@wbce-d9/api 11.1.0 → 11.1.2

package/dist/database/migrations/20250814A-add-session-fallback-token.d.ts

@@ -0,0 +1,3 @@
+import type { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20250814A-add-session-fallback-token.js

@@ -0,0 +1,10 @@
+export async function up(knex) {
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.string('fallback_token', 64).nullable();
+    });
+}
+export async function down(knex) {
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.dropColumn('fallback_token');
+    });
+}

package/dist/database/migrations/20250910A-add-session-tracking.d.ts

@@ -0,0 +1,3 @@
+import type { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20250910A-add-session-tracking.js

@@ -0,0 +1,16 @@
+export async function up(knex) {
+    await knex.schema.alterTable('directus_activity', (table) => {
+        table.string('session_id', 64).nullable();
+    });
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.string('session_id', 64).nullable();
+    });
+}
+export async function down(knex) {
+    await knex.schema.alterTable('directus_activity', (table) => {
+        table.dropColumn('session_id');
+    });
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.dropColumn('session_id');
+    });
+}

package/dist/env.js

@@ -43,6 +43,7 @@ const allowedEnvironmentVars = [
     'REFRESH_TOKEN_COOKIE_SECURE',
     'REFRESH_TOKEN_COOKIE_SAME_SITE',
     'REFRESH_TOKEN_COOKIE_NAME',
+    'REFRESH_TOKEN_OVERLAP_DURATION',
     'LOGIN_STALL_TIME',
     'PASSWORD_RESET_URL_ALLOW_LIST',
     'USER_INVITE_URL_ALLOW_LIST',
@@ -225,6 +226,7 @@ const defaults = {
     REFRESH_TOKEN_COOKIE_SECURE: false,
     REFRESH_TOKEN_COOKIE_SAME_SITE: 'lax',
     REFRESH_TOKEN_COOKIE_NAME: 'directus_refresh_token',
+    REFRESH_TOKEN_OVERLAP_DURATION: '10s',
     LOGIN_STALL_TIME: 500,
     SERVER_SHUTDOWN_TIMEOUT: 1000,
     ROOT_REDIRECT: './admin',

package/dist/middleware/authenticate.js

@@ -2,11 +2,12 @@ import { isEqual } from 'lodash-es';
 import getDatabase from '../database/index.js';
 import emitter from '../emitter.js';
 import env from '../env.js';
-import { InvalidCredentialsException, TokenExpiredException } from '../exceptions/index.js';
+import { InvalidCredentialsException, InvalidTokenException } from '../exceptions/index.js';
 import asyncHandler from '../utils/async-handler.js';
 import { getIPFromReq } from '../utils/get-ip-from-req.js';
 import isDirectusJWT from '../utils/is-directus-jwt.js';
 import { verifyAccessJWT } from '../utils/jwt.js';
+import { ACCESS_COOKIE_CLEAR_OPTIONS, REFRESH_COOKIE_CLEAR_OPTIONS } from '../constants.js';
 /**
  * Verify the passed JWT and assign the user ID and role to `req`
  */
@@ -36,53 +37,68 @@ export const handler = async (req, _res, next) => {
         req.accountability = customAccountability;
         return next();
     }
-    req.accountability = defaultAccountability;
-    if (req.token) {
-        if (isDirectusJWT(req.token)) {
-            const payload = verifyAccessJWT(req.token, env['SECRET']);
-            // Try finding the user with a valid refresh token stored in the access token
-            const user = await database
-                .select({
-                session_expires: 's.expires',
-                user_id: 'u.id',
-            })
-                .from('directus_sessions AS s')
-                .leftJoin('directus_users AS u', 's.user', 'u.id')
-                .where('s.token', payload.refresh_token)
-                .andWhere('s.expires', '>=', new Date())
-                .first();
-            if (!user) {
-                throw new TokenExpiredException();
+    try {
+        req.accountability = defaultAccountability;
+        if (req.token) {
+            if (isDirectusJWT(req.token)) {
+                const payload = verifyAccessJWT(req.token, env['SECRET']);
+                // Try finding the user with a valid refresh token stored in the access token
+                const user = await database
+                    .select({
+                    session_expires: 's.expires',
+                    user_id: 'u.id',
+                    session_id: 's.session_id',
+                })
+                    .from('directus_sessions AS s')
+                    .leftJoin('directus_users AS u', 's.user', 'u.id')
+                    .where('s.token', payload.refresh_token)
+                    .andWhere('s.expires', '>=', new Date())
+                    .first();
+                if (!user) {
+                    throw new InvalidCredentialsException();
+                }
+                req.accountability.role = payload.role;
+                req.accountability.admin = payload.admin_access === true || payload.admin_access == 1;
+                req.accountability.app = payload.app_access === true || payload.app_access == 1;
+                req.accountability.session_id = user.session_id;
+                if (payload.share)
+                    req.accountability.share = payload.share;
+                if (payload.share_scope)
+                    req.accountability.share_scope = payload.share_scope;
+                if (payload.id)
+                    req.accountability.user = payload.id;
+            }
+            else {
+                // Try finding the user with the provided token
+                const user = await database
+                    .select('directus_users.id', 'directus_users.role', 'directus_roles.admin_access', 'directus_roles.app_access')
+                    .from('directus_users')
+                    .leftJoin('directus_roles', 'directus_users.role', 'directus_roles.id')
+                    .where({
+                    'directus_users.token': req.token,
+                    status: 'active',
+                })
+                    .first();
+                if (!user) {
+                    throw new InvalidCredentialsException();
+                }
+                req.accountability.user = user.id;
+                req.accountability.role = user.role;
+                req.accountability.admin = user.admin_access === true || user.admin_access == 1;
+                req.accountability.app = user.app_access === true || user.app_access == 1;
             }
-            req.accountability.role = payload.role;
-            req.accountability.admin = payload.admin_access === true || payload.admin_access == 1;
-            req.accountability.app = payload.app_access === true || payload.app_access == 1;
-            if (payload.share)
-                req.accountability.share = payload.share;
-            if (payload.share_scope)
-                req.accountability.share_scope = payload.share_scope;
-            if (payload.id)
-                req.accountability.user = payload.id;
         }
-        else {
-            // Try finding the user with the provided token
-            const user = await database
-                .select('directus_users.id', 'directus_users.role', 'directus_roles.admin_access', 'directus_roles.app_access')
-                .from('directus_users')
-                .leftJoin('directus_roles', 'directus_users.role', 'directus_roles.id')
-                .where({
-                'directus_users.token': req.token,
-                status: 'active',
-            })
-                .first();
-            if (!user) {
-                throw new InvalidCredentialsException();
+    }
+    catch (error) {
+        if (error instanceof InvalidCredentialsException || error instanceof InvalidTokenException) {
+            if (req?.cookies[env['ACCESS_TOKEN_COOKIE_NAME']]) {
+                _res?.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_CLEAR_OPTIONS);
+            }
+            if (req?.cookies[env['REFRESH_TOKEN_COOKIE_NAME']]) {
+                _res?.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_CLEAR_OPTIONS);
             }
-            req.accountability.user = user.id;
-            req.accountability.role = user.role;
-            req.accountability.admin = user.admin_access === true || user.admin_access == 1;
-            req.accountability.app = user.app_access === true || user.app_access == 1;
         }
+        throw error;
     }
     return next();
 };

package/dist/request/response-interceptor.d.ts

@@ -1,2 +1,2 @@
 import type { AxiosResponse } from 'axios';
-export declare const responseInterceptor: (config: AxiosResponse<any, any>) => Promise<AxiosResponse<any, any>>;
+export declare const responseInterceptor: (config: AxiosResponse<any, any>) => Promise<AxiosResponse<any, any, {}>>;

package/dist/services/authentication.js

@@ -120,6 +120,7 @@ export class AuthenticationService {
         }
         const refreshToken = nanoid(64);
         const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
+        const sessionId = nanoid(64);
         await this.knex('directus_sessions').insert({
             token: refreshToken,
             user: user.id,
@@ -127,6 +128,7 @@ export class AuthenticationService {
             ip: this.accountability?.ip,
             user_agent: this.accountability?.userAgent,
             origin: this.accountability?.origin,
+            session_id: sessionId,
         });
         const tokenPayload = {
             id: user.id,
@@ -159,6 +161,7 @@ export class AuthenticationService {
                 origin: this.accountability.origin,
                 collection: 'directus_users',
                 item: user.id,
+                session_id: sessionId,
             });
         }
         await this.knex('directus_users').update({ last_access: new Date() }).where({ id: user.id });
@@ -184,6 +187,8 @@ export class AuthenticationService {
         const record = await this.knex
             .select({
             session_expires: 's.expires',
+            session_fallback_token: 's.fallback_token',
+            session_id: 's.session_id',
             user_id: 'u.id',
             user_first_name: 'u.first_name',
             user_last_name: 'u.last_name',
@@ -251,14 +256,54 @@ export class AuthenticationService {
                 admin_access: record.role_admin_access,
             });
         }
-        const newRefreshToken = nanoid(64);
-        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
+        // Clean up expired sessions for this user first
         await this.knex('directus_sessions')
-            .update({
-            token: newRefreshToken,
-            expires: refreshTokenExpiration,
-        })
-            .where({ token: refreshToken });
+            .delete()
+            .where('user', '=', record.user_id)
+            .andWhere('expires', '<', new Date());
+        let newRefreshToken = record.session_fallback_token ?? nanoid(64);
+        const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
+        const sessionId = record.session_id ?? nanoid(64);
+        // If a fallback session already exists, just update its expiration
+        if (record.session_fallback_token) {
+            await this.knex('directus_sessions')
+                .update({
+                expires: refreshTokenExpiration,
+            })
+                .where({ token: newRefreshToken });
+        }
+        else {
+            // Otherwise, create the race condition protection mechanism
+            const overlapDuration = getMilliseconds(env['REFRESH_TOKEN_OVERLAP_DURATION'], 10000);
+            // Atomic protection: only the first request can create the fallback_token
+            const sessionUpdated = await this.knex('directus_sessions')
+                .update({
+                fallback_token: newRefreshToken,
+                expires: new Date(Date.now() + overlapDuration), // Current session expires after the overlapDuration
+            })
+                .where({ token: refreshToken, fallback_token: null }); // Atomic condition to prevent race conditions
+            if (sessionUpdated === 0) {
+                // Another request already created the fallback_token, retrieve it
+                const existingFallback = await this.knex('directus_sessions')
+                    .select('fallback_token')
+                    .where({ token: refreshToken })
+                    .first();
+                newRefreshToken = existingFallback.fallback_token;
+            }
+            else {
+                // We successfully created the fallback_token, create the new session
+                await this.knex('directus_sessions').insert({
+                    token: newRefreshToken,
+                    user: record.user_id,
+                    share: record.share_id,
+                    expires: refreshTokenExpiration,
+                    ip: this.accountability?.ip,
+                    user_agent: this.accountability?.userAgent,
+                    origin: this.accountability?.origin,
+                    session_id: sessionId,
+                });
+            }
+        }
         const tokenPayload = {
             id: record.user_id,
             role: record.role_id,
@@ -312,7 +357,12 @@ export class AuthenticationService {
             const user = record;
             const provider = getAuthProvider(user.provider);
             await provider.logout(clone(user));
-            await this.knex.delete().from('directus_sessions').where('token', refreshToken);
+            // Remove all related sessions (main and fallback)
+            await this.knex
+                .delete()
+                .from('directus_sessions')
+                .where('token', refreshToken)
+                .orWhere('fallback_token', refreshToken);
         }
     }
     async verifyPassword(userID, password) {

package/dist/services/items.js

@@ -162,6 +162,7 @@ export class ItemsService {
                     user_agent: this.accountability.userAgent,
                     origin: this.accountability.origin,
                     item: primaryKey,
+                    session_id: this.accountability.session_id,
                 });
                 // If revisions are tracked, create revisions record
                 if (this.schema.collections[this.collection].accountability === 'all') {
@@ -496,6 +497,7 @@ export class ItemsService {
                     user_agent: this.accountability.userAgent,
                     origin: this.accountability.origin,
                     item: key,
+                    session_id: this.accountability?.session_id,
                 })), { bypassLimits: true });
                 if (this.schema.collections[this.collection].accountability === 'all') {
                     const itemsService = new ItemsService(this.collection, {
@@ -680,6 +682,7 @@ export class ItemsService {
                     user_agent: this.accountability.userAgent,
                     origin: this.accountability.origin,
                     item: key,
+                    session_id: this.accountability.session_id,
                 })), { bypassLimits: true });
             }
         });

package/dist/services/shares.js

@@ -61,6 +61,7 @@ export class SharesService extends ItemsService {
             .where('id', record.share_id);
         const refreshToken = nanoid(64);
         const refreshTokenExpiration = new Date(Date.now() + getMilliseconds(env['REFRESH_TOKEN_TTL'], 0));
+        const sessionId = nanoid(64);
         await this.knex('directus_sessions').insert({
             token: refreshToken,
             expires: refreshTokenExpiration,
@@ -68,6 +69,7 @@ export class SharesService extends ItemsService {
             user_agent: this.accountability?.userAgent,
             origin: this.accountability?.origin,
             share: record.share_id,
+            session_id: sessionId,
         });
         await this.knex('directus_sessions').delete().where('expires', '<', new Date());
         const tokenPayload = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "11.1.0",
+  "version": "11.1.2",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -72,7 +72,7 @@
     "@wbce-d9/format-title": "10.0.0",
     "argon2": "0.30.3",
     "async": "3.2.4",
-    "axios": "^1.8.2",
+    "axios": "^1.12.0",
     "busboy": "1.6.0",
     "bytes": "3.1.2",
     "camelcase": "7.0.1",
@@ -143,19 +143,19 @@
     "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
     "wellknown": "0.5.0",
-    "@wbce-d9/app": "9.33.2",
+    "@wbce-d9/app": "9.33.3",
+    "@wbce-d9/exceptions": "9.26.4",
+    "@wbce-d9/extensions-sdk": "9.27.3",
     "@wbce-d9/constants": "9.28.0",
-    "@wbce-d9/schema": "9.26.4",
     "@wbce-d9/specs": "9.26.5",
-    "@wbce-d9/exceptions": "9.26.4",
     "@wbce-d9/storage": "9.26.4",
     "@wbce-d9/storage-driver-azure": "9.26.9",
-    "@wbce-d9/extensions-sdk": "9.27.2",
+    "@wbce-d9/storage-driver-cloudinary": "9.27.2",
     "@wbce-d9/storage-driver-gcs": "9.26.9",
     "@wbce-d9/storage-driver-s3": "9.26.11",
     "@wbce-d9/storage-driver-local": "9.26.9",
     "@wbce-d9/update-check": "9.28.0",
-    "@wbce-d9/storage-driver-cloudinary": "9.27.2",
+    "@wbce-d9/schema": "9.26.4",
     "@wbce-d9/utils": "9.29.2"
   },
   "devDependencies": {
@@ -204,7 +204,7 @@
     "supertest": "6.3.3",
     "typescript": "5.0.4",
     "vitest": "0.30.1",
-    "@wbce-d9/types": "9.28.0"
+    "@wbce-d9/types": "9.28.1"
   },
   "optionalDependencies": {
     "@keyv/redis": "2.5.7",