@wbce-d9/api 12.2.0 → 12.3.0

package/dist/auth/drivers/baseoauth.js

@@ -42,7 +42,7 @@ export class BaseOAuthDriver extends LocalAuthDriver {
             // Update user to update refresh_token and other properties that might have changed
             await this.getUserService().updateOne(userId, {
                 ...updatedUserPayload,
-                auth_data: userPayload.auth_data,
+                auth_data: userPayload.auth_data ?? null,
             });
             return userId;
         }

package/dist/auth/drivers/oauth2.js

@@ -4,7 +4,7 @@ import flatten from 'flat';
 import jwt from 'jsonwebtoken';
 import { Issuer, generators } from 'openid-client';
 import { getAuthProvider } from '../../auth.js';
-import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, OAUTH2_COOKIE_CLEAR_OPTIONS, OAUTH2_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS, } from '../../constants.js';
 import env from '../../env.js';
 import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException, InvalidPayloadException, } from '../../exceptions/index.js';
 import logger from '../../logger.js';
@@ -127,10 +127,7 @@ export function createOAuth2AuthRouter(providerName) {
             expiresIn: '5m',
             issuer: 'directus',
         });
-        res.cookie(`oauth2.${providerName}`, token, {
-            httpOnly: true,
-            sameSite: 'lax',
-        });
+        res.cookie(`oauth2.${providerName}`, token, OAUTH2_COOKIE_OPTIONS);
         return res.redirect(provider.generateAuthUrl(codeVerifier, prompt));
     }, respond);
     router.post('/callback', express.urlencoded({ extended: false }), (req, res) => {
@@ -164,7 +161,7 @@ export function createOAuth2AuthRouter(providerName) {
         });
         let authResponse;
         try {
-            res.clearCookie(`oauth2.${providerName}`);
+            res.clearCookie(`oauth2.${providerName}`, OAUTH2_COOKIE_CLEAR_OPTIONS);
             authResponse = await authenticationService.login(providerName, {
                 code: req.query['code'],
                 codeVerifier: verifier,

package/dist/auth/drivers/openid.js

@@ -4,7 +4,7 @@ import flatten from 'flat';
 import jwt from 'jsonwebtoken';
 import { Issuer, generators } from 'openid-client';
 import { getAuthProvider } from '../../auth.js';
-import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, OAUTH2_COOKIE_CLEAR_OPTIONS, OAUTH2_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS, } from '../../constants.js';
 import env from '../../env.js';
 import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException, InvalidPayloadException, } from '../../exceptions/index.js';
 import logger from '../../logger.js';
@@ -168,10 +168,7 @@ export function createOpenIDAuthRouter(providerName) {
         const urlParams = new URL(authUrl);
         const state = urlParams.searchParams.get('state');
         const cookieName = `openid.${providerName}.${state || ''}`;
-        res.cookie(cookieName, token, {
-            httpOnly: true,
-            sameSite: 'lax',
-        });
+        res.cookie(cookieName, token, OAUTH2_COOKIE_OPTIONS);
         return res.redirect(authUrl);
     }), respond);
     router.post('/callback', express.urlencoded({ extended: false }), (req, res) => {
@@ -214,7 +211,7 @@ export function createOpenIDAuthRouter(providerName) {
         });
         let authResponse;
         try {
-            res.clearCookie(cookieName);
+            res.clearCookie(cookieName, OAUTH2_COOKIE_CLEAR_OPTIONS);
             authResponse = await authenticationService.login(providerName, {
                 code: req.query['code'],
                 codeVerifier: verifier,

package/dist/cli/utils/create-env/env-stub.liquid

@@ -307,8 +307,8 @@ EXTENSIONS_AUTO_RELOAD=false
 ####################################################################################################
 ### Email
 
-# Email address from which emails are sent ["no-reply@directus.io"]
-EMAIL_FROM="no-reply@directus.io"
+# Email address from which emails are sent
+EMAIL_FROM="no-reply@example.com"
 
 # What to use to send emails. One of
 # sendmail, smtp, mailgun, sendgrid, ses.

package/dist/constants.d.ts

@@ -13,6 +13,8 @@ export declare const REFRESH_COOKIE_CLEAR_OPTIONS: CookieOptions;
 export declare const GET_SET_HEADER: (cookieValue: string) => string;
 export declare const ACCESS_COOKIE_OPTIONS: CookieOptions;
 export declare const ACCESS_COOKIE_CLEAR_OPTIONS: CookieOptions;
+export declare const OAUTH2_COOKIE_OPTIONS: CookieOptions;
+export declare const OAUTH2_COOKIE_CLEAR_OPTIONS: CookieOptions;
 export declare const OAS_REQUIRED_SCHEMAS: string[];
 /** Formats from which transformation is supported */
 export declare const SUPPORTED_IMAGE_TRANSFORM_FORMATS: string[];

package/dist/constants.js

@@ -82,6 +82,20 @@ export const ACCESS_COOKIE_CLEAR_OPTIONS = (() => {
     delete rest.expires;
     return rest;
 })();
+export const OAUTH2_COOKIE_OPTIONS = {
+    httpOnly: true,
+    domain: env['OAUTH2_TOKEN_COOKIE_DOMAIN'] || env['ACCESS_TOKEN_COOKIE_DOMAIN'],
+    maxAge: getMilliseconds(env['OAUTH2_TOKEN_TTL'] || env['ACCESS_TOKEN_TTL']),
+    secure: (env['OAUTH2_TOKEN_COOKIE_SECURE'] || env['ACCESS_TOKEN_COOKIE_SECURE']) ?? false,
+    sameSite: env['OAUTH2_TOKEN_COOKIE_SAME_SITE'] || 'lax',
+    path: '/auth',
+};
+export const OAUTH2_COOKIE_CLEAR_OPTIONS = (() => {
+    const { ...rest } = ACCESS_COOKIE_OPTIONS;
+    delete rest.maxAge;
+    delete rest.expires;
+    return rest;
+})();
 export const OAS_REQUIRED_SCHEMAS = ['Diff', 'Schema', 'Query', 'x-metadata'];
 /** Formats from which transformation is supported */
 export const SUPPORTED_IMAGE_TRANSFORM_FORMATS = ['image/jpeg', 'image/png', 'image/webp', 'image/tiff', 'image/avif'];

package/dist/database/seeds/13-settings.yaml

@@ -7,7 +7,7 @@ columns:
     type: string
     length: 100
     nullable: false
-    default: 'Directus'
+    default: 'd9'
   project_url:
     type: string
     length: 255

package/dist/database/system-data/fields/files.yaml

@@ -63,6 +63,8 @@ fields:
       placeholder: $t:field_options.directus_files.filename_disk
     readonly: true
     width: half
+    special:
+      - system-only
 
   - field: filename_download
     interface: input

package/dist/database/system-data/fields/users.yaml

@@ -180,3 +180,6 @@ fields:
 
   - field: auth_data
     hidden: true
+    special:
+      - system-only
+      - conceal

package/dist/middleware/authenticate.js

@@ -51,7 +51,7 @@ export const handler = async (req, _res, next) => {
                 })
                     .from('directus_sessions AS s')
                     .leftJoin('directus_users AS u', 's.user', 'u.id')
-                    .where('s.token', payload.refresh_token)
+                    .where('s.session_id', payload.session_id)
                     .andWhere('s.expires', '>=', new Date())
                     .first();
                 if (!user) {

package/dist/middleware/cors.js

@@ -3,7 +3,7 @@ import env from '../env.js';
 let corsMiddleware = (_req, _res, next) => next();
 if (env['CORS_ENABLED'] === true) {
     corsMiddleware = cors({
-        origin: env['CORS_ORIGIN'] || true,
+        origin: env['CORS_ORIGIN'] || false,
         methods: env['CORS_METHODS'] || 'GET,POST,PATCH,DELETE',
         allowedHeaders: env['CORS_ALLOWED_HEADERS'],
         exposedHeaders: env['CORS_EXPOSED_HEADERS'],

package/dist/services/authentication.js

@@ -135,7 +135,7 @@ export class AuthenticationService {
             role: user.role,
             app_access: user.app_access,
             admin_access: user.admin_access,
-            refresh_token: refreshToken,
+            session_id: sessionId,
         };
         const customClaims = await emitter.emitFilter('auth.jwt', tokenPayload, {
             status: 'pending',
@@ -309,7 +309,7 @@ export class AuthenticationService {
             role: record.role_id,
             app_access: record.role_app_access,
             admin_access: record.role_admin_access,
-            refresh_token: newRefreshToken,
+            session_id: sessionId,
         };
         if (record.share_id) {
             tokenPayload.share = record.share_id;

package/dist/services/authorization.js

@@ -449,7 +449,13 @@ export class AuthorizationService {
                         const originalItems = await mainItemService.readMany(keys);
                         for (let i = 0; i < originalItems.length; i++) {
                             const originalItem = originalItems[i];
-                            const emptyItemsToAdd = originalItem[fieldKey].length - field.update?.length - field.delete?.length;
+                            const alreadyExistingItems = originalItem[fieldKey].length;
+                            const updatedItemsIds = field.update.map((f) => f.id);
+                            const deletedItemsIds = field.delete.map((f) => f?.id || f);
+                            const twoTimesCountedItems = originalItem[fieldKey].reduce((n, item) => {
+                                return n + Number(updatedItemsIds.includes(item) || deletedItemsIds.includes(item));
+                            }, 0);
+                            const emptyItemsToAdd = alreadyExistingItems - twoTimesCountedItems;
                             const finalArrayToValidate = arrayToValidate.concat(Array(emptyItemsToAdd).fill({}));
                             // validate partial items until the last key
                             if (i == keys.length - 1) {

package/dist/services/mail/index.js

@@ -72,7 +72,7 @@ export class MailService {
             .from('directus_settings')
             .first();
         return {
-            projectName: projectInfo?.project_name || 'Directus',
+            projectName: projectInfo?.project_name || 'd9',
             projectColor: projectInfo?.project_color || '#546e7a',
             projectLogo: getProjectLogoURL(projectInfo?.project_logo),
             projectUrl: projectInfo?.project_url || '',

package/dist/services/payload.js

@@ -105,6 +105,12 @@ export class PayloadService {
                 return new Date(helpers.date.writeTimestamp(new Date().toISOString()));
             return value;
         },
+        async 'system-only'({ value, accountability }) {
+            if (accountability && (value === null || value)) {
+                throw new ForbiddenException();
+            }
+            return value;
+        },
         async 'cast-csv'({ action, value }) {
             if (Array.isArray(value) === false && typeof value !== 'string')
                 return;

package/dist/services/shares.js

@@ -81,7 +81,7 @@ export class SharesService extends ItemsService {
                 item: record.share_item,
                 collection: record.share_collection,
             },
-            refresh_token: refreshToken,
+            session_id: sessionId,
         };
         const accessToken = jwt.sign(tokenPayload, env['SECRET'], {
             expiresIn: env['ACCESS_TOKEN_TTL'],

package/dist/services/tfa.js

@@ -31,7 +31,7 @@ export class TFAService {
         const project = await this.knex.select('project_name').from('directus_settings').limit(1).first();
         return {
             secret,
-            url: authenticator.keyuri(user.email, project?.project_name || 'Directus', secret),
+            url: authenticator.keyuri(user.email, project?.project_name || 'd9', secret),
         };
     }
     async enableTFA(key, otp, secret) {

package/dist/types/auth.d.ts

@@ -34,7 +34,7 @@ export type DirectusTokenPayload = {
         collection: string;
         item: string;
     };
-    refresh_token: string;
+    session_id: string;
 };
 export type ShareData = {
     share_id: string;

package/dist/utils/compress.d.ts

@@ -1,3 +1,4 @@
 /// <reference types="node" resolution-mode="require"/>
+/// <reference types="node" resolution-mode="require"/>
 export declare function compress(raw: Record<string, any> | Record<string, any>[]): Promise<Buffer>;
 export declare function decompress(compressed: Buffer): Promise<any>;

package/dist/utils/get-ip-from-req.js

@@ -13,5 +13,5 @@ export function getIPFromReq(req) {
         }
     }
     // IP addresses starting with ::ffff: are IPv4 addresses in IPv6 format. We can strip the prefix to get back to IPv4
-    return ip.startsWith('::ffff:') ? ip.substring(7) : ip;
+    return ip?.startsWith('::ffff:') ? ip.substring(7) : ip ?? '';
 }

package/dist/utils/jwt.js

@@ -21,9 +21,9 @@ export function verifyJWT(token, secret) {
     return payload;
 }
 export function verifyAccessJWT(token, secret) {
-    const { id, role, app_access, admin_access, share, share_scope, refresh_token } = verifyJWT(token, secret);
-    if (role === undefined || app_access === undefined || admin_access === undefined || refresh_token === undefined) {
+    const { id, role, app_access, admin_access, share, share_scope, session_id } = verifyJWT(token, secret);
+    if (role === undefined || app_access === undefined || admin_access === undefined || session_id === undefined) {
         throw new InvalidTokenException('Invalid token payload.');
     }
-    return { id, role, app_access, admin_access, share, share_scope, refresh_token };
+    return { id, role, app_access, admin_access, share, share_scope, session_id };
 }

package/dist/utils/parse-image-metadata.d.ts

@@ -1,3 +1,4 @@
 /// <reference types="node" resolution-mode="require"/>
+/// <reference types="node" resolution-mode="require"/>
 export declare function parseIptc(buffer: Buffer): Record<string, unknown>;
 export declare function parseXmp(buffer: Buffer): Record<string, unknown>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.2.0",
+  "version": "12.3.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -22,7 +22,7 @@
     "framework",
     "vue"
   ],
-  "homepage": "https://directus.io",
+  "homepage": "https://github.com/LaWebcapsule/directus9",
   "bugs": {
     "url": "https://github.com/LaWebcapsule/directus9/issues"
   },
@@ -63,75 +63,77 @@
     "!**/__*__/"
   ],
   "dependencies": {
-    "@authenio/samlify-node-xmllint": "2.0.0",
-    "@aws-sdk/client-sesv2": "3.916.0",
-    "@godaddy/terminus": "4.12.0",
-    "@rollup/plugin-alias": "5.0.0",
     "@rollup/plugin-node-resolve": "15.0.2",
     "@rollup/plugin-virtual": "3.0.1",
     "@wbce-d9/format-title": "10.0.0",
-    "argon2": "0.30.3",
-    "async": "3.2.4",
     "axios": "^1.12.0",
+    "chalk": "5.2.0",
+    "commander": "10.0.1",
+    "date-fns": "2.29.3",
+    "execa": "7.1.1",
+    "express": "^4.21.2",
+    "fs-extra": "11.1.1",
+    "inquirer": "9.1.5",
+    "joi": "17.9.1",
+    "js-yaml": "4.1.1",
+    "json2csv": "5.0.7",
+    "knex": "3.1.0",
+    "lodash-es": "4.17.23",
+    "marked": "4.3.0",
+    "micromustache": "8.0.3",
+    "nanoid": "5.0.9",
+    "openapi3-ts": "3.2.0",
+    "ora": "6.3.0",
+    "pino": "8.11.0",
+    "rollup": "3.29.5",
+    "uuid": "9.0.0",
+    "wellknown": "0.5.0",
+    "@authenio/samlify-node-xmllint": "2.0.0",
+    "@aws-sdk/client-sesv2": "3.1004.0",
+    "@godaddy/terminus": "4.12.0",
+    "@rollup/plugin-alias": "5.0.0",
+    "argon2": "0.44.0",
+    "async": "3.2.4",
     "busboy": "1.6.0",
     "bytes": "3.1.2",
     "camelcase": "7.0.1",
-    "chalk": "5.2.0",
     "chokidar": "3.5.3",
-    "commander": "10.0.1",
     "content-disposition": "0.5.4",
     "cookie-parser": "1.4.7",
     "cors": "2.8.5",
     "csv-parser": "3.0.0",
-    "date-fns": "2.29.3",
     "deep-diff": "1.0.2",
     "destroy": "1.2.0",
     "dotenv": "16.0.3",
     "encodeurl": "1.0.2",
     "eventemitter2": "6.4.9",
-    "execa": "7.1.1",
     "exif-reader": "1.2.0",
-    "express": "^4.21.2",
     "fast-redact": "^3.5.0",
     "flat": "5.0.2",
-    "fs-extra": "11.1.1",
     "graphql": "16.8.1",
     "graphql-compose": "9.0.10",
     "helmet": "6.1.5",
     "icc": "3.0.0",
-    "inquirer": "9.1.5",
     "ioredis": "5.3.2",
     "isolated-vm": "^6.0.1",
-    "joi": "17.9.1",
-    "js-yaml": "4.1.1",
     "js2xmlparser": "5.0.0",
-    "json2csv": "5.0.7",
     "jsonwebtoken": "9.0.0",
     "keyv": "4.5.2",
-    "knex": "3.1.0",
     "ldapjs": "2.3.3",
     "liquidjs": "10.7.0",
-    "lodash-es": "4.17.23",
-    "marked": "4.3.0",
-    "micromustache": "8.0.3",
     "mime-types": "2.1.35",
     "ms": "2.1.3",
-    "nanoid": "5.0.9",
     "node-cron": "3.0.2",
     "node-machine-id": "1.1.12",
     "nodemailer": "7.0.11",
     "object-hash": "3.0.0",
-    "openapi3-ts": "3.2.0",
     "openid-client": "5.4.0",
-    "ora": "6.3.0",
     "otplib": "12.0.1",
-    "pino": "8.11.0",
     "pino-http": "8.3.3",
     "pino-http-print": "3.1.0",
     "pino-pretty": "10.0.0",
-    "qs": "6.14.1",
+    "qs": "6.14.2",
     "rate-limiter-flexible": "2.4.1",
-    "rollup": "3.29.5",
     "samlify": "2.10.0",
     "sanitize-html": "2.12.1",
     "sharp": "0.32.6",
@@ -140,26 +142,39 @@
     "strip-bom-stream": "5.0.0",
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
-    "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
-    "wellknown": "0.5.0",
-    "@wbce-d9/constants": "10.0.0",
-    "@wbce-d9/app": "9.35.1",
+    "@wbce-d9/app": "10.0.0",
     "@wbce-d9/exceptions": "10.0.0",
     "@wbce-d9/extensions-sdk": "10.0.2",
+    "@wbce-d9/constants": "10.0.0",
+    "@wbce-d9/schema": "10.0.0",
     "@wbce-d9/specs": "9.26.5",
     "@wbce-d9/storage": "10.0.0",
     "@wbce-d9/storage-driver-azure": "10.0.1",
-    "@wbce-d9/schema": "10.0.0",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.1",
-    "@wbce-d9/storage-driver-local": "10.0.1",
-    "@wbce-d9/storage-driver-s3": "10.0.1",
     "@wbce-d9/storage-driver-gcs": "10.0.1",
+    "@wbce-d9/storage-driver-s3": "10.0.1",
+    "@wbce-d9/storage-driver-local": "10.0.1",
+    "@wbce-d9/utils": "10.0.1",
     "@wbce-d9/update-check": "10.0.1",
-    "@wbce-d9/utils": "10.0.1"
+    "@wbce-d9/storage-driver-cloudinary": "10.0.1"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
+    "@types/fs-extra": "11.0.1",
+    "@types/inquirer": "9.0.3",
+    "@types/js-yaml": "4.0.5",
+    "@types/json2csv": "5.0.3",
+    "@types/lodash-es": "4.17.7",
+    "@types/marked": "4.0.8",
+    "@types/node": "22.15.29",
+    "@types/supertest": "2.0.12",
+    "@types/uuid": "9.0.1",
+    "@types/wellknown": "0.5.4",
+    "@vitest/coverage-v8": "4.1.0",
+    "@wbce-d9/tsconfig": "2.0.0",
+    "supertest": "6.3.3",
+    "typescript": "5.0.4",
+    "vitest": "4.1.0",
     "@types/async": "3.2.19",
     "@types/busboy": "1.5.0",
     "@types/bytes": "3.1.1",
@@ -170,40 +185,25 @@
     "@types/destroy": "1.0.0",
     "@types/encodeurl": "1.0.0",
     "@types/exif-reader": "1.0.0",
-    "@types/express": "4.17.17",
-    "@types/express-serve-static-core": "4.17.33",
+    "@types/express": "4.17.25",
+    "@types/express-serve-static-core": "4.19.8",
     "@types/fast-redact": "3.0.2",
     "@types/flat": "5.0.2",
-    "@types/fs-extra": "11.0.1",
-    "@types/inquirer": "9.0.3",
-    "@types/js-yaml": "4.0.5",
-    "@types/json2csv": "5.0.3",
     "@types/jsonwebtoken": "9.0.1",
     "@types/keyv": "4.2.0",
     "@types/ldapjs": "2.2.5",
-    "@types/lodash-es": "4.17.7",
-    "@types/marked": "4.0.8",
     "@types/mime-types": "2.1.1",
     "@types/ms": "0.7.31",
-    "@types/node": "18.15.13",
     "@types/node-cron": "3.0.7",
     "@types/nodemailer": "6.4.7",
     "@types/object-hash": "3.0.2",
-    "@types/qs": "6.9.7",
+    "@types/qs": "6.14.0",
     "@types/sanitize-html": "2.9.0",
     "@types/stream-json": "1.7.3",
-    "@types/supertest": "2.0.12",
-    "@types/uuid": "9.0.1",
     "@types/uuid-validate": "0.0.1",
-    "@types/wellknown": "0.5.4",
-    "@vitest/coverage-c8": "0.30.1",
-    "@wbce-d9/tsconfig": "2.0.0",
     "copyfiles": "2.4.1",
     "form-data": "4.0.4",
     "knex-mock-client": "3.0.2",
-    "supertest": "6.3.3",
-    "typescript": "5.0.4",
-    "vitest": "0.30.1",
     "@wbce-d9/types": "10.1.0"
   },
   "optionalDependencies": {