@wbce-d9/api 12.5.8 → 12.5.10

package/dist/auth/drivers/openid.js

@@ -17,6 +17,23 @@ import { getIPFromReq } from '../../utils/get-ip-from-req.js';
 import { Url } from '../../utils/url.js';
 import { isRedirectAllowedOnLogin } from '../../utils/is-redirect-allowed-on-login.js';
 import { BaseOAuthDriver } from './baseoauth.js';
+// Authorization-request parameters the caller must never control
+const RESERVED_AUTH_PARAMS = new Set([
+    'prompt',
+    'redirect',
+    'scope',
+    'access_type',
+    'code_challenge',
+    'code_challenge_method',
+    'state',
+    'nonce',
+    'redirect_uri',
+    'client_id',
+    'response_type',
+    'response_mode',
+    'request',
+    'request_uri',
+]);
 export class OpenIDAuthDriver extends BaseOAuthDriver {
     client;
     redirectUrl;
@@ -75,6 +92,7 @@ export class OpenIDAuthDriver extends BaseOAuthDriver {
             const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
             const paramsConfig = typeof this.config['params'] === 'object' ? this.config['params'] : {};
             const params = {
+                ...additionalParams,
                 scope: this.config['scope'] ?? 'openid profile email',
                 access_type: 'offline',
                 ...paramsConfig,
@@ -84,7 +102,6 @@ export class OpenIDAuthDriver extends BaseOAuthDriver {
                 state: codeChallenge,
                 nonce: codeChallenge,
                 redirect_uri: this.redirectUrl,
-                ...additionalParams,
             };
             if (prompt) {
                 params.prompt = 'consent';
@@ -155,7 +172,7 @@ export function createOpenIDAuthRouter(providerName) {
             issuer: 'directus',
         });
         const additionalParams = Object.fromEntries(Object.entries(req.query)
-            .filter(([k, v]) => k !== 'prompt' && k !== 'redirect' && typeof v === 'string')
+            .filter(([k, v]) => RESERVED_AUTH_PARAMS.has(k) === false && typeof v === 'string')
             .map(([k, v]) => [k, v]));
         const authUrl = await provider.generateAuthUrl(codeVerifier, prompt, additionalParams);
         const urlParams = new URL(authUrl);

package/dist/auth/drivers/openid.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/get-cache-key.js

@@ -5,9 +5,17 @@ import { version } from './package.js';
 export function getCacheKey(req) {
     const path = url.parse(req.originalUrl).pathname;
     const isGraphQl = path?.startsWith('/graphql');
+    const accountability = req.accountability;
+    // Include every accountability field that affects permission resolution (see get-permissions.ts),
+    // so responses are never shared across roles, shares or share scopes
     const info = {
         version,
-        user: req.accountability?.user || null,
+        user: accountability?.user || null,
+        role: accountability?.role || null,
+        admin: accountability?.admin || false,
+        app: accountability?.app || false,
+        share: accountability?.share || null,
+        share_scope: accountability?.share_scope || null,
         path,
         query: isGraphQl ? getGraphqlQueryAndVariables(req) : req.sanitizedQuery,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.5.8",
+  "version": "12.5.10",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -143,15 +143,15 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
-    "@wbce-d9/app": "11.0.0",
     "@wbce-d9/constants": "10.0.0",
     "@wbce-d9/exceptions": "10.0.0",
     "@wbce-d9/extensions-sdk": "10.0.4",
     "@wbce-d9/schema": "10.0.0",
-    "@wbce-d9/storage-driver-azure": "10.0.3",
     "@wbce-d9/specs": "9.26.5",
     "@wbce-d9/storage": "10.0.0",
+    "@wbce-d9/storage-driver-azure": "10.0.3",
     "@wbce-d9/storage-driver-cloudinary": "10.0.4",
+    "@wbce-d9/app": "11.0.0",
     "@wbce-d9/storage-driver-gcs": "10.0.3",
     "@wbce-d9/storage-driver-local": "10.0.3",
     "@wbce-d9/storage-driver-s3": "10.0.3",