@wbce-d9/api 12.5.4 → 12.5.5

package/dist/auth/drivers/local.d.ts

@@ -1,9 +1,47 @@
 import { Router } from 'express';
-import type { User } from '../../types/index.js';
+import type { PrimaryKey, User } from '../../types/index.js';
 import { AuthDriver } from '../auth.js';
 export declare class LocalAuthDriver extends AuthDriver {
     getUserID(payload: Record<string, any>): Promise<string>;
     verify(user: User, password?: string): Promise<void>;
     login(user: User, payload: Record<string, any>): Promise<void>;
+    private getRegistrationService;
+    private getAccountByEmail;
+    /**
+     * Build the confirmation link handed to a freshly registered user.
+     *
+     * Without a `verification_url` the link points back at this provider's own verify route, so the
+     * endpoint works with no frontend at all. With one, the token is appended to the caller's page,
+     * which is expected to forward it here.
+     */
+    private registerUrl;
+    /**
+     * When was the last confirmation mail for this pending account sent, if ever.
+     */
+    private lastMailSentAt;
+    /**
+     * Public self-service registration for this provider.
+     *
+     * The account is created `draft`, and d9 won't issue a token for a draft user, so nothing is
+     * reachable until the emailed link is redeemed by `verifyEmail`. An address that already has a
+     * non-draft account is ignored silently — the caller can't tell the two cases apart. An account
+     * still awaiting confirmation has its mail re-sent, which is how a client implements "resend"
+     * without a second route.
+     */
+    registerUser(provider: string, input: {
+        email: string;
+        password: string;
+        first_name?: string | null;
+        last_name?: string | null;
+        verification_url?: string | null;
+    }): Promise<void>;
+    /**
+     * Redeem a registration token and activate the account. Returns the user id so the route can
+     * redirect to it.
+     *
+     * A token whose account is no longer `draft` — a link clicked twice, or an account since
+     * suspended — is reported as invalid rather than replayed.
+     */
+    verifyEmail(provider: string, token: string): Promise<PrimaryKey>;
 }
 export declare function createLocalAuthRouter(provider: string): Router;

package/dist/auth/drivers/local.js

@@ -1,16 +1,33 @@
+import { parseJSON } from '@wbce-d9/utils';
 import argon2 from 'argon2';
 import { Router } from 'express';
 import Joi from 'joi';
+import jwt from 'jsonwebtoken';
 import { performance } from 'perf_hooks';
 import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
+import getDatabase from '../../database/index.js';
+import emitter from '../../emitter.js';
 import env from '../../env.js';
-import { InvalidCredentialsException, InvalidPayloadException } from '../../exceptions/index.js';
+import { ForbiddenException, InvalidCredentialsException, InvalidPayloadException, InvalidTokenException, } from '../../exceptions/index.js';
+import logger from '../../logger.js';
 import { respond } from '../../middleware/respond.js';
 import { AuthenticationService } from '../../services/authentication.js';
+import { MailService } from '../../services/mail/index.js';
+import { UsersService } from '../../services/users.js';
 import asyncHandler from '../../utils/async-handler.js';
+import { getConfigFromEnv } from '../../utils/get-config-from-env.js';
 import { getIPFromReq } from '../../utils/get-ip-from-req.js';
+import isUrlAllowed from '../../utils/is-url-allowed.js';
+import { verifyJWT } from '../../utils/jwt.js';
 import { stall } from '../../utils/stall.js';
+import { Url } from '../../utils/url.js';
 import { AuthDriver } from '../auth.js';
+/**
+ * Shortest gap between two confirmation mails for the same pending account. Without it, replaying
+ * `/register` for an address that is still awaiting confirmation would send a mail every time,
+ * which turns the endpoint into a way to flood a stranger's inbox.
+ */
+const REGISTER_MAIL_INTERVAL = 60000;
 export class LocalAuthDriver extends AuthDriver {
     async getUserID(payload) {
         if (!payload['email']) {
@@ -34,9 +51,142 @@ export class LocalAuthDriver extends AuthDriver {
     async login(user, payload) {
         await this.verify(user, payload['password']);
     }
+    getRegistrationService() {
+        // Registration is requested by an anonymous visitor, so the permission checks on the write
+        // have nothing to check against.
+        return new UsersService({
+            knex: this.knex,
+            schema: this.schema,
+            accountability: { role: null, admin: true },
+        });
+    }
+    async getAccountByEmail(email) {
+        return this.knex
+            .select('id', 'status', 'provider', 'auth_data')
+            .from('directus_users')
+            .whereRaw('LOWER(??) = ?', ['email', email.toLowerCase()])
+            .first();
+    }
+    /**
+     * Build the confirmation link handed to a freshly registered user.
+     *
+     * Without a `verification_url` the link points back at this provider's own verify route, so the
+     * endpoint works with no frontend at all. With one, the token is appended to the caller's page,
+     * which is expected to forward it here.
+     */
+    registerUrl(provider, email, url) {
+        const payload = { email, scope: 'register', provider };
+        const token = jwt.sign(payload, env['SECRET'], { expiresIn: '1d', issuer: 'directus' });
+        const verifyUrl = url
+            ? new Url(url)
+            : new Url(env['PUBLIC_URL']).addPath('auth', 'login', provider, 'register', 'verify-email');
+        verifyUrl.setQuery('token', token);
+        return verifyUrl.toString();
+    }
+    /**
+     * When was the last confirmation mail for this pending account sent, if ever.
+     */
+    lastMailSentAt(authData) {
+        let data = authData;
+        if (typeof data === 'string') {
+            try {
+                data = parseJSON(data);
+            }
+            catch {
+                return 0;
+            }
+        }
+        const sentAt = data?.['registerMailSentAt'];
+        return sentAt ? Date.parse(sentAt) || 0 : 0;
+    }
+    /**
+     * Public self-service registration for this provider.
+     *
+     * The account is created `draft`, and d9 won't issue a token for a draft user, so nothing is
+     * reachable until the emailed link is redeemed by `verifyEmail`. An address that already has a
+     * non-draft account is ignored silently — the caller can't tell the two cases apart. An account
+     * still awaiting confirmation has its mail re-sent, which is how a client implements "resend"
+     * without a second route.
+     */
+    async registerUser(provider, input) {
+        // Read here rather than held on the instance: this class is the base of the SSO drivers,
+        // which declare a `config` of their own.
+        const config = getConfigFromEnv(`AUTH_${provider.toUpperCase()}_`);
+        const url = input.verification_url ?? null;
+        if (url && isUrlAllowed(url, config['registerUrlAllowList']) === false) {
+            throw new InvalidPayloadException(`Url "${url}" can't be used to verify registrations.`);
+        }
+        const service = this.getRegistrationService();
+        const existing = await this.getAccountByEmail(input.email);
+        if (existing && (existing.status !== 'draft' || existing.provider.toLowerCase() !== provider.toLowerCase())) {
+            // Already confirmed, suspended/archived, or registered against a different provider.
+            // Send nothing, reveal nothing.
+            return;
+        }
+        if (existing && Date.now() - this.lastMailSentAt(existing.auth_data) < REGISTER_MAIL_INTERVAL) {
+            return;
+        }
+        // Not typed as `Partial<User>`: the type lists active|suspended|invited, while the schema also
+        // allows draft and archived (`system-data/fields/users.yaml:116`).
+        const userPayload = {
+            email: input.email,
+            password: input.password,
+            first_name: input.first_name ?? null,
+            last_name: input.last_name ?? null,
+            role: config['defaultRoleId'] ?? null,
+            status: 'draft',
+            // Login checks the user's provider against the one being logged in with
+            // (`services/authentication.ts:116`), so the column default would lock out anyone
+            // registered against a named local provider.
+            provider,
+        };
+        if (!existing) {
+            // Run hook so the end user has the chance to augment the
+            // user that is about to be created
+            const updatedUserPayload = await emitter.emitFilter(`auth.create`, userPayload, { identifier: input.email, provider, providerPayload: {} }, { database: getDatabase(), schema: this.schema, accountability: null });
+            await service.createOne(updatedUserPayload);
+        }
+        const account = existing ?? (await this.getAccountByEmail(input.email));
+        if (!account)
+            return;
+        const mailService = new MailService({ knex: this.knex, schema: this.schema });
+        await mailService.send({
+            to: input.email,
+            subject: 'Please confirm your email address',
+            template: {
+                name: 'user-registration',
+                data: {
+                    url: this.registerUrl(provider, input.email, url),
+                    email: input.email,
+                },
+            },
+        });
+        await service.updateOne(account.id, {
+            auth_data: JSON.stringify({ registerMailSentAt: new Date().toISOString() }),
+        });
+    }
+    /**
+     * Redeem a registration token and activate the account. Returns the user id so the route can
+     * redirect to it.
+     *
+     * A token whose account is no longer `draft` — a link clicked twice, or an account since
+     * suspended — is reported as invalid rather than replayed.
+     */
+    async verifyEmail(provider, token) {
+        const { email, scope, provider: tokenProvider, } = verifyJWT(token, env['SECRET']);
+        if (scope !== 'register' || tokenProvider !== provider)
+            throw new ForbiddenException();
+        const account = await this.getAccountByEmail(email);
+        if (account?.status !== 'draft' || account.provider.toLowerCase() !== provider.toLowerCase()) {
+            throw new InvalidTokenException('Token invalid.');
+        }
+        await this.getRegistrationService().updateOne(account.id, { status: 'active', auth_data: null });
+        return account.id;
+    }
 }
 export function createLocalAuthRouter(provider) {
     const router = Router();
+    const config = getConfigFromEnv(`AUTH_${provider.toUpperCase()}_`);
     const userLoginSchema = Joi.object({
         email: Joi.string().email().required(),
         password: Joi.string().required(),
@@ -80,5 +230,46 @@ export function createLocalAuthRouter(provider) {
         res.locals['payload'] = payload;
         return next();
     }), respond);
+    // The registration routes only exist where the provider is configured for it, so an instance
+    // that hasn't opted in doesn't expose them at all.
+    if (config['allowPublicRegistration']) {
+        const userRegisterSchema = Joi.object({
+            email: Joi.string().email().required(),
+            password: Joi.string().required(),
+            first_name: Joi.string().allow(null, ''),
+            last_name: Joi.string().allow(null, ''),
+            verification_url: Joi.string().uri(),
+        });
+        router.post('/register', asyncHandler(async (req, res) => {
+            const { error } = userRegisterSchema.validate(req.body);
+            if (error)
+                throw new InvalidPayloadException(error.message);
+            const driver = new LocalAuthDriver({ knex: getDatabase(), schema: req.schema }, config);
+            // Answer before doing any work. The response must not vary — in content or in timing —
+            // with whether the address is already registered, or the endpoint becomes a way to
+            // enumerate accounts.
+            res.status(204).end();
+            try {
+                await driver.registerUser(provider, {
+                    email: req.body.email,
+                    password: req.body.password,
+                    first_name: req.body.first_name ?? null,
+                    last_name: req.body.last_name ?? null,
+                    verification_url: req.body.verification_url ?? null,
+                });
+            }
+            catch (err) {
+                logger.warn(err, `[register] Failed to register user for provider "${provider}"`);
+            }
+        }));
+        router.get('/register/verify-email', asyncHandler(async (req, res) => {
+            if (!req.query['token'] || typeof req.query['token'] !== 'string') {
+                throw new InvalidPayloadException(`"token" query parameter is required`);
+            }
+            const driver = new LocalAuthDriver({ knex: getDatabase(), schema: req.schema }, config);
+            const pk = await driver.verifyEmail(provider, req.query['token']);
+            return res.redirect(new Url(env['PUBLIC_URL']).addPath('admin', 'users', String(pk)).toString());
+        }));
+    }
     return router;
 }

package/dist/env.js

@@ -140,6 +140,7 @@ const allowedEnvironmentVars = [
     'AUTH_.+_LAST_NAME_KEY',
     'AUTH_.+_ALLOW_PUBLIC_REGISTRATION',
     'AUTH_.+_DEFAULT_ROLE_ID',
+    'AUTH_.+_REGISTER_URL_ALLOW_LIST',
     'AUTH_.+_ICON',
     'AUTH_.+_LABEL',
     'AUTH_.+_PARAMS',

package/dist/services/mail/templates/user-registration.liquid

@@ -0,0 +1,23 @@
+{% layout "base" %}
+{% block content %}
+
+<p>
+    Welcome to <i>{{ projectName }}</i>. Please click the button below to confirm this email address and activate your account:
+</p>
+
+<p style="text-align: center; padding: 20px 0;">
+    <a href="{{ url }}">
+        <b>Confirm your email</b>
+    </a>
+</p>
+
+<p>
+    If you didn't create this account, you can safely ignore this email.
+</p>
+
+<p>
+    Thank you,<br>
+    The {{ projectName }} Team
+</p>
+
+{% endblock %}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.5.4",
+  "version": "12.5.5",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -143,20 +143,20 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
-    "@wbce-d9/app": "10.1.1",
-    "@wbce-d9/extensions-sdk": "10.0.3",
-    "@wbce-d9/constants": "10.0.0",
+    "@wbce-d9/exceptions": "10.0.0",
     "@wbce-d9/schema": "10.0.0",
     "@wbce-d9/specs": "9.26.5",
-    "@wbce-d9/exceptions": "10.0.0",
     "@wbce-d9/storage": "10.0.0",
+    "@wbce-d9/constants": "10.0.0",
     "@wbce-d9/storage-driver-azure": "10.0.2",
+    "@wbce-d9/storage-driver-cloudinary": "10.0.3",
     "@wbce-d9/storage-driver-local": "10.0.2",
-    "@wbce-d9/storage-driver-s3": "10.0.2",
     "@wbce-d9/storage-driver-gcs": "10.0.2",
     "@wbce-d9/update-check": "10.0.3",
+    "@wbce-d9/storage-driver-s3": "10.0.2",
     "@wbce-d9/utils": "10.0.2",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.3"
+    "@wbce-d9/extensions-sdk": "10.0.3",
+    "@wbce-d9/app": "10.1.2"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",