }
+            }
+        }
         if (action === 'read') {
             specialFieldsInCollection = specialFieldsInCollection.filter(([name]) => {
                 return fieldsInPayload.includes(name);

package/dist/services/shares.js

@@ -59,6 +59,17 @@ export class SharesService extends ItemsService {
         await this.knex('directus_shares')
             .update({ times_used: record.share_times_used + 1 })
             .where('id', record.share_id);
+        const refreshToken = nanoid(64);
+        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
+        await this.knex('directus_sessions').insert({
+            token: refreshToken,
+            expires: refreshTokenExpiration,
+            ip: this.accountability?.ip,
+            user_agent: this.accountability?.userAgent,
+            origin: this.accountability?.origin,
+            share: record.share_id,
+        });
+        await this.knex('directus_sessions').delete().where('expires', '<', new Date());
         const tokenPayload = {
             app_access: false,
             admin_access: false,
@@ -68,22 +79,12 @@ export class SharesService extends ItemsService {
                 item: record.share_item,
                 collection: record.share_collection,
             },
+            refresh_token: refreshToken,
         };
         const accessToken = jwt.sign(tokenPayload, env['SECRET'], {
             expiresIn: env['ACCESS_TOKEN_TTL'],
             issuer: 'directus',
         });
-        const refreshToken = nanoid(64);
-        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
-        await this.knex('directus_sessions').insert({
-            token: refreshToken,
-            expires: refreshTokenExpiration,
-            ip: this.accountability?.ip,
-            user_agent: this.accountability?.userAgent,
-            origin: this.accountability?.origin,
-            share: record.share_id,
-        });
-        await this.knex('directus_sessions').delete().where('expires', '<', new Date());
         return {
             accessToken,
             refreshToken,

package/dist/services/users.js

@@ -117,7 +117,7 @@ export class UsersService extends ItemsService {
      */
     async getUserByEmail(email) {
         return await this.knex
-            .select('id', 'role', 'status', 'password')
+            .select('id', 'role', 'status', 'password', 'email')
             .from('directus_users')
             .whereRaw(`LOWER(??) = ?`, ['email', email.toLowerCase()])
             .first();
@@ -307,13 +307,13 @@ export class UsersService extends ItemsService {
             if (isEmpty(user) || user.status === 'invited') {
                 const subjectLine = subject ?? "You've been invited";
                 await mailService.send({
-                    to: email,
+                    to: user.email,
                     subject: subjectLine,
                     template: {
                         name: 'user-invitation',
                         data: {
                             url: this.inviteUrl(email, url),
-                            email,
+                            email: user.email,
                         },
                     },
                 });
@@ -351,20 +351,20 @@ export class UsersService extends ItemsService {
             knex: this.knex,
             accountability: this.accountability,
         });
-        const payload = { email, scope: 'password-reset', hash: getSimpleHash('' + user.password) };
+        const payload = { email: user.email, scope: 'password-reset', hash: getSimpleHash('' + user.password) };
         const token = jwt.sign(payload, env['SECRET'], { expiresIn: '1d', issuer: 'directus' });
         const acceptURL = url
             ? new Url(url).setQuery('token', token).toString()
             : new Url(env['PUBLIC_URL']).addPath('admin', 'reset-password').setQuery('token', token).toString();
         const subjectLine = subject ? subject : 'Password Reset Request';
         await mailService.send({
-            to: email,
+            to: user.email,
             subject: subjectLine,
             template: {
                 name: 'password-reset',
                 data: {
                     url: acceptURL,
-                    email,
+                    email: user.email,
                 },
             },
         });

package/dist/types/auth.d.ts

@@ -34,6 +34,7 @@ export type DirectusTokenPayload = {
         collection: string;
         item: string;
     };
+    refresh_token: string;
 };
 export type ShareData = {
     share_id: string;

package/dist/utils/jwt.js

@@ -21,9 +21,9 @@ export function verifyJWT(token, secret) {
     return payload;
 }
 export function verifyAccessJWT(token, secret) {
-    const { id, role, app_access, admin_access, share, share_scope } = verifyJWT(token, secret);
-    if (role === undefined || app_access === undefined || admin_access === undefined) {
+    const { id, role, app_access, admin_access, share, share_scope, refresh_token } = verifyJWT(token, secret);
+    if (role === undefined || app_access === undefined || admin_access === undefined || refresh_token === undefined) {
         throw new InvalidTokenException('Invalid token payload.');
     }
-    return { id, role, app_access, admin_access, share, share_scope };
+    return { id, role, app_access, admin_access, share, share_scope, refresh_token };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "10.3.1",
+  "version": "10.6.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -72,7 +72,7 @@
     "@wbce-d9/format-title": "10.0.0",
     "argon2": "0.30.3",
     "async": "3.2.4",
-    "axios": "^1.7.2",
+    "axios": "^1.8.2",
     "busboy": "1.6.0",
     "bytes": "3.1.2",
     "camelcase": "7.0.1",
@@ -80,7 +80,7 @@
     "chokidar": "3.5.3",
     "commander": "10.0.1",
     "content-disposition": "0.5.4",
-    "cookie-parser": "1.4.6",
+    "cookie-parser": "1.4.7",
     "cors": "2.8.5",
     "csv-parser": "3.0.0",
     "date-fns": "2.29.3",
@@ -91,11 +91,11 @@
     "eventemitter2": "6.4.9",
     "execa": "7.1.1",
     "exif-reader": "1.2.0",
-    "express": "4.18.2",
+    "express": "^4.21.2",
     "fast-redact": "3.1.2",
     "flat": "5.0.2",
     "fs-extra": "11.1.1",
-    "graphql": "16.6.0",
+    "graphql": "16.8.1",
     "graphql-compose": "9.0.10",
     "helmet": "6.1.5",
     "icc": "3.0.0",
@@ -107,7 +107,7 @@
     "json2csv": "5.0.7",
     "jsonwebtoken": "9.0.0",
     "keyv": "4.5.2",
-    "knex": "2.4.2",
+    "knex": "3.1.0",
     "ldapjs": "2.3.3",
     "liquidjs": "10.7.0",
     "lodash-es": "4.17.21",
@@ -115,10 +115,10 @@
     "micromustache": "8.0.3",
     "mime-types": "2.1.35",
     "ms": "2.1.3",
-    "nanoid": "4.0.2",
+    "nanoid": "5.0.9",
     "node-cron": "3.0.2",
     "node-machine-id": "1.1.12",
-    "nodemailer": "6.9.1",
+    "nodemailer": "6.9.9",
     "object-hash": "3.0.0",
     "openapi3-ts": "3.2.0",
     "openid-client": "5.4.0",
@@ -130,10 +130,10 @@
     "pino-pretty": "10.0.0",
     "qs": "6.11.1",
     "rate-limiter-flexible": "2.4.1",
-    "rollup": "3.20.7",
+    "rollup": "3.29.5",
     "samlify": "2.8.10",
-    "sanitize-html": "2.10.0",
-    "sharp": "0.32.0",
+    "sanitize-html": "2.12.1",
+    "sharp": "0.32.6",
     "snappy": "7.2.2",
     "stream-json": "1.7.5",
     "strip-bom-stream": "5.0.0",
@@ -143,20 +143,20 @@
     "uuid-validate": "0.0.3",
     "vm2": "^3.9.19",
     "wellknown": "0.5.0",
-    "@wbce-d9/app": "9.29.1",
-    "@wbce-d9/constants": "9.26.4",
-    "@wbce-d9/extensions-sdk": "9.26.6",
-    "@wbce-d9/specs": "9.26.4",
+    "@wbce-d9/app": "9.32.0",
+    "@wbce-d9/constants": "9.28.0",
+    "@wbce-d9/extensions-sdk": "9.27.1",
     "@wbce-d9/exceptions": "9.26.4",
-    "@wbce-d9/storage": "9.26.4",
     "@wbce-d9/schema": "9.26.4",
-    "@wbce-d9/storage-driver-azure": "9.26.6",
-    "@wbce-d9/storage-driver-cloudinary": "9.26.6",
-    "@wbce-d9/storage-driver-gcs": "9.26.6",
-    "@wbce-d9/storage-driver-local": "9.26.6",
-    "@wbce-d9/storage-driver-s3": "9.26.8",
-    "@wbce-d9/update-check": "9.26.4",
-    "@wbce-d9/utils": "9.28.1"
+    "@wbce-d9/storage-driver-azure": "9.26.8",
+    "@wbce-d9/specs": "9.26.4",
+    "@wbce-d9/storage": "9.26.4",
+    "@wbce-d9/storage-driver-cloudinary": "9.27.0",
+    "@wbce-d9/storage-driver-local": "9.26.8",
+    "@wbce-d9/storage-driver-s3": "9.26.10",
+    "@wbce-d9/storage-driver-gcs": "9.26.8",
+    "@wbce-d9/utils": "9.29.1",
+    "@wbce-d9/update-check": "9.28.0"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
@@ -200,11 +200,11 @@
     "@wbce-d9/tsconfig": "0.0.7",
     "copyfiles": "2.4.1",
     "form-data": "4.0.0",
-    "knex-mock-client": "2.0.0",
+    "knex-mock-client": "3.0.2",
     "supertest": "6.3.3",
     "typescript": "5.0.4",
     "vitest": "0.30.1",
-    "@wbce-d9/types": "9.26.4"
+    "@wbce-d9/types": "9.28.0"
   },
   "optionalDependencies": {
     "@keyv/redis": "2.5.7",
@@ -212,10 +212,9 @@
     "memcached": "2.2.2",
     "mysql": "2.18.1",
     "nodemailer-mailgun-transport": "2.1.5",
-    "nodemailer-sendgrid": "1.0.3",
     "pg": "8.10.0",
     "sqlite3": "5.1.6",
-    "tedious": "16.0.0"
+    "tedious": "18.6.1"
   },
   "engines": {
     "node": ">=18.0.0"