@wbce-d9/api 12.5.11 → 12.6.1

package/dist/auth/drivers/saml.js

@@ -116,6 +116,9 @@ export function createSAMLAuthRouter(providerName) {
     }));
     router.post('/acs', express.urlencoded({ extended: false }), asyncHandler(async (req, res, next) => {
         const relayState = req.body?.RelayState;
+        if (isRedirectAllowedOnLogin(relayState, providerName) === false) {
+            throw new InvalidPayloadException(`URL "${relayState}" can't be used to redirect after login`);
+        }
         try {
             const { sp, idp } = getAuthProvider(providerName);
             const { extract } = await sp.parseLoginResponse(idp, 'post', {

package/dist/env.js

@@ -61,6 +61,7 @@ const allowedEnvironmentVars = [
     'IP_CUSTOM_HEADER',
     'ASSETS_CONTENT_SECURITY_POLICY',
     'IMPORT_IP_DENY_LIST',
+    'IMPORT_FILE_IP_ALLOW_LIST',
     'CONTENT_SECURITY_POLICY_.+',
     'HSTS_.+',
     'CROSS_ORIGIN_OPENER_POLICY',
@@ -284,6 +285,7 @@ const defaults = {
     IP_TRUST_PROXY: true,
     IP_CUSTOM_HEADER: false,
     IMPORT_IP_DENY_LIST: ['0.0.0.0', '169.254.169.254'],
+    IMPORT_FILE_IP_ALLOW_LIST: [],
     CROSS_ORIGIN_OPENER_POLICY: 'same-origin',
     SERVE_APP: true,
     SERVE_GRAPHQL: true,
@@ -308,6 +310,7 @@ const typeMap = {
     DB_EXCLUDE_TABLES: 'array',
     CACHE_SKIP_ALLOWED: 'boolean',
     IMPORT_IP_DENY_LIST: 'array',
+    IMPORT_FILE_IP_ALLOW_LIST: 'array',
     FILE_METADATA_ALLOW_LIST: 'array',
     SERVE_GRAPHQL: 'boolean',
     GRAPHQL_INTROSPECTION: 'boolean',

package/dist/flows.d.ts

@@ -15,6 +15,11 @@ declare class FlowManager {
     runOperationFlow(id: string, data: unknown, context: Record<string, unknown>): Promise<unknown>;
     runWebhookFlow(id: string, data: unknown, context: Record<string, unknown>): Promise<unknown>;
     private load;
+    /**
+     * Manual flows act on behalf of the triggering user: make sure that user can see the flow itself
+     * and read the collection / items passed in the payload before running it.
+     */
+    private checkManualTriggerAccess;
     private unload;
     private executeFlow;
     private executeOperation;

package/dist/flows.js

@@ -197,13 +197,16 @@ class FlowManager {
                         logger.warn(`Specified collection must be one of: ${enabledCollections.join(', ')}.`);
                         throw new exceptions.ForbiddenException();
                     }
-                    if (flow.options['async']) {
-                        this.executeFlow(flow, data, context);
-                        return undefined;
-                    }
-                    else {
-                        return this.executeFlow(flow, data, context);
-                    }
+                    const run = () => {
+                        if (flow.options['async']) {
+                            this.executeFlow(flow, data, context);
+                            return undefined;
+                        }
+                        else {
+                            return this.executeFlow(flow, data, context);
+                        }
+                    };
+                    return this.checkManualTriggerAccess(flow, targetCollection, data, context).then(run);
                 };
                 // Default return to $last for manual
                 flow.options['return'] = '$last';
@@ -212,6 +215,34 @@ class FlowManager {
         }
         this.isLoaded = true;
     }
+    /**
+     * Manual flows act on behalf of the triggering user: make sure that user can see the flow itself
+     * and read the collection / items passed in the payload before running it.
+     */
+    async checkManualTriggerAccess(flow, collection, data, context) {
+        const accountability = context['accountability'];
+        if (!accountability)
+            throw new exceptions.ForbiddenException();
+        if (accountability.admin)
+            return;
+        const database = context['database'] ?? getDatabase();
+        const schema = context['schema'] ?? (await getSchema({ database }));
+        const flowsService = new FlowsService({ accountability, knex: database, schema });
+        await flowsService.readOne(flow.id, { fields: ['id'] });
+        const keys = data?.['body']?.keys;
+        if (keys === null || keys === undefined || (Array.isArray(keys) && keys.length === 0)) {
+            if (flow.options?.['requireSelection'] !== false)
+                throw new exceptions.ForbiddenException();
+            const canReadCollection = accountability.permissions?.some((permission) => permission.collection === collection && permission.action === 'read');
+            if (!canReadCollection)
+                throw new exceptions.ForbiddenException();
+            return;
+        }
+        if (!Array.isArray(keys))
+            throw new exceptions.ForbiddenException();
+        const authorizationService = new services.AuthorizationService({ accountability, knex: database, schema });
+        await authorizationService.checkAccess('read', collection, keys);
+    }
     async unload() {
         for (const trigger of this.triggerHandlers) {
             trigger.events.forEach((event) => {

package/dist/request/index.d.ts

@@ -1,5 +1,27 @@
+/// <reference types="node" resolution-mode="require"/>
 import type { AxiosInstance } from 'axios';
+import { RequestFilteringHttpAgent, RequestFilteringHttpsAgent } from 'request-filtering-agent';
 export declare const _cache: {
     axiosInstance: AxiosInstance | null;
 };
 export declare function getAxios(): Promise<AxiosInstance>;
+/**
+ * Request config for file imports, where the URL is user-provided: only public IP addresses (or those in
+ * IMPORT_FILE_IP_ALLOW_LIST) are allowed, checked on every connection (including redirects).
+ * request-filtering-agent skips its deny list for addresses in its allow list, so IMPORT_IP_DENY_LIST is checked again
+ * on every DNS lookup and redirect to make sure it always takes precedence over IMPORT_FILE_IP_ALLOW_LIST
+ */
+export declare const importRequestConfig: () => {
+    maxRedirects: number;
+    httpAgent: RequestFilteringHttpAgent;
+    httpsAgent: RequestFilteringHttpsAgent;
+    lookup: (hostname: string, options: object) => Promise<[import("dns").LookupAddress[]]>;
+    beforeRedirect: (options: Record<string, any>, responseDetails: {
+        headers: Record<string, string>;
+        statusCode: import("axios").HttpStatusCode;
+    }, requestDetails: {
+        headers: Record<string, string>;
+        url: string;
+        method: string;
+    }) => void;
+};

package/dist/request/index.js

@@ -1,5 +1,10 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { RequestFilteringHttpAgent, RequestFilteringHttpsAgent } from 'request-filtering-agent';
+import { getEnv } from '../env.js';
 import { requestInterceptor } from './request-interceptor.js';
 import { responseInterceptor } from './response-interceptor.js';
+import { validateIP } from './validate-ip.js';
 export const _cache = {
     axiosInstance: null,
 };
@@ -12,3 +17,35 @@ export async function getAxios() {
     }
     return _cache.axiosInstance;
 }
+const denyListLookup = async (hostname, options) => {
+    const addresses = await lookup(hostname, { ...options, all: true });
+    for (const { address } of addresses) {
+        validateIP(address, hostname);
+    }
+    return [addresses];
+};
+// IP addresses in the redirect URL are connected to without DNS lookup
+const denyListBeforeRedirect = ({ hostname, href }) => {
+    if (isIP(hostname) !== 0)
+        validateIP(hostname, href);
+};
+/**
+ * Request config for file imports, where the URL is user-provided: only public IP addresses (or those in
+ * IMPORT_FILE_IP_ALLOW_LIST) are allowed, checked on every connection (including redirects).
+ * request-filtering-agent skips its deny list for addresses in its allow list, so IMPORT_IP_DENY_LIST is checked again
+ * on every DNS lookup and redirect to make sure it always takes precedence over IMPORT_FILE_IP_ALLOW_LIST
+ */
+export const importRequestConfig = () => {
+    const env = getEnv();
+    const options = {
+        denyIPAddressList: env['IMPORT_IP_DENY_LIST'],
+        allowIPAddressList: env['IMPORT_FILE_IP_ALLOW_LIST'],
+    };
+    return {
+        maxRedirects: 5,
+        httpAgent: new RequestFilteringHttpAgent(options),
+        httpsAgent: new RequestFilteringHttpsAgent(options),
+        lookup: denyListLookup,
+        beforeRedirect: denyListBeforeRedirect,
+    };
+};

package/dist/request/request-interceptor.js

@@ -21,6 +21,6 @@ export const requestInterceptor = async (config) => {
     else {
         ip = hostname;
     }
-    await validateIP(ip, uri);
+    validateIP(ip, uri);
     return config;
 };

package/dist/request/response-interceptor.js

@@ -1,5 +1,5 @@
 import { validateIP } from './validate-ip.js';
 export const responseInterceptor = async (config) => {
-    await validateIP(config.request.socket.remoteAddress, config.request.url);
+    validateIP(config.request.socket.remoteAddress, config.request.url);
     return config;
 };

package/dist/request/validate-ip.d.ts

@@ -1 +1 @@
-export declare const validateIP: (ip: string, url: string) => Promise<void>;
+export declare const validateIP: (ip: string, url: string) => void;

package/dist/request/validate-ip.js

@@ -1,8 +1,8 @@
-import { BlockList } from 'net';
+import { BlockList, isIP } from 'net';
 import os from 'node:os';
 import { getEnv } from '../env.js';
 import logger from '../logger.js';
-export const validateIP = async (ip, url) => {
+export const validateIP = (ip, url) => {
     const env = getEnv();
     const ipDenyList = env['IMPORT_IP_DENY_LIST'] || [];
     // Create a BlockList for efficient IP range checking
@@ -53,7 +53,7 @@ export const validateIP = async (ip, url) => {
                             logger.warn(`Warning: Invalid prefix length in CIDR "${info.cidr}"`);
                             continue;
                         }
-                        blockList.addSubnet(network, prefixLength);
+                        blockList.addSubnet(network, prefixLength, isIP(network) === 6 ? 'ipv6' : 'ipv4');
                     }
                     catch (error) {
                         // Log but don't fail for invalid local interface CIDR
@@ -64,7 +64,7 @@ export const validateIP = async (ip, url) => {
         }
     }
     // Check if the IP is blocked
-    if (blockList.check(ip)) {
+    if (blockList.check(ip, isIP(ip) === 6 ? 'ipv6' : 'ipv4')) {
         throw new Error(`Requested URL "${url}" resolves to a denied IP address`);
     }
 };

package/dist/services/fields.js

@@ -458,6 +458,18 @@ export class FieldsService {
                 if (Object.keys(collectionMetaUpdates).length > 0) {
                     await trx('directus_collections').update(collectionMetaUpdates).where({ collection });
                 }
+                const permissions = await trx('directus_permissions')
+                    .select('id', 'fields')
+                    .where({ collection });
+                for (const permission of permissions) {
+                    const permittedFields = permission.fields?.split(',') ?? [];
+                    if (permittedFields.includes(field) === false)
+                        continue;
+                    const remainingFields = permittedFields.filter((permittedField) => permittedField !== field);
+                    await trx('directus_permissions')
+                        .update({ fields: remainingFields.length > 0 ? remainingFields.join(',') : null })
+                        .where({ id: permission.id });
+                }
                 // Cleanup directus_fields
                 const metaRow = await trx
                     .select('collection', 'field')

package/dist/services/files.js

@@ -14,7 +14,7 @@ import emitter from '../emitter.js';
 import env from '../env.js';
 import { ForbiddenException, InvalidPayloadException, ServiceUnavailableException } from '../exceptions/index.js';
 import logger from '../logger.js';
-import { getAxios } from '../request/index.js';
+import { getAxios, importRequestConfig } from '../request/index.js';
 import { getStorage } from '../storage/index.js';
 import { parseIptc, parseXmp } from '../utils/parse-image-metadata.js';
 import { ItemsService } from './items.js';
@@ -216,6 +216,7 @@ export class FilesService extends ItemsService {
             const axios = await getAxios();
             fileResponse = await axios.get(encodeURL(importURL), {
                 responseType: 'stream',
+                ...importRequestConfig(),
             });
         }
         catch (err) {

package/dist/services/payload.js

@@ -35,6 +35,9 @@ export class PayloadService {
             if (action === 'create' || action === 'update') {
                 return await generateHash(String(value));
             }
+            // Same as conceal
+            if (action === 'read')
+                return '**********';
             return value;
         },
         async uuid({ action, value }) {

package/dist/services/specifications.js

@@ -62,7 +62,8 @@ class OASSpecsService {
             info: {
                 title: 'Dynamic API Specification',
                 description: 'This is a dynamically generated API specification for all endpoints existing on the current project.',
-                version: version,
+                // Only admins see the real version, as on /server/info
+                version: this.accountability?.admin ? version : '0.0.0-hidden',
             },
             servers: [
                 {

package/dist/utils/apply-query.d.ts

@@ -32,4 +32,4 @@ export declare function applyFilter(knex: Knex, schema: SchemaOverview, rootQuer
 };
 export declare function addWhereClauses(knex: Knex, schema: SchemaOverview, dbQuery: Knex.QueryBuilder, filter: Filter, collection: string, aliasMap: AliasMap, logical?: 'and' | 'or'): void;
 export declare function applySearch(schema: SchemaOverview, dbQuery: Knex.QueryBuilder, searchQuery: string, collection: string): Promise<void>;
-export declare function applyAggregate(dbQuery: Knex.QueryBuilder, aggregate: Aggregate, collection: string): void;
+export declare function applyAggregate(schema: SchemaOverview, dbQuery: Knex.QueryBuilder, aggregate: Aggregate, collection: string): void;

package/dist/utils/apply-query.js

@@ -33,7 +33,7 @@ export default function applyQuery(knex, collection, dbQuery, query, schema, opt
         dbQuery.groupBy(query.group.map((column) => getColumn(knex, collection, column, false, schema)));
     }
     if (query.aggregate) {
-        applyAggregate(dbQuery, query.aggregate, collection);
+        applyAggregate(schema, dbQuery, query.aggregate, collection);
     }
     if (query.filter) {
         hasMultiRelationalFilter = applyFilter(knex, schema, dbQuery, query.filter, collection, aliasMap).hasMultiRelationalFilter;
@@ -166,6 +166,9 @@ export function applySort(knex, schema, rootQuery, rootSort, collection, aliasMa
     rootQuery.orderBy(sortRecords);
     return undefined;
 }
+function isConcealedField(schema, collection, field) {
+    return schema.collections[collection]?.fields[stripFunction(field)]?.special.includes('conceal') ?? false;
+}
 export function applyLimit(knex, rootQuery, limit) {
     if (typeof limit === 'number') {
         getHelpers(knex).schema.applyLimit(rootQuery, limit);
@@ -480,6 +483,8 @@ export async function applySearch(schema, dbQuery, searchQuery, collection) {
     const fields = Object.entries(schema.collections[collection].fields);
     dbQuery.andWhere(function () {
         fields.forEach(([name, field]) => {
+            if (field.special.includes('conceal'))
+                return;
             if (['text', 'string'].includes(field.type)) {
                 this.orWhereRaw(`LOWER(??) LIKE ?`, [`${collection}.${name}`, `%${searchQuery.toLowerCase()}%`]);
             }
@@ -494,11 +499,14 @@ export async function applySearch(schema, dbQuery, searchQuery, collection) {
         });
     });
 }
-export function applyAggregate(dbQuery, aggregate, collection) {
+export function applyAggregate(schema, dbQuery, aggregate, collection) {
     for (const [operation, fields] of Object.entries(aggregate)) {
         if (!fields)
             continue;
         for (const field of fields) {
+            if (!operation.startsWith('count') && isConcealedField(schema, collection, field)) {
+                throw new InvalidQueryException(`Field with "conceal" special does not allow the "${operation}" aggregate function`);
+            }
             if (operation === 'avg') {
                 dbQuery.avg(`${collection}.${field}`, { as: `avg->${field}` });
             }

package/dist/utils/package.d.ts

@@ -1,3 +1,3 @@
 declare const name: string, version: string;
-declare const mainVersion: any;
+declare const mainVersion: string;
 export { name, version, mainVersion };

package/dist/utils/package.js

@@ -4,6 +4,18 @@ import { fileURLToPath } from 'node:url';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const apiPkgPath = resolve(__dirname, '../../package.json');
 const { name, version } = JSON.parse(readFileSync(apiPkgPath, 'utf8'));
-const mainPkgPath = resolve(dirname(apiPkgPath), '../../../../../../package.json');
-const mainVersion = existsSync(mainPkgPath) ? JSON.parse(readFileSync(mainPkgPath, 'utf8')).version : null;
+function pkgVersion(path) {
+    try {
+        return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')).version ?? null : null;
+    }
+    catch {
+        return null;
+    }
+}
+// d9 release version (the bundle, matching the Docker image tag): dev-checkout root, then the
+// installed bundle (published/projen image), then the api version as a last resort.
+const mainVersion = pkgVersion(resolve(dirname(apiPkgPath), '../../../../../../package.json')) ??
+    pkgVersion(resolve(process.cwd(), 'node_modules/@wbce-d9/directus9/package.json')) ??
+    pkgVersion(resolve(process.cwd(), 'node_modules/directus9/package.json')) ??
+    version;
 export { name, version, mainVersion };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.5.11",
+  "version": "12.6.1",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -85,6 +85,7 @@
     "openapi3-ts": "3.2.0",
     "ora": "6.3.0",
     "pino": "8.11.0",
+    "request-filtering-agent": "3.2.1",
     "rollup": "3.30.0",
     "uuid": "14.0.0",
     "wellknown": "0.5.0",
@@ -143,20 +144,20 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
+    "@wbce-d9/app": "11.1.0",
     "@wbce-d9/constants": "10.0.0",
-    "@wbce-d9/app": "11.0.0",
-    "@wbce-d9/exceptions": "10.0.0",
-    "@wbce-d9/specs": "9.26.5",
+    "@wbce-d9/exceptions": "10.0.1",
     "@wbce-d9/schema": "10.0.0",
     "@wbce-d9/storage": "10.0.0",
-    "@wbce-d9/storage-driver-gcs": "10.0.3",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.4",
-    "@wbce-d9/storage-driver-azure": "10.0.3",
-    "@wbce-d9/storage-driver-local": "10.0.3",
-    "@wbce-d9/storage-driver-s3": "10.0.3",
-    "@wbce-d9/extensions-sdk": "10.0.4",
+    "@wbce-d9/specs": "9.26.5",
+    "@wbce-d9/storage-driver-azure": "10.0.4",
+    "@wbce-d9/storage-driver-cloudinary": "10.0.5",
+    "@wbce-d9/extensions-sdk": "10.0.5",
+    "@wbce-d9/storage-driver-local": "10.0.4",
+    "@wbce-d9/storage-driver-gcs": "10.0.4",
+    "@wbce-d9/storage-driver-s3": "10.0.4",
     "@wbce-d9/update-check": "10.0.4",
-    "@wbce-d9/utils": "10.0.3"
+    "@wbce-d9/utils": "10.0.4"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",