@wbce-d9/api 11.0.8 → 11.1.1

package/dist/constants.js

@@ -56,8 +56,12 @@ export const REFRESH_COOKIE_OPTIONS = {
     sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
     path: '/auth',
 };
-const { maxAge: refreshCookieMaxAge, expires: refreshCookieExpires, ...refresh_cookie_clear_options } = REFRESH_COOKIE_OPTIONS;
-export const REFRESH_COOKIE_CLEAR_OPTIONS = refresh_cookie_clear_options;
+export const REFRESH_COOKIE_CLEAR_OPTIONS = (() => {
+    const { ...rest } = REFRESH_COOKIE_OPTIONS;
+    delete rest.maxAge;
+    delete rest.expires;
+    return rest;
+})();
 export const GET_SET_HEADER = (cookieValue) => {
     const domainHeader = env['REFRESH_TOKEN_COOKIE_DOMAIN'] ? ` Domain=${env['REFRESH_TOKEN_COOKIE_DOMAIN']};` : '';
     const partitionedHeader = env['REFRESH_TOKEN_COOKIE_PARTITIONED'] == true ? ' Partitioned;' : '';
@@ -70,10 +74,14 @@ export const ACCESS_COOKIE_OPTIONS = {
     maxAge: getMilliseconds(env['ACCESS_TOKEN_TTL']),
     secure: env['ACCESS_TOKEN_COOKIE_SECURE'] ?? false,
     sameSite: env['ACCESS_TOKEN_COOKIE_SAME_SITE'] || 'strict',
-    path: '/',
+    path: '/assets',
 };
-const { maxAge: accessCookieMaxAge, expires: accessCookieExpires, ...access_cookie_clear_options } = ACCESS_COOKIE_OPTIONS;
-export const ACCESS_COOKIE_CLEAR_OPTIONS = access_cookie_clear_options;
+export const ACCESS_COOKIE_CLEAR_OPTIONS = (() => {
+    const { ...rest } = ACCESS_COOKIE_OPTIONS;
+    delete rest.maxAge;
+    delete rest.expires;
+    return rest;
+})();
 export const OAS_REQUIRED_SCHEMAS = ['Diff', 'Schema', 'Query', 'x-metadata'];
 /** Formats from which transformation is supported */
 export const SUPPORTED_IMAGE_TRANSFORM_FORMATS = ['image/jpeg', 'image/png', 'image/webp', 'image/tiff', 'image/avif'];

package/dist/database/migrations/20250814A-add-session-fallback-token.d.ts

@@ -0,0 +1,3 @@
+import type { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20250814A-add-session-fallback-token.js

@@ -0,0 +1,10 @@
+export async function up(knex) {
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.string('fallback_token', 64).nullable();
+    });
+}
+export async function down(knex) {
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.dropColumn('fallback_token');
+    });
+}

package/dist/env.js

@@ -225,6 +225,7 @@ const defaults = {
     REFRESH_TOKEN_COOKIE_SECURE: false,
     REFRESH_TOKEN_COOKIE_SAME_SITE: 'lax',
     REFRESH_TOKEN_COOKIE_NAME: 'directus_refresh_token',
+    REFRESH_TOKEN_OVERLAP_DURATION: '10s',
     LOGIN_STALL_TIME: 500,
     SERVER_SHUTDOWN_TIMEOUT: 1000,
     ROOT_REDIRECT: './admin',

package/dist/middleware/authenticate.js

@@ -2,11 +2,12 @@ import { isEqual } from 'lodash-es';
 import getDatabase from '../database/index.js';
 import emitter from '../emitter.js';
 import env from '../env.js';
-import { InvalidCredentialsException, TokenExpiredException } from '../exceptions/index.js';
+import { InvalidCredentialsException, InvalidTokenException } from '../exceptions/index.js';
 import asyncHandler from '../utils/async-handler.js';
 import { getIPFromReq } from '../utils/get-ip-from-req.js';
 import isDirectusJWT from '../utils/is-directus-jwt.js';
 import { verifyAccessJWT } from '../utils/jwt.js';
+import { ACCESS_COOKIE_CLEAR_OPTIONS, REFRESH_COOKIE_CLEAR_OPTIONS } from '../constants.js';
 /**
  * Verify the passed JWT and assign the user ID and role to `req`
  */
@@ -36,53 +37,66 @@ export const handler = async (req, _res, next) => {
         req.accountability = customAccountability;
         return next();
     }
-    req.accountability = defaultAccountability;
-    if (req.token) {
-        if (isDirectusJWT(req.token)) {
-            const payload = verifyAccessJWT(req.token, env['SECRET']);
-            // Try finding the user with a valid refresh token stored in the access token
-            const user = await database
-                .select({
-                session_expires: 's.expires',
-                user_id: 'u.id',
-            })
-                .from('directus_sessions AS s')
-                .leftJoin('directus_users AS u', 's.user', 'u.id')
-                .where('s.token', payload.refresh_token)
-                .andWhere('s.expires', '>=', new Date())
-                .first();
-            if (!user) {
-                throw new TokenExpiredException();
+    try {
+        req.accountability = defaultAccountability;
+        if (req.token) {
+            if (isDirectusJWT(req.token)) {
+                const payload = verifyAccessJWT(req.token, env['SECRET']);
+                // Try finding the user with a valid refresh token stored in the access token
+                const user = await database
+                    .select({
+                    session_expires: 's.expires',
+                    user_id: 'u.id',
+                })
+                    .from('directus_sessions AS s')
+                    .leftJoin('directus_users AS u', 's.user', 'u.id')
+                    .where('s.token', payload.refresh_token)
+                    .andWhere('s.expires', '>=', new Date())
+                    .first();
+                if (!user) {
+                    throw new InvalidCredentialsException();
+                }
+                req.accountability.role = payload.role;
+                req.accountability.admin = payload.admin_access === true || payload.admin_access == 1;
+                req.accountability.app = payload.app_access === true || payload.app_access == 1;
+                if (payload.share)
+                    req.accountability.share = payload.share;
+                if (payload.share_scope)
+                    req.accountability.share_scope = payload.share_scope;
+                if (payload.id)
+                    req.accountability.user = payload.id;
+            }
+            else {
+                // Try finding the user with the provided token
+                const user = await database
+                    .select('directus_users.id', 'directus_users.role', 'directus_roles.admin_access', 'directus_roles.app_access')
+                    .from('directus_users')
+                    .leftJoin('directus_roles', 'directus_users.role', 'directus_roles.id')
+                    .where({
+                    'directus_users.token': req.token,
+                    status: 'active',
+                })
+                    .first();
+                if (!user) {
+                    throw new InvalidCredentialsException();
+                }
+                req.accountability.user = user.id;
+                req.accountability.role = user.role;
+                req.accountability.admin = user.admin_access === true || user.admin_access == 1;
+                req.accountability.app = user.app_access === true || user.app_access == 1;
             }
-            req.accountability.role = payload.role;
-            req.accountability.admin = payload.admin_access === true || payload.admin_access == 1;
-            req.accountability.app = payload.app_access === true || payload.app_access == 1;
-            if (payload.share)
-                req.accountability.share = payload.share;
-            if (payload.share_scope)
-                req.accountability.share_scope = payload.share_scope;
-            if (payload.id)
-                req.accountability.user = payload.id;
         }
-        else {
-            // Try finding the user with the provided token
-            const user = await database
-                .select('directus_users.id', 'directus_users.role', 'directus_roles.admin_access', 'directus_roles.app_access')
-                .from('directus_users')
-                .leftJoin('directus_roles', 'directus_users.role', 'directus_roles.id')
-                .where({
-                'directus_users.token': req.token,
-                status: 'active',
-            })
-                .first();
-            if (!user) {
-                throw new InvalidCredentialsException();
+    }
+    catch (error) {
+        if (error instanceof InvalidCredentialsException || error instanceof InvalidTokenException) {
+            if (req?.cookies[env['ACCESS_TOKEN_COOKIE_NAME']]) {
+                _res?.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_CLEAR_OPTIONS);
+            }
+            if (req?.cookies[env['REFRESH_TOKEN_COOKIE_NAME']]) {
+                _res?.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_CLEAR_OPTIONS);
             }
-            req.accountability.user = user.id;
-            req.accountability.role = user.role;
-            req.accountability.admin = user.admin_access === true || user.admin_access == 1;
-            req.accountability.app = user.app_access === true || user.app_access == 1;
         }
+        throw error;
     }
     return next();
 };

package/dist/middleware/extract-token.js

@@ -22,7 +22,9 @@ const extractToken = (req, _res, next) => {
     /**
      * Check if there is an access token stored in the cookies
      */
-    if (req?.cookies?.[env['ACCESS_TOKEN_COOKIE_NAME']]) {
+    if (req?.cookies?.[env['ACCESS_TOKEN_COOKIE_NAME']] &&
+        req.path.startsWith('/assets/') &&
+        req.method === 'GET') {
         token = req.cookies[env['ACCESS_TOKEN_COOKIE_NAME']];
     }
     /**

package/dist/services/authentication.js

@@ -184,6 +184,7 @@ export class AuthenticationService {
         const record = await this.knex
             .select({
             session_expires: 's.expires',
+            session_fallback_token: 's.fallback_token',
             user_id: 'u.id',
             user_first_name: 'u.first_name',
             user_last_name: 'u.last_name',
@@ -251,14 +252,52 @@ export class AuthenticationService {
                 admin_access: record.role_admin_access,
             });
         }
-        const newRefreshToken = nanoid(64);
-        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
+        // Clean up expired sessions for this user first
         await this.knex('directus_sessions')
-            .update({
-            token: newRefreshToken,
-            expires: refreshTokenExpiration,
-        })
-            .where({ token: refreshToken });
+            .delete()
+            .where('user', '=', record.user_id)
+            .andWhere('expires', '<', new Date());
+        let newRefreshToken = record.session_fallback_token ?? nanoid(64);
+        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
+        // If a fallback session already exists, just update its expiration
+        if (record.session_fallback_token) {
+            await this.knex('directus_sessions')
+                .update({
+                expires: refreshTokenExpiration,
+            })
+                .where({ token: newRefreshToken });
+        }
+        else {
+            // Otherwise, create the race condition protection mechanism
+            const overlapDuration = getMilliseconds(env['REFRESH_TOKEN_OVERLAP_DURATION'], 10000);
+            // Atomic protection: only the first request can create the fallback_token
+            const sessionUpdated = await this.knex('directus_sessions')
+                .update({
+                fallback_token: newRefreshToken,
+                expires: new Date(Date.now() + overlapDuration), // Current session expires after the overlapDuration
+            })
+                .where({ token: refreshToken, fallback_token: null }); // Atomic condition to prevent race conditions
+            if (sessionUpdated === 0) {
+                // Another request already created the fallback_token, retrieve it
+                const existingFallback = await this.knex('directus_sessions')
+                    .select('fallback_token')
+                    .where({ token: refreshToken })
+                    .first();
+                newRefreshToken = existingFallback.fallback_token;
+            }
+            else {
+                // We successfully created the fallback_token, create the new session
+                await this.knex('directus_sessions').insert({
+                    token: newRefreshToken,
+                    user: record.user_id,
+                    share: record.share_id,
+                    expires: refreshTokenExpiration,
+                    ip: this.accountability?.ip,
+                    user_agent: this.accountability?.userAgent,
+                    origin: this.accountability?.origin,
+                });
+            }
+        }
         const tokenPayload = {
             id: record.user_id,
             role: record.role_id,
@@ -312,7 +351,12 @@ export class AuthenticationService {
             const user = record;
             const provider = getAuthProvider(user.provider);
             await provider.logout(clone(user));
-            await this.knex.delete().from('directus_sessions').where('token', refreshToken);
+            // Remove all related sessions (main and fallback)
+            await this.knex
+                .delete()
+                .from('directus_sessions')
+                .where('token', refreshToken)
+                .orWhere('fallback_token', refreshToken);
         }
     }
     async verifyPassword(userID, password) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "11.0.8",
+  "version": "11.1.1",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -143,20 +143,20 @@
     "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
     "wellknown": "0.5.0",
-    "@wbce-d9/app": "9.33.2",
     "@wbce-d9/constants": "9.28.0",
+    "@wbce-d9/app": "9.33.2",
     "@wbce-d9/extensions-sdk": "9.27.2",
-    "@wbce-d9/exceptions": "9.26.4",
     "@wbce-d9/schema": "9.26.4",
     "@wbce-d9/specs": "9.26.5",
     "@wbce-d9/storage": "9.26.4",
+    "@wbce-d9/storage-driver-azure": "9.26.9",
     "@wbce-d9/storage-driver-cloudinary": "9.27.2",
     "@wbce-d9/storage-driver-gcs": "9.26.9",
-    "@wbce-d9/storage-driver-azure": "9.26.9",
     "@wbce-d9/storage-driver-local": "9.26.9",
-    "@wbce-d9/utils": "9.29.2",
     "@wbce-d9/update-check": "9.28.0",
-    "@wbce-d9/storage-driver-s3": "9.26.11"
+    "@wbce-d9/storage-driver-s3": "9.26.11",
+    "@wbce-d9/utils": "9.29.2",
+    "@wbce-d9/exceptions": "9.26.4"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",