@wbce-d9/api 12.5.7 → 12.5.9

package/dist/cli/utils/create-env/env-stub.liquid

@@ -295,6 +295,11 @@ AUTH_PROVIDERS=""
 # AUTH_GITHUB_EMAIL_KEY="email"
 # AUTH_GITHUB_IDENTIFIER_KEY="login"
 
+# Public self-service registration on the default email/password provider. Needs working EMAIL_*
+# AUTH_DEFAULT_ALLOW_PUBLIC_REGISTRATION=true
+# AUTH_DEFAULT_DEFAULT_ROLE_ID="82424427-c9d4-4289-8bc5-ed1bf8422c90"
+# AUTH_DEFAULT_REGISTER_URL_ALLOW_LIST="https://example.com/verify-email"
+
 ####################################################################################################
 ### Extensions
 

package/dist/controllers/assets.js

@@ -1,6 +1,7 @@
 import { parseJSON } from '@wbce-d9/utils';
 import contentDisposition from 'content-disposition';
 import { Router } from 'express';
+import helmet from 'helmet';
 import { merge, pick } from 'lodash-es';
 import { ASSET_TRANSFORM_QUERY_KEYS, SYSTEM_ASSET_ALLOW_LIST } from '../constants.js';
 import getDatabase from '../database/index.js';
@@ -89,14 +90,6 @@ asyncHandler(async (req, res, next) => {
             return next();
         throw new InvalidQueryException(`Dynamic asset generation has been disabled for this project.`);
     }
-}), asyncHandler(async (req, res, next) => {
-    const helmet = await import('helmet');
-    return helmet.contentSecurityPolicy(merge({
-        useDefaults: false,
-        directives: {
-            defaultSrc: ['none'],
-        },
-    }, getConfigFromEnv('ASSETS_CONTENT_SECURITY_POLICY')))(req, res, next);
 }), 
 // Return file
 asyncHandler(async (req, res) => {
@@ -144,7 +137,21 @@ asyncHandler(async (req, res) => {
     const filename = req.params['filename'] ?? file.filename_download;
     res.attachment(filename);
     res.setHeader('Content-Type', file.type);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
     res.setHeader('Accept-Ranges', 'bytes');
+    helmet.contentSecurityPolicy(merge({
+        useDefaults: false,
+        directives: {
+            defaultSrc: ["'none'"],
+            // form-action doesn't fall back to default-src
+            formAction: ["'none'"],
+            // Serve assets from an opaque origin, except PDFs which browsers refuse to render when sandboxed
+            ...(file.type !== 'application/pdf' ? { sandbox: [] } : {}),
+        },
+    }, getConfigFromEnv('ASSETS_CONTENT_SECURITY_POLICY')))(req, res, (err) => {
+        if (err)
+            throw err;
+    });
     res.setHeader('Cache-Control', getCacheControlHeader(req, getMilliseconds(env['ASSETS_CACHE_TTL']), false, true));
     res.setHeader('Vary', vary.join(', '));
     const unixTime = Date.parse(file.modified_on);

package/dist/services/files.js

@@ -75,9 +75,14 @@ export class FilesService extends ItemsService {
             const { height, width, description, title, tags, metadata } = await this.getMetadata(stream);
             payload.height ??= height ?? null;
             payload.width ??= width ?? null;
-            payload.description ??= description ?? null;
-            payload.title ??= title ?? null;
-            payload.tags ??= tags ?? null;
+            // Only fill these from metadata the file actually carries. Setting them to null would wipe the stored values
+            // when a file is replaced with one that has none, e.g. a screenshot.
+            if (description)
+                payload.description ??= description;
+            if (title)
+                payload.title ??= title;
+            if (tags)
+                payload.tags ??= tags;
             payload.metadata ??= metadata ?? null;
         }
         // We do this in a service without accountability. Even if you don't have update permissions to the file,

package/dist/utils/get-cache-key.js

@@ -5,9 +5,17 @@ import { version } from './package.js';
 export function getCacheKey(req) {
     const path = url.parse(req.originalUrl).pathname;
     const isGraphQl = path?.startsWith('/graphql');
+    const accountability = req.accountability;
+    // Include every accountability field that affects permission resolution (see get-permissions.ts),
+    // so responses are never shared across roles, shares or share scopes
     const info = {
         version,
-        user: req.accountability?.user || null,
+        user: accountability?.user || null,
+        role: accountability?.role || null,
+        admin: accountability?.admin || false,
+        app: accountability?.app || false,
+        share: accountability?.share || null,
+        share_scope: accountability?.share_scope || null,
         path,
         query: isGraphQl ? getGraphqlQueryAndVariables(req) : req.sanitizedQuery,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.5.7",
+  "version": "12.5.9",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -144,18 +144,18 @@
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
     "@wbce-d9/app": "11.0.0",
-    "@wbce-d9/constants": "10.0.0",
-    "@wbce-d9/extensions-sdk": "10.0.4",
     "@wbce-d9/exceptions": "10.0.0",
-    "@wbce-d9/schema": "10.0.0",
     "@wbce-d9/specs": "9.26.5",
-    "@wbce-d9/storage-driver-azure": "10.0.3",
+    "@wbce-d9/schema": "10.0.0",
+    "@wbce-d9/extensions-sdk": "10.0.4",
     "@wbce-d9/storage": "10.0.0",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.4",
-    "@wbce-d9/storage-driver-gcs": "10.0.3",
+    "@wbce-d9/constants": "10.0.0",
     "@wbce-d9/storage-driver-s3": "10.0.3",
+    "@wbce-d9/storage-driver-azure": "10.0.3",
     "@wbce-d9/update-check": "10.0.4",
     "@wbce-d9/utils": "10.0.3",
+    "@wbce-d9/storage-driver-gcs": "10.0.3",
+    "@wbce-d9/storage-driver-cloudinary": "10.0.4",
     "@wbce-d9/storage-driver-local": "10.0.3"
   },
   "devDependencies": {