@wbce-d9/api 12.6.1 → 12.7.0

package/dist/auth/drivers/baseoauth.js

@@ -39,11 +39,16 @@ export class BaseOAuthDriver extends LocalAuthDriver {
                 provider: this.getConfig()['provider'],
                 providerPayload: { accessToken: tokenSet.access_token, userInfo },
             }, { database: getDatabase(), schema: this.schema, accountability: null });
-            // Update user to update refresh_token and other properties that might have changed
-            await this.getUserService().updateOne(userId, {
-                ...updatedUserPayload,
-                auth_data: userPayload.auth_data ?? null,
-            });
+            // Update user to update refresh_token and other properties that might have changed.
+            // Keep the stored refresh_token if the provider didn't issue a new one (e.g. Google when consent was
+            // already granted): refresh() still checks it against the provider
+            const updateUserPayload = userPayload.auth_data
+                ? { ...updatedUserPayload, auth_data: userPayload.auth_data }
+                : updatedUserPayload;
+            // Skip empty updates, they crash (#127)
+            if (Object.keys(updateUserPayload).length > 0) {
+                await this.getUserService().updateOne(userId, updateUserPayload);
+            }
             return userId;
         }
         //  --- NEW USER ----
@@ -131,10 +136,16 @@ export class BaseOAuthDriver extends LocalAuthDriver {
                 throw this.handleError(e);
             }
         }
+        else if (this.getConfig()['requireRefreshToken'] === false) {
+            // Opt-in: the provider issued no refresh token (e.g. Google when consent was already granted),
+            // so the Directus session is the only source of truth for this user
+            logger.debug(`[${this.getClientName()}] No refresh token stored, continuing (REQUIRE_REFRESH_TOKEN=false)`);
+        }
         else {
-            // If no auth connexion, throw user out
+            // If no auth connexion, throw user out. On login, the callback retries once with prompt=consent
+            // so the provider can issue a refresh_token
             logger.error(`No [${this.getClientName()}] Session found`);
-            throw new InvalidCredentialsException();
+            throw new InvalidTokenException();
         }
     }
     handleError = (e) => {

package/dist/auth/drivers/baseoauth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/env.js

@@ -141,6 +141,7 @@ const allowedEnvironmentVars = [
     'AUTH_.+_FIRST_NAME_KEY',
     'AUTH_.+_LAST_NAME_KEY',
     'AUTH_.+_ALLOW_PUBLIC_REGISTRATION',
+    'AUTH_.+_REQUIRE_REFRESH_TOKEN',
     'AUTH_.+_DEFAULT_ROLE_ID',
     'AUTH_.+_REGISTER_URL_ALLOW_LIST',
     'AUTH_.+_ICON',

package/dist/flows.d.ts

@@ -22,6 +22,15 @@ declare class FlowManager {
     private checkManualTriggerAccess;
     private unload;
     private executeFlow;
+    /**
+     * Return a copy of the event data whose payload has its concealed fields masked, as they would be on read.
+     * The data is returned as is when there is nothing to conceal.
+     */
+    private concealEventPayload;
+    /**
+     * Options are resolved against `concealedKeyedData` for the log operation and for the returned options (stored in
+     * the flow revisions), and against `keyedData` for every other operation.
+     */
     private executeOperation;
 }
 export {};

package/dist/flows.js

@@ -2,7 +2,7 @@ import * as sharedExceptions from '@wbce-d9/exceptions';
 import { Action } from '@wbce-d9/constants';
 import { applyOptionsData, isValidJSON, parseJSON, toArray } from '@wbce-d9/utils';
 import fastRedact from 'fast-redact';
-import { omit, pick } from 'lodash-es';
+import { cloneDeep, omit, pick } from 'lodash-es';
 import { get } from 'micromustache';
 import { schedule, validate } from 'node-cron';
 import getDatabase from './database/index.js';
@@ -15,6 +15,7 @@ import { getMessenger } from './messenger.js';
 import { ActivityService } from './services/activity.js';
 import * as services from './services/index.js';
 import { FlowsService } from './services/flows.js';
+import { PayloadService } from './services/payload.js';
 import { RevisionsService } from './services/revisions.js';
 import { constructFlowTree } from './utils/construct-flow-tree.js';
 import { getSchema } from './utils/get-schema.js';
@@ -273,13 +274,22 @@ class FlowManager {
             [ACCOUNTABILITY_KEY]: context?.['accountability'] ?? null,
             [ENV_KEY]: pick(env, env['FLOWS_ENV_ALLOW_LIST'] ? toArray(env['FLOWS_ENV_ALLOW_LIST']) : []),
         };
+        // Concealed fields of the event payload (e.g. passwords, tokens) must never end up in logs or revisions
+        const concealedData = await this.concealEventPayload(flow, data, database, schema);
+        const concealedKeyedData = {
+            ...keyedData,
+            [TRIGGER_KEY]: concealedData,
+            [LAST_KEY]: concealedData,
+        };
         let nextOperation = flow.operation;
         let lastOperationStatus = 'unknown';
         const steps = [];
         while (nextOperation !== null) {
-            const { successor, data, status, options } = await this.executeOperation(nextOperation, keyedData, context);
+            const { successor, data, status, options } = await this.executeOperation(nextOperation, keyedData, concealedKeyedData, context);
             keyedData[nextOperation.key] = data;
             keyedData[LAST_KEY] = data;
+            concealedKeyedData[nextOperation.key] = data;
+            concealedKeyedData[LAST_KEY] = data;
             lastOperationStatus = status;
             steps.push({ operation: nextOperation.id, key: nextOperation.key, status, options });
             nextOperation = successor;
@@ -310,7 +320,7 @@ class FlowManager {
                     item: flow.id,
                     data: {
                         steps: steps,
-                        data: redactLogs(omit(keyedData, '$accountability.permissions')), // Permissions is a ton of data, and is just a copy of what's in the directus_permissions table
+                        data: redactLogs(omit(concealedKeyedData, '$accountability.permissions')), // Permissions is a ton of data, and is just a copy of what's in the directus_permissions table
                     },
                 });
             }
@@ -326,15 +336,35 @@ class FlowManager {
         }
         return undefined;
     }
-    async executeOperation(operation, keyedData, context = {}) {
+    /**
+     * Return a copy of the event data whose payload has its concealed fields masked, as they would be on read.
+     * The data is returned as is when there is nothing to conceal.
+     */
+    async concealEventPayload(flow, data, knex, schema) {
+        if (flow.trigger !== 'event')
+            return data;
+        const { collection, payload } = data;
+        if (!schema.collections[collection] || !payload)
+            return data;
+        const payloadService = new PayloadService(collection, { knex, schema });
+        const concealedData = cloneDeep(data);
+        concealedData.payload = await payloadService.processValues('read', concealedData.payload);
+        return concealedData;
+    }
+    /**
+     * Options are resolved against `concealedKeyedData` for the log operation and for the returned options (stored in
+     * the flow revisions), and against `keyedData` for every other operation.
+     */
+    async executeOperation(operation, keyedData, concealedKeyedData, context = {}) {
         if (!(operation.type in this.operations)) {
             logger.warn(`Couldn't find operation ${operation.type}`);
             return { successor: null, status: 'unknown', data: null, options: null };
         }
         const handler = this.operations[operation.type];
         const options = applyOptionsData(operation.options, keyedData);
+        const concealedOptions = applyOptionsData(operation.options, concealedKeyedData);
         try {
-            let result = await handler(options, {
+            let result = await handler(operation.type === 'log' ? concealedOptions : options, {
                 services,
                 exceptions: { ...exceptions, ...sharedExceptions },
                 env,
@@ -352,7 +382,7 @@ class FlowManager {
             if (typeof result === 'object' && result !== null) {
                 result = mapValuesDeep(result, (_, value) => (value === undefined ? null : value));
             }
-            return { successor: operation.resolve, status: 'resolve', data: result ?? null, options };
+            return { successor: operation.resolve, status: 'resolve', data: result ?? null, options: concealedOptions };
         }
         catch (error) {
             let data;
@@ -374,7 +404,7 @@ class FlowManager {
                 successor: operation.reject,
                 status: 'reject',
                 data,
-                options,
+                options: concealedOptions,
             };
         }
     }

package/dist/flows.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/logger.js

@@ -6,17 +6,18 @@ import { URL } from 'url';
 import env from './env.js';
 import { REDACT_TEXT } from './constants.js';
 import { getConfigFromEnv } from './utils/get-config-from-env.js';
+const REDACTED_PATHS = ['req.headers.authorization', 'req.headers.cookie', 'req.query.access_token'];
 const pinoOptions = {
     level: env['LOG_LEVEL'] || 'info',
     redact: {
-        paths: ['req.headers.authorization', 'req.headers.cookie'],
+        paths: REDACTED_PATHS,
         censor: REDACT_TEXT,
     },
 };
 export const httpLoggerOptions = {
     level: env['LOG_LEVEL'] || 'info',
     redact: {
-        paths: ['req.headers.authorization', 'req.headers.cookie'],
+        paths: REDACTED_PATHS,
         censor: REDACT_TEXT,
     },
 };
@@ -43,7 +44,7 @@ if (env['LOG_STYLE'] !== 'raw') {
 }
 if (env['LOG_STYLE'] === 'raw') {
     httpLoggerOptions.redact = {
-        paths: ['req.headers.authorization', 'req.headers.cookie', 'res.headers'],
+        paths: [...REDACTED_PATHS, 'res.headers'],
         censor: (value, pathParts) => {
             const path = pathParts.join('.');
             if (path === 'res.headers') {

package/dist/services/graphql/index.js

@@ -104,6 +104,9 @@ export class GraphQLService {
         return formattedResult;
     }
     getSchema(type = 'schema') {
+        if (type === 'sdl' && env['GRAPHQL_INTROSPECTION'] === false) {
+            throw new ForbiddenException();
+        }
         // eslint-disable-next-line @typescript-eslint/no-this-alias
         const self = this;
         const schemaComposer = new SchemaComposer();

package/dist/services/payload.js

@@ -3,7 +3,7 @@ import { format, isValid, parseISO } from 'date-fns';
 import flat from 'flat';
 import Joi from 'joi';
 import { clone, cloneDeep, isNil, isObject, isPlainObject, omit, pick } from 'lodash-es';
-import { v4 as uuid } from 'uuid';
+import { v4 as uuid, validate as validateUUID } from 'uuid';
 import { parse as wktToGeoJSON } from 'wellknown';
 import { getHelpers } from '../database/helpers/index.js';
 import getDatabase from '../database/index.js';
@@ -44,7 +44,10 @@ export class PayloadService {
             if (action === 'create' && !value) {
                 return uuid();
             }
-            return value;
+            if (action === 'create' && !validateUUID(String(value))) {
+                throw new InvalidPayloadException(`Invalid UUID "${value}"`);
+            }
+            return action === 'create' ? String(value).toLowerCase() : value;
         },
         async 'cast-boolean'({ action, value }) {
             if (action === 'read') {

package/dist/services/users.js

@@ -5,6 +5,7 @@ import { cloneDeep, isEmpty } from 'lodash-es';
 import { performance } from 'perf_hooks';
 import getDatabase from '../database/index.js';
 import env from '../env.js';
+import logger from '../logger.js';
 import { RecordNotUniqueException } from '../exceptions/database/record-not-unique.js';
 import { ForbiddenException, InvalidPayloadException, UnprocessableEntityException } from '../exceptions/index.js';
 import isUrlAllowed from '../utils/is-url-allowed.js';
@@ -340,37 +341,42 @@ export class UsersService extends ItemsService {
     async requestPasswordReset(email, url, subject) {
         const STALL_TIME = 500;
         const timeStart = performance.now();
-        const user = await this.getUserByEmail(email);
-        if (user?.status !== 'active') {
-            await stall(STALL_TIME, timeStart);
-            throw new ForbiddenException();
+        try {
+            if (url && isUrlAllowed(url, env['PASSWORD_RESET_URL_ALLOW_LIST']) === false) {
+                throw new InvalidPayloadException(`Url "${url}" can't be used to reset passwords.`);
+            }
+            const user = await this.getUserByEmail(email);
+            if (user?.status !== 'active') {
+                throw new ForbiddenException();
+            }
+            const mailService = new MailService({
+                schema: this.schema,
+                knex: this.knex,
+                accountability: this.accountability,
+            });
+            const payload = { email: user.email, scope: 'password-reset', hash: getSimpleHash('' + user.password) };
+            const token = jwt.sign(payload, env['SECRET'], { expiresIn: '1d', issuer: 'directus' });
+            const acceptURL = url
+                ? new Url(url).setQuery('token', token).toString()
+                : new Url(env['PUBLIC_URL']).addPath('admin', 'reset-password').setQuery('token', token).toString();
+            const subjectLine = subject ? subject : 'Password Reset Request';
+            mailService
+                .send({
+                to: user.email,
+                subject: subjectLine,
+                template: {
+                    name: 'password-reset',
+                    data: {
+                        url: acceptURL,
+                        email: user.email,
+                    },
+                },
+            })
+                .catch((err) => logger.warn(err, `[email] ${err}`));
         }
-        if (url && isUrlAllowed(url, env['PASSWORD_RESET_URL_ALLOW_LIST']) === false) {
-            throw new InvalidPayloadException(`Url "${url}" can't be used to reset passwords.`);
+        finally {
+            await stall(STALL_TIME, timeStart);
         }
-        const mailService = new MailService({
-            schema: this.schema,
-            knex: this.knex,
-            accountability: this.accountability,
-        });
-        const payload = { email: user.email, scope: 'password-reset', hash: getSimpleHash('' + user.password) };
-        const token = jwt.sign(payload, env['SECRET'], { expiresIn: '1d', issuer: 'directus' });
-        const acceptURL = url
-            ? new Url(url).setQuery('token', token).toString()
-            : new Url(env['PUBLIC_URL']).addPath('admin', 'reset-password').setQuery('token', token).toString();
-        const subjectLine = subject ? subject : 'Password Reset Request';
-        await mailService.send({
-            to: user.email,
-            subject: subjectLine,
-            template: {
-                name: 'password-reset',
-                data: {
-                    url: acceptURL,
-                    email: user.email,
-                },
-            },
-        });
-        await stall(STALL_TIME, timeStart);
     }
     async resetPassword(token, password) {
         const { email, scope, hash } = jwt.verify(token, env['SECRET'], { issuer: 'directus' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.6.1",
+  "version": "12.7.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -144,20 +144,20 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
-    "@wbce-d9/app": "11.1.0",
-    "@wbce-d9/constants": "10.0.0",
-    "@wbce-d9/exceptions": "10.0.1",
+    "@wbce-d9/app": "11.2.0",
+    "@wbce-d9/extensions-sdk": "10.0.5",
     "@wbce-d9/schema": "10.0.0",
-    "@wbce-d9/storage": "10.0.0",
     "@wbce-d9/specs": "9.26.5",
     "@wbce-d9/storage-driver-azure": "10.0.4",
     "@wbce-d9/storage-driver-cloudinary": "10.0.5",
-    "@wbce-d9/extensions-sdk": "10.0.5",
     "@wbce-d9/storage-driver-local": "10.0.4",
     "@wbce-d9/storage-driver-gcs": "10.0.4",
     "@wbce-d9/storage-driver-s3": "10.0.4",
     "@wbce-d9/update-check": "10.0.4",
-    "@wbce-d9/utils": "10.0.4"
+    "@wbce-d9/storage": "10.0.0",
+    "@wbce-d9/utils": "10.0.4",
+    "@wbce-d9/constants": "10.0.0",
+    "@wbce-d9/exceptions": "10.0.1"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",