@wbce-d9/api 12.2.0 → 12.4.0

package/dist/auth/drivers/baseoauth.d.ts

@@ -1,4 +1,4 @@
-import type { Client, TokenSet } from 'openid-client';
+import * as oidc from 'openid-client';
 import { UsersService } from '../../services/users.js';
 import type { User } from '../../types/index.js';
 import { LocalAuthDriver } from './local.js';
@@ -12,12 +12,12 @@ export interface UserPayload {
     auth_data: any;
 }
 export declare abstract class BaseOAuthDriver extends LocalAuthDriver {
-    abstract getClient(): Promise<Client>;
+    abstract getClient(): Promise<oidc.Configuration>;
     abstract getredirectUrl(): string;
     abstract getUserService(): UsersService;
     abstract getConfig(): Record<string, any>;
     abstract getClientName(): string;
-    abstract getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[TokenSet, Record<string, unknown>, UserPayload]>;
+    abstract getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers, Record<string, unknown>, UserPayload]>;
     generateCodeVerifier(): string;
     fetchUserId(identifier: string): Promise<string | undefined>;
     getUserID(payload: Record<string, any>): Promise<string>;

package/dist/auth/drivers/baseoauth.js

@@ -1,5 +1,5 @@
 import { parseJSON } from '@wbce-d9/utils';
-import { errors, generators } from 'openid-client';
+import * as oidc from 'openid-client';
 import getDatabase from '../../database/index.js';
 import emitter from '../../emitter.js';
 import { RecordNotUniqueException } from '../../exceptions/database/record-not-unique.js';
@@ -9,7 +9,7 @@ import { UsersService } from '../../services/users.js';
 import { LocalAuthDriver } from './local.js';
 export class BaseOAuthDriver extends LocalAuthDriver {
     generateCodeVerifier() {
-        return generators.codeVerifier();
+        return oidc.randomPKCECodeVerifier();
     }
     async fetchUserId(identifier) {
         const user = await this.knex.select('id').from('directus_users').where('external_identifier', identifier).first();
@@ -42,7 +42,7 @@ export class BaseOAuthDriver extends LocalAuthDriver {
             // Update user to update refresh_token and other properties that might have changed
             await this.getUserService().updateOne(userId, {
                 ...updatedUserPayload,
-                auth_data: userPayload.auth_data,
+                auth_data: userPayload.auth_data ?? null,
             });
             return userId;
         }
@@ -86,9 +86,9 @@ export class BaseOAuthDriver extends LocalAuthDriver {
         if (authData?.['refreshToken']) {
             try {
                 const client = await this.getClient();
-                const tokenSet = await client.refresh(authData['refreshToken']);
+                const tokenSet = await oidc.refreshTokenGrant(client, authData['refreshToken']);
                 if (tokenSet.refresh_token) {
-                    await client.revoke(tokenSet.refresh_token, 'refresh_token');
+                    await oidc.tokenRevocation(client, tokenSet.refresh_token);
                 }
                 await this.getUserService().updateOne(user.id, {
                     auth_data: null,
@@ -119,7 +119,7 @@ export class BaseOAuthDriver extends LocalAuthDriver {
         if (authData?.['refreshToken']) {
             try {
                 const client = await this.getClient();
-                const tokenSet = await client.refresh(authData['refreshToken']);
+                const tokenSet = await oidc.refreshTokenGrant(client, authData['refreshToken']);
                 // Update user refreshToken if provided
                 if (tokenSet.refresh_token) {
                     await this.getUserService().updateOne(user.id, {
@@ -138,7 +138,7 @@ export class BaseOAuthDriver extends LocalAuthDriver {
         }
     }
     handleError = (e) => {
-        if (e instanceof errors.OPError) {
+        if (e instanceof oidc.ResponseBodyError) {
             if (e.error === 'invalid_grant') {
                 // Invalid token
                 logger.trace(e, `[${this.getClientName()}] Invalid grant`);
@@ -151,7 +151,7 @@ export class BaseOAuthDriver extends LocalAuthDriver {
                 message: e.error_description,
             });
         }
-        else if (e instanceof errors.RPError) {
+        else if (e instanceof oidc.ClientError) {
             // Internal client error
             logger.trace(e, `[${this.getClientName()}] Unknown RP error`);
             return new InvalidCredentialsException();

package/dist/auth/drivers/oauth2.d.ts

@@ -1,20 +1,20 @@
 import { Router } from 'express';
-import type { BaseClient, Client, TokenSet } from 'openid-client';
+import * as oidc from 'openid-client';
 import { UsersService } from '../../services/users.js';
 import type { AuthDriverOptions } from '../../types/index.js';
 import { BaseOAuthDriver, type UserPayload } from './baseoauth.js';
 export declare class OAuth2AuthDriver extends BaseOAuthDriver {
-    client: Client;
+    client: oidc.Configuration;
     redirectUrl: string;
     usersService: UsersService;
     config: Record<string, any>;
-    getClient(): Promise<BaseClient>;
+    getClient(): Promise<oidc.Configuration>;
     getredirectUrl(): string;
     getUserService(): UsersService;
     getConfig(): Record<string, any>;
     getClientName(): string;
     constructor(options: AuthDriverOptions, config: Record<string, any>);
-    generateAuthUrl(codeVerifier: string, prompt?: boolean): string;
-    getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[TokenSet, Record<string, unknown>, UserPayload]>;
+    generateAuthUrl(codeVerifier: string, prompt?: boolean): Promise<string>;
+    getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers, Record<string, unknown>, UserPayload]>;
 }
 export declare function createOAuth2AuthRouter(providerName: string): Router;

package/dist/auth/drivers/oauth2.js

@@ -2,9 +2,9 @@ import { BaseException } from '@wbce-d9/exceptions';
 import express, { Router } from 'express';
 import flatten from 'flat';
 import jwt from 'jsonwebtoken';
-import { Issuer, generators } from 'openid-client';
+import * as oidc from 'openid-client';
 import { getAuthProvider } from '../../auth.js';
-import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, OAUTH2_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
 import env from '../../env.js';
 import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException, InvalidPayloadException, } from '../../exceptions/index.js';
 import logger from '../../logger.js';
@@ -47,35 +47,31 @@ export class OAuth2AuthDriver extends BaseOAuthDriver {
         this.redirectUrl = redirectUrl.toString();
         this.usersService = new UsersService({ knex: this.knex, schema: this.schema });
         this.config = additionalConfig;
-        const issuer = new Issuer({
+        const clientOptionsOverrides = getConfigFromEnv(`AUTH_${config['provider'].toUpperCase()}_CLIENT_`, [`AUTH_${config['provider'].toUpperCase()}_CLIENT_ID`, `AUTH_${config['provider'].toUpperCase()}_CLIENT_SECRET`], 'underscore');
+        this.client = new oidc.Configuration({
             authorization_endpoint: authorizeUrl,
             token_endpoint: accessUrl,
             userinfo_endpoint: profileUrl,
             issuer: additionalConfig['provider'],
-        });
-        const clientOptionsOverrides = getConfigFromEnv(`AUTH_${config['provider'].toUpperCase()}_CLIENT_`, [`AUTH_${config['provider'].toUpperCase()}_CLIENT_ID`, `AUTH_${config['provider'].toUpperCase()}_CLIENT_SECRET`], 'underscore');
-        this.client = new issuer.Client({
-            client_id: clientId,
-            client_secret: clientSecret,
-            redirect_uris: [this.redirectUrl],
-            response_types: ['code'],
-            ...clientOptionsOverrides,
-        });
+        }, clientId, { client_secret: clientSecret, ...clientOptionsOverrides });
     }
-    generateAuthUrl(codeVerifier, prompt = false) {
+    async generateAuthUrl(codeVerifier, prompt = false) {
         try {
-            const codeChallenge = generators.codeChallenge(codeVerifier);
+            const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
             const paramsConfig = typeof this.config['params'] === 'object' ? this.config['params'] : {};
-            return this.client.authorizationUrl({
+            const params = {
                 scope: this.config['scope'] ?? 'email',
                 access_type: 'offline',
-                prompt: prompt ? 'consent' : undefined,
                 ...paramsConfig,
                 code_challenge: codeChallenge,
                 code_challenge_method: 'S256',
                 // Some providers require state even with PKCE
                 state: codeChallenge,
-            });
+            };
+            if (prompt) {
+                params['prompt'] = 'consent';
+            }
+            return oidc.buildAuthorizationUrl(this.client, params).href;
         }
         catch (e) {
             throw this.handleError(e);
@@ -85,8 +81,13 @@ export class OAuth2AuthDriver extends BaseOAuthDriver {
         let tokenSet;
         let userInfo;
         try {
-            tokenSet = await this.client.oauthCallback(this.redirectUrl, { code: payload['code'], state: payload['state'] }, { code_verifier: payload['codeVerifier'], state: generators.codeChallenge(payload['codeVerifier']) });
-            userInfo = await this.client.userinfo(tokenSet.access_token);
+            const codeChallenge = await oidc.calculatePKCECodeChallenge(payload['codeVerifier']);
+            const callbackUrl = new URL(payload['callbackPath'], this.redirectUrl);
+            tokenSet = await oidc.authorizationCodeGrant(this.client, callbackUrl, {
+                pkceCodeVerifier: payload['codeVerifier'],
+                expectedState: codeChallenge,
+            });
+            userInfo = await oidc.fetchUserInfo(this.client, tokenSet.access_token, oidc.skipSubjectCheck);
         }
         catch (e) {
             throw this.handleError(e);
@@ -115,7 +116,7 @@ export class OAuth2AuthDriver extends BaseOAuthDriver {
 }
 export function createOAuth2AuthRouter(providerName) {
     const router = Router();
-    router.get('/', (req, res) => {
+    router.get('/', asyncHandler(async (req, res) => {
         const provider = getAuthProvider(providerName);
         const codeVerifier = provider.generateCodeVerifier();
         const prompt = !!req.query['prompt'];
@@ -124,15 +125,12 @@ export function createOAuth2AuthRouter(providerName) {
             throw new InvalidPayloadException(`URL "${redirect}" can't be used to redirect after login`);
         }
         const token = jwt.sign({ verifier: codeVerifier, redirect, prompt }, env['SECRET'], {
-            expiresIn: '5m',
+            expiresIn: Math.floor(OAUTH2_COOKIE_OPTIONS.maxAge / 1000),
             issuer: 'directus',
         });
-        res.cookie(`oauth2.${providerName}`, token, {
-            httpOnly: true,
-            sameSite: 'lax',
-        });
-        return res.redirect(provider.generateAuthUrl(codeVerifier, prompt));
-    }, respond);
+        res.cookie(`oauth2.${providerName}`, token, OAUTH2_COOKIE_OPTIONS);
+        return res.redirect(await provider.generateAuthUrl(codeVerifier, prompt));
+    }), respond);
     router.post('/callback', express.urlencoded({ extended: false }), (req, res) => {
         res.redirect(303, `./callback?${new URLSearchParams(req.body)}`);
     }, respond);
@@ -164,8 +162,8 @@ export function createOAuth2AuthRouter(providerName) {
         });
         let authResponse;
         try {
-            res.clearCookie(`oauth2.${providerName}`);
             authResponse = await authenticationService.login(providerName, {
+                callbackPath: req.originalUrl,
                 code: req.query['code'],
                 codeVerifier: verifier,
                 state: req.query['state'],

package/dist/auth/drivers/openid.d.ts

@@ -1,20 +1,20 @@
 import { Router } from 'express';
-import type { AuthorizationParameters, BaseClient, Client, TokenSet } from 'openid-client';
+import * as oidc from 'openid-client';
 import { UsersService } from '../../services/users.js';
 import type { AuthDriverOptions } from '../../types/index.js';
 import { BaseOAuthDriver, type UserPayload } from './baseoauth.js';
 export declare class OpenIDAuthDriver extends BaseOAuthDriver {
-    client: Promise<Client>;
+    client: Promise<oidc.Configuration>;
     redirectUrl: string;
     usersService: UsersService;
     config: Record<string, any>;
-    getClient(): Promise<BaseClient>;
+    getClient(): Promise<oidc.Configuration>;
     getredirectUrl(): string;
     getUserService(): UsersService;
     getConfig(): Record<string, any>;
     getClientName(): string;
     constructor(options: AuthDriverOptions, config: Record<string, any>);
-    generateAuthUrl(codeVerifier: string, prompt?: boolean, additionalParams?: AuthorizationParameters | undefined): Promise<string>;
-    getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[TokenSet, Record<string, unknown>, UserPayload]>;
+    generateAuthUrl(codeVerifier: string, prompt?: boolean, additionalParams?: Record<string, string>): Promise<string>;
+    getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers, Record<string, unknown>, UserPayload]>;
 }
 export declare function createOpenIDAuthRouter(providerName: string): Router;

package/dist/auth/drivers/openid.js

@@ -2,9 +2,9 @@ import { BaseException } from '@wbce-d9/exceptions';
 import express, { Router } from 'express';
 import flatten from 'flat';
 import jwt from 'jsonwebtoken';
-import { Issuer, generators } from 'openid-client';
+import * as oidc from 'openid-client';
 import { getAuthProvider } from '../../auth.js';
-import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, OAUTH2_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
 import env from '../../env.js';
 import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException, InvalidPayloadException, } from '../../exceptions/index.js';
 import logger from '../../logger.js';
@@ -48,55 +48,48 @@ export class OpenIDAuthDriver extends BaseOAuthDriver {
         this.redirectUrl = redirectUrl.toString();
         this.usersService = new UsersService({ knex: this.knex, schema: this.schema });
         this.config = additionalConfig;
-        this.client = new Promise((resolve, reject) => {
-            Issuer.discover(issuerUrl)
-                .then((issuer) => {
-                const supportedTypes = issuer.metadata['response_types_supported'];
-                if (!supportedTypes?.includes('code')) {
-                    reject(new InvalidConfigException('OpenID provider does not support required code flow', {
-                        provider: additionalConfig['provider'],
-                    }));
-                }
-                resolve(new issuer.Client({
-                    client_id: clientId,
+        this.client = (async () => {
+            let config;
+            try {
+                config = await oidc.discovery(new URL(issuerUrl), clientId, {
                     client_secret: clientSecret,
-                    redirect_uris: [this.redirectUrl],
-                    response_types: ['code'],
                     ...clientOptionsOverrides,
-                }));
-            })
-                .catch((e) => {
+                });
+            }
+            catch (e) {
                 logger.error(e, '[OpenID] Failed to fetch provider config');
                 process.exit(1);
-            });
-        });
+            }
+            const supportedTypes = config.serverMetadata().response_types_supported;
+            if (supportedTypes && !supportedTypes.includes('code')) {
+                throw new InvalidConfigException('OpenID provider does not support required code flow', {
+                    provider: additionalConfig['provider'],
+                });
+            }
+            return config;
+        })();
     }
     async generateAuthUrl(codeVerifier, prompt = false, additionalParams) {
         try {
             const client = await this.client;
-            const codeChallenge = generators.codeChallenge(codeVerifier);
+            const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
             const paramsConfig = typeof this.config['params'] === 'object' ? this.config['params'] : {};
-            const redirectAfterLogin = additionalParams?.['redirect'];
-            delete additionalParams?.['redirect'];
-            let finalRedirectUri = this.redirectUrl;
-            if (redirectAfterLogin) {
-                const redirectUriWithParams = new URL(this.redirectUrl);
-                redirectUriWithParams.searchParams.set('redirect', redirectAfterLogin);
-                finalRedirectUri = redirectUriWithParams.toString();
-            }
-            return client.authorizationUrl({
+            const params = {
                 scope: this.config['scope'] ?? 'openid profile email',
                 access_type: 'offline',
-                prompt: prompt ? 'consent' : undefined,
                 ...paramsConfig,
                 code_challenge: codeChallenge,
                 code_challenge_method: 'S256',
                 // Some providers require state even with PKCE
                 state: codeChallenge,
                 nonce: codeChallenge,
-                redirect_uri: finalRedirectUri,
+                redirect_uri: this.redirectUrl,
                 ...additionalParams,
-            });
+            };
+            if (prompt) {
+                params.prompt = 'consent';
+            }
+            return oidc.buildAuthorizationUrl(client, params).href;
         }
         catch (e) {
             throw this.handleError(e);
@@ -107,19 +100,18 @@ export class OpenIDAuthDriver extends BaseOAuthDriver {
         let userInfo;
         try {
             const client = await this.client;
-            const codeChallenge = generators.codeChallenge(payload['codeVerifier']);
-            let finalRedirectUri = this.redirectUrl;
-            if (payload['redirect']) {
-                const redirectUriWithParams = new URL(this.redirectUrl);
-                redirectUriWithParams.searchParams.set('redirect', payload['redirect']);
-                finalRedirectUri = redirectUriWithParams.toString();
-            }
-            tokenSet = await client.callback(finalRedirectUri, { code: payload['code'], state: payload['state'], iss: payload['iss'] }, { code_verifier: payload['codeVerifier'], state: codeChallenge, nonce: codeChallenge });
-            userInfo = tokenSet.claims();
-            if (client.issuer.metadata['userinfo_endpoint']) {
+            const codeChallenge = await oidc.calculatePKCECodeChallenge(payload['codeVerifier']);
+            const callbackUrl = new URL(payload['callbackPath'], this.redirectUrl);
+            tokenSet = await oidc.authorizationCodeGrant(client, callbackUrl, {
+                pkceCodeVerifier: payload['codeVerifier'],
+                expectedState: codeChallenge,
+                expectedNonce: codeChallenge,
+            });
+            userInfo = (tokenSet.claims() ?? {});
+            if (client.serverMetadata().userinfo_endpoint) {
                 userInfo = {
                     ...userInfo,
-                    ...(await client.userinfo(tokenSet.access_token)),
+                    ...(await oidc.fetchUserInfo(client, tokenSet.access_token, tokenSet.claims()?.sub ?? oidc.skipSubjectCheck)),
                 };
             }
         }
@@ -159,19 +151,17 @@ export function createOpenIDAuthRouter(providerName) {
             throw new InvalidPayloadException(`URL "${redirect}" can't be used to redirect after login`);
         }
         const token = jwt.sign({ verifier: codeVerifier, redirect, prompt }, env['SECRET'], {
-            expiresIn: '5m',
+            expiresIn: Math.floor(OAUTH2_COOKIE_OPTIONS.maxAge / 1000),
             issuer: 'directus',
         });
-        const additionalParams = { ...req.query };
-        delete additionalParams['prompt'];
+        const additionalParams = Object.fromEntries(Object.entries(req.query)
+            .filter(([k, v]) => k !== 'prompt' && k !== 'redirect' && typeof v === 'string')
+            .map(([k, v]) => [k, v]));
         const authUrl = await provider.generateAuthUrl(codeVerifier, prompt, additionalParams);
         const urlParams = new URL(authUrl);
         const state = urlParams.searchParams.get('state');
         const cookieName = `openid.${providerName}.${state || ''}`;
-        res.cookie(cookieName, token, {
-            httpOnly: true,
-            sameSite: 'lax',
-        });
+        res.cookie(cookieName, token, OAUTH2_COOKIE_OPTIONS);
         return res.redirect(authUrl);
     }), respond);
     router.post('/callback', express.urlencoded({ extended: false }), (req, res) => {
@@ -214,13 +204,13 @@ export function createOpenIDAuthRouter(providerName) {
         });
         let authResponse;
         try {
-            res.clearCookie(cookieName);
             authResponse = await authenticationService.login(providerName, {
                 code: req.query['code'],
                 codeVerifier: verifier,
                 state: req.query['state'],
                 iss: req.query['iss'],
                 redirect: validRedirectUrl,
+                callbackPath: req.originalUrl,
             });
         }
         catch (error) {

package/dist/cli/utils/create-env/env-stub.liquid

@@ -307,8 +307,8 @@ EXTENSIONS_AUTO_RELOAD=false
 ####################################################################################################
 ### Email
 
-# Email address from which emails are sent ["no-reply@directus.io"]
-EMAIL_FROM="no-reply@directus.io"
+# Email address from which emails are sent
+EMAIL_FROM="no-reply@example.com"
 
 # What to use to send emails. One of
 # sendmail, smtp, mailgun, sendgrid, ses.

package/dist/constants.d.ts

@@ -13,6 +13,8 @@ export declare const REFRESH_COOKIE_CLEAR_OPTIONS: CookieOptions;
 export declare const GET_SET_HEADER: (cookieValue: string) => string;
 export declare const ACCESS_COOKIE_OPTIONS: CookieOptions;
 export declare const ACCESS_COOKIE_CLEAR_OPTIONS: CookieOptions;
+export declare const OAUTH2_COOKIE_OPTIONS: CookieOptions;
+export declare const OAUTH2_COOKIE_CLEAR_OPTIONS: CookieOptions;
 export declare const OAS_REQUIRED_SCHEMAS: string[];
 /** Formats from which transformation is supported */
 export declare const SUPPORTED_IMAGE_TRANSFORM_FORMATS: string[];

package/dist/constants.js

@@ -82,6 +82,20 @@ export const ACCESS_COOKIE_CLEAR_OPTIONS = (() => {
     delete rest.expires;
     return rest;
 })();
+export const OAUTH2_COOKIE_OPTIONS = {
+    httpOnly: true,
+    domain: env['OAUTH2_TOKEN_COOKIE_DOMAIN'] || env['ACCESS_TOKEN_COOKIE_DOMAIN'],
+    maxAge: getMilliseconds(env['OAUTH2_TOKEN_TTL']),
+    secure: (env['OAUTH2_TOKEN_COOKIE_SECURE'] || env['ACCESS_TOKEN_COOKIE_SECURE']) ?? false,
+    sameSite: env['OAUTH2_TOKEN_COOKIE_SAME_SITE'] || 'lax',
+    path: '/auth',
+};
+export const OAUTH2_COOKIE_CLEAR_OPTIONS = (() => {
+    const { ...rest } = ACCESS_COOKIE_OPTIONS;
+    delete rest.maxAge;
+    delete rest.expires;
+    return rest;
+})();
 export const OAS_REQUIRED_SCHEMAS = ['Diff', 'Schema', 'Query', 'x-metadata'];
 /** Formats from which transformation is supported */
 export const SUPPORTED_IMAGE_TRANSFORM_FORMATS = ['image/jpeg', 'image/png', 'image/webp', 'image/tiff', 'image/avif'];

package/dist/database/seeds/13-settings.yaml

@@ -7,7 +7,7 @@ columns:
     type: string
     length: 100
     nullable: false
-    default: 'Directus'
+    default: 'd9'
   project_url:
     type: string
     length: 255

package/dist/database/system-data/fields/files.yaml

@@ -63,6 +63,8 @@ fields:
       placeholder: $t:field_options.directus_files.filename_disk
     readonly: true
     width: half
+    special:
+      - system-only
 
   - field: filename_download
     interface: input

package/dist/database/system-data/fields/users.yaml

@@ -180,3 +180,6 @@ fields:
 
   - field: auth_data
     hidden: true
+    special:
+      - system-only
+      - conceal

package/dist/env.js

@@ -49,6 +49,10 @@ const allowedEnvironmentVars = [
     'REFRESH_TOKEN_COOKIE_SAME_SITE',
     'REFRESH_TOKEN_COOKIE_NAME',
     'REFRESH_TOKEN_OVERLAP_DURATION',
+    'OAUTH2_TOKEN_TTL',
+    'OAUTH2_TOKEN_COOKIE_DOMAIN',
+    'OAUTH2_TOKEN_COOKIE_SECURE',
+    'OAUTH2_TOKEN_COOKIE_SAME_SITE',
     'LOGIN_STALL_TIME',
     'PASSWORD_RESET_URL_ALLOW_LIST',
     'USER_INVITE_URL_ALLOW_LIST',
@@ -235,6 +239,7 @@ const defaults = {
     REFRESH_TOKEN_COOKIE_SAME_SITE: 'lax',
     REFRESH_TOKEN_COOKIE_NAME: 'directus_refresh_token',
     REFRESH_TOKEN_OVERLAP_DURATION: '10s',
+    OAUTH2_TOKEN_TTL: '1d',
     LOGIN_STALL_TIME: 500,
     SERVER_SHUTDOWN_TIMEOUT: 1000,
     ROOT_REDIRECT: './admin',

package/dist/exceptions/forbidden.js

@@ -7,7 +7,7 @@ export class ForbiddenException extends BaseException {
          * We currently don't show the reason for a forbidden exception in the API output, as that
          * has the potential to leak schema information (eg a "No permission" vs "No permission to files"
          * would leak that a thing called "files" exists.
-         * Ref https://github.com/LaWebcapsule/directus9/discussions/4368
+         * Ref https://github.com/LaWebcapsule/d9/discussions/4368
          */
     }
 }

package/dist/middleware/authenticate.js

@@ -51,7 +51,7 @@ export const handler = async (req, _res, next) => {
                 })
                     .from('directus_sessions AS s')
                     .leftJoin('directus_users AS u', 's.user', 'u.id')
-                    .where('s.token', payload.refresh_token)
+                    .where('s.session_id', payload.session_id)
                     .andWhere('s.expires', '>=', new Date())
                     .first();
                 if (!user) {

package/dist/middleware/cors.js

@@ -3,7 +3,7 @@ import env from '../env.js';
 let corsMiddleware = (_req, _res, next) => next();
 if (env['CORS_ENABLED'] === true) {
     corsMiddleware = cors({
-        origin: env['CORS_ORIGIN'] || true,
+        origin: env['CORS_ORIGIN'] || false,
         methods: env['CORS_METHODS'] || 'GET,POST,PATCH,DELETE',
         allowedHeaders: env['CORS_ALLOWED_HEADERS'],
         exposedHeaders: env['CORS_EXPOSED_HEADERS'],

package/dist/services/authentication.js

@@ -135,7 +135,7 @@ export class AuthenticationService {
             role: user.role,
             app_access: user.app_access,
             admin_access: user.admin_access,
-            refresh_token: refreshToken,
+            session_id: sessionId,
         };
         const customClaims = await emitter.emitFilter('auth.jwt', tokenPayload, {
             status: 'pending',
@@ -309,7 +309,7 @@ export class AuthenticationService {
             role: record.role_id,
             app_access: record.role_app_access,
             admin_access: record.role_admin_access,
-            refresh_token: newRefreshToken,
+            session_id: sessionId,
         };
         if (record.share_id) {
             tokenPayload.share = record.share_id;

package/dist/services/authorization.js

@@ -449,7 +449,13 @@ export class AuthorizationService {
                         const originalItems = await mainItemService.readMany(keys);
                         for (let i = 0; i < originalItems.length; i++) {
                             const originalItem = originalItems[i];
-                            const emptyItemsToAdd = originalItem[fieldKey].length - field.update?.length - field.delete?.length;
+                            const alreadyExistingItems = originalItem[fieldKey].length;
+                            const updatedItemsIds = field.update.map((f) => f.id);
+                            const deletedItemsIds = field.delete.map((f) => f?.id || f);
+                            const twoTimesCountedItems = originalItem[fieldKey].reduce((n, item) => {
+                                return n + Number(updatedItemsIds.includes(item) || deletedItemsIds.includes(item));
+                            }, 0);
+                            const emptyItemsToAdd = alreadyExistingItems - twoTimesCountedItems;
                             const finalArrayToValidate = arrayToValidate.concat(Array(emptyItemsToAdd).fill({}));
                             // validate partial items until the last key
                             if (i == keys.length - 1) {

package/dist/services/mail/index.js

@@ -72,7 +72,7 @@ export class MailService {
             .from('directus_settings')
             .first();
         return {
-            projectName: projectInfo?.project_name || 'Directus',
+            projectName: projectInfo?.project_name || 'd9',
             projectColor: projectInfo?.project_color || '#546e7a',
             projectLogo: getProjectLogoURL(projectInfo?.project_logo),
             projectUrl: projectInfo?.project_url || '',

package/dist/services/payload.js

@@ -105,6 +105,12 @@ export class PayloadService {
                 return new Date(helpers.date.writeTimestamp(new Date().toISOString()));
             return value;
         },
+        async 'system-only'({ value, accountability }) {
+            if (accountability && (value === null || value)) {
+                throw new ForbiddenException();
+            }
+            return value;
+        },
         async 'cast-csv'({ action, value }) {
             if (Array.isArray(value) === false && typeof value !== 'string')
                 return;

package/dist/services/shares.js

@@ -81,7 +81,7 @@ export class SharesService extends ItemsService {
                 item: record.share_item,
                 collection: record.share_collection,
             },
-            refresh_token: refreshToken,
+            session_id: sessionId,
         };
         const accessToken = jwt.sign(tokenPayload, env['SECRET'], {
             expiresIn: env['ACCESS_TOKEN_TTL'],

package/dist/services/tfa.js

@@ -31,7 +31,7 @@ export class TFAService {
         const project = await this.knex.select('project_name').from('directus_settings').limit(1).first();
         return {
             secret,
-            url: authenticator.keyuri(user.email, project?.project_name || 'Directus', secret),
+            url: authenticator.keyuri(user.email, project?.project_name || 'd9', secret),
         };
     }
     async enableTFA(key, otp, secret) {

package/dist/types/auth.d.ts

@@ -34,7 +34,7 @@ export type DirectusTokenPayload = {
         collection: string;
         item: string;
     };
-    refresh_token: string;
+    session_id: string;
 };
 export type ShareData = {
     share_id: string;

package/dist/utils/compress.d.ts

@@ -1,3 +1,4 @@
 /// <reference types="node" resolution-mode="require"/>
+/// <reference types="node" resolution-mode="require"/>
 export declare function compress(raw: Record<string, any> | Record<string, any>[]): Promise<Buffer>;
 export declare function decompress(compressed: Buffer): Promise<any>;

package/dist/utils/generate-hash.js

@@ -1,7 +1,7 @@
 import argon2 from 'argon2';
 import { getConfigFromEnv } from './get-config-from-env.js';
 export function generateHash(stringToHash) {
-    const argon2HashConfigOptions = getConfigFromEnv('HASH_', 'HASH_RAW'); // Disallow the HASH_RAW option, see https://github.com/LaWebcapsule/directus9/discussions/7670#discussioncomment-1255805
+    const argon2HashConfigOptions = getConfigFromEnv('HASH_', 'HASH_RAW'); // Disallow the HASH_RAW option, see https://github.com/LaWebcapsule/d9/discussions/7670#discussioncomment-1255805
     // associatedData, if specified, must be passed as a Buffer to argon2.hash, see https://github.com/ranisalt/node-argon2/wiki/Options#associateddata
     'associatedData' in argon2HashConfigOptions &&
         (argon2HashConfigOptions['associatedData'] = Buffer.from(argon2HashConfigOptions['associatedData']));

package/dist/utils/get-ip-from-req.js

@@ -13,5 +13,5 @@ export function getIPFromReq(req) {
         }
     }
     // IP addresses starting with ::ffff: are IPv4 addresses in IPv6 format. We can strip the prefix to get back to IPv4
-    return ip.startsWith('::ffff:') ? ip.substring(7) : ip;
+    return ip?.startsWith('::ffff:') ? ip.substring(7) : ip ?? '';
 }

package/dist/utils/jwt.js

@@ -21,9 +21,9 @@ export function verifyJWT(token, secret) {
     return payload;
 }
 export function verifyAccessJWT(token, secret) {
-    const { id, role, app_access, admin_access, share, share_scope, refresh_token } = verifyJWT(token, secret);
-    if (role === undefined || app_access === undefined || admin_access === undefined || refresh_token === undefined) {
+    const { id, role, app_access, admin_access, share, share_scope, session_id } = verifyJWT(token, secret);
+    if (role === undefined || app_access === undefined || admin_access === undefined || session_id === undefined) {
         throw new InvalidTokenException('Invalid token payload.');
     }
-    return { id, role, app_access, admin_access, share, share_scope, refresh_token };
+    return { id, role, app_access, admin_access, share, share_scope, session_id };
 }

package/dist/utils/parse-image-metadata.d.ts

@@ -1,3 +1,4 @@
 /// <reference types="node" resolution-mode="require"/>
+/// <reference types="node" resolution-mode="require"/>
 export declare function parseIptc(buffer: Buffer): Record<string, unknown>;
 export declare function parseXmp(buffer: Buffer): Record<string, unknown>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.2.0",
+  "version": "12.4.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -22,16 +22,16 @@
     "framework",
     "vue"
   ],
-  "homepage": "https://directus.io",
+  "homepage": "https://github.com/LaWebcapsule/d9",
   "bugs": {
-    "url": "https://github.com/LaWebcapsule/directus9/issues"
+    "url": "https://github.com/LaWebcapsule/d9/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/LaWebcapsule/directus9.git",
+    "url": "https://github.com/LaWebcapsule/d9.git",
     "directory": "api"
   },
-  "funding": "https://github.com/LaWebcapsule/directus9?sponsor=1",
+  "funding": "https://github.com/LaWebcapsule/d9?sponsor=1",
   "license": "GPL-3.0-only",
   "author": {
     "name": "Monospace Inc",
@@ -63,75 +63,77 @@
     "!**/__*__/"
   ],
   "dependencies": {
-    "@authenio/samlify-node-xmllint": "2.0.0",
-    "@aws-sdk/client-sesv2": "3.916.0",
-    "@godaddy/terminus": "4.12.0",
-    "@rollup/plugin-alias": "5.0.0",
     "@rollup/plugin-node-resolve": "15.0.2",
     "@rollup/plugin-virtual": "3.0.1",
     "@wbce-d9/format-title": "10.0.0",
-    "argon2": "0.30.3",
-    "async": "3.2.4",
     "axios": "^1.12.0",
+    "chalk": "5.2.0",
+    "commander": "10.0.1",
+    "date-fns": "2.29.3",
+    "execa": "7.1.1",
+    "express": "^4.21.2",
+    "fs-extra": "11.1.1",
+    "inquirer": "9.1.5",
+    "joi": "17.9.1",
+    "js-yaml": "4.1.1",
+    "json2csv": "5.0.7",
+    "knex": "3.1.0",
+    "lodash-es": "4.17.23",
+    "marked": "4.3.0",
+    "micromustache": "8.0.3",
+    "nanoid": "5.0.9",
+    "openapi3-ts": "3.2.0",
+    "ora": "6.3.0",
+    "pino": "8.11.0",
+    "rollup": "3.30.0",
+    "uuid": "9.0.0",
+    "wellknown": "0.5.0",
+    "@authenio/samlify-node-xmllint": "2.0.0",
+    "@aws-sdk/client-sesv2": "3.1004.0",
+    "@godaddy/terminus": "4.12.0",
+    "@rollup/plugin-alias": "5.0.0",
+    "argon2": "0.44.0",
+    "async": "3.2.4",
     "busboy": "1.6.0",
     "bytes": "3.1.2",
     "camelcase": "7.0.1",
-    "chalk": "5.2.0",
     "chokidar": "3.5.3",
-    "commander": "10.0.1",
     "content-disposition": "0.5.4",
     "cookie-parser": "1.4.7",
     "cors": "2.8.5",
     "csv-parser": "3.0.0",
-    "date-fns": "2.29.3",
     "deep-diff": "1.0.2",
     "destroy": "1.2.0",
     "dotenv": "16.0.3",
     "encodeurl": "1.0.2",
     "eventemitter2": "6.4.9",
-    "execa": "7.1.1",
     "exif-reader": "1.2.0",
-    "express": "^4.21.2",
     "fast-redact": "^3.5.0",
     "flat": "5.0.2",
-    "fs-extra": "11.1.1",
     "graphql": "16.8.1",
     "graphql-compose": "9.0.10",
     "helmet": "6.1.5",
     "icc": "3.0.0",
-    "inquirer": "9.1.5",
     "ioredis": "5.3.2",
     "isolated-vm": "^6.0.1",
-    "joi": "17.9.1",
-    "js-yaml": "4.1.1",
     "js2xmlparser": "5.0.0",
-    "json2csv": "5.0.7",
     "jsonwebtoken": "9.0.0",
     "keyv": "4.5.2",
-    "knex": "3.1.0",
     "ldapjs": "2.3.3",
     "liquidjs": "10.7.0",
-    "lodash-es": "4.17.23",
-    "marked": "4.3.0",
-    "micromustache": "8.0.3",
     "mime-types": "2.1.35",
     "ms": "2.1.3",
-    "nanoid": "5.0.9",
     "node-cron": "3.0.2",
     "node-machine-id": "1.1.12",
     "nodemailer": "7.0.11",
     "object-hash": "3.0.0",
-    "openapi3-ts": "3.2.0",
-    "openid-client": "5.4.0",
-    "ora": "6.3.0",
+    "openid-client": "6.8.2",
     "otplib": "12.0.1",
-    "pino": "8.11.0",
     "pino-http": "8.3.3",
     "pino-http-print": "3.1.0",
     "pino-pretty": "10.0.0",
-    "qs": "6.14.1",
+    "qs": "6.14.2",
     "rate-limiter-flexible": "2.4.1",
-    "rollup": "3.29.5",
     "samlify": "2.10.0",
     "sanitize-html": "2.12.1",
     "sharp": "0.32.6",
@@ -140,26 +142,39 @@
     "strip-bom-stream": "5.0.0",
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
-    "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
-    "wellknown": "0.5.0",
     "@wbce-d9/constants": "10.0.0",
-    "@wbce-d9/app": "9.35.1",
     "@wbce-d9/exceptions": "10.0.0",
     "@wbce-d9/extensions-sdk": "10.0.2",
+    "@wbce-d9/schema": "10.0.0",
     "@wbce-d9/specs": "9.26.5",
     "@wbce-d9/storage": "10.0.0",
+    "@wbce-d9/app": "10.0.0",
     "@wbce-d9/storage-driver-azure": "10.0.1",
-    "@wbce-d9/schema": "10.0.0",
+    "@wbce-d9/storage-driver-gcs": "10.0.1",
     "@wbce-d9/storage-driver-cloudinary": "10.0.1",
     "@wbce-d9/storage-driver-local": "10.0.1",
     "@wbce-d9/storage-driver-s3": "10.0.1",
-    "@wbce-d9/storage-driver-gcs": "10.0.1",
-    "@wbce-d9/update-check": "10.0.1",
-    "@wbce-d9/utils": "10.0.1"
+    "@wbce-d9/utils": "10.0.1",
+    "@wbce-d9/update-check": "10.0.1"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
+    "@types/fs-extra": "11.0.1",
+    "@types/inquirer": "9.0.3",
+    "@types/js-yaml": "4.0.5",
+    "@types/json2csv": "5.0.3",
+    "@types/lodash-es": "4.17.7",
+    "@types/marked": "4.0.8",
+    "@types/node": "22.15.29",
+    "@types/supertest": "2.0.12",
+    "@types/uuid": "9.0.1",
+    "@types/wellknown": "0.5.4",
+    "@vitest/coverage-v8": "4.1.0",
+    "@wbce-d9/tsconfig": "2.0.0",
+    "supertest": "6.3.3",
+    "typescript": "5.0.4",
+    "vitest": "4.1.0",
     "@types/async": "3.2.19",
     "@types/busboy": "1.5.0",
     "@types/bytes": "3.1.1",
@@ -170,40 +185,25 @@
     "@types/destroy": "1.0.0",
     "@types/encodeurl": "1.0.0",
     "@types/exif-reader": "1.0.0",
-    "@types/express": "4.17.17",
-    "@types/express-serve-static-core": "4.17.33",
+    "@types/express": "4.17.25",
+    "@types/express-serve-static-core": "4.19.8",
     "@types/fast-redact": "3.0.2",
     "@types/flat": "5.0.2",
-    "@types/fs-extra": "11.0.1",
-    "@types/inquirer": "9.0.3",
-    "@types/js-yaml": "4.0.5",
-    "@types/json2csv": "5.0.3",
     "@types/jsonwebtoken": "9.0.1",
     "@types/keyv": "4.2.0",
     "@types/ldapjs": "2.2.5",
-    "@types/lodash-es": "4.17.7",
-    "@types/marked": "4.0.8",
     "@types/mime-types": "2.1.1",
     "@types/ms": "0.7.31",
-    "@types/node": "18.15.13",
     "@types/node-cron": "3.0.7",
     "@types/nodemailer": "6.4.7",
     "@types/object-hash": "3.0.2",
-    "@types/qs": "6.9.7",
+    "@types/qs": "6.14.0",
     "@types/sanitize-html": "2.9.0",
     "@types/stream-json": "1.7.3",
-    "@types/supertest": "2.0.12",
-    "@types/uuid": "9.0.1",
     "@types/uuid-validate": "0.0.1",
-    "@types/wellknown": "0.5.4",
-    "@vitest/coverage-c8": "0.30.1",
-    "@wbce-d9/tsconfig": "2.0.0",
     "copyfiles": "2.4.1",
     "form-data": "4.0.4",
     "knex-mock-client": "3.0.2",
-    "supertest": "6.3.3",
-    "typescript": "5.0.4",
-    "vitest": "0.30.1",
     "@wbce-d9/types": "10.1.0"
   },
   "optionalDependencies": {