@wbce-d9/api 12.7.2 → 12.7.3

package/dist/controllers/assets.js

@@ -133,7 +133,11 @@ asyncHandler(async (req, res) => {
             }
         }
     }
-    const { stream, file, stat } = await service.getAsset(id, transformation, range);
+    const isHead = req.method.toLowerCase() === 'head';
+    const asset = isHead
+        ? await service.getAssetInfo(id, transformation, range)
+        : await service.getAsset(id, transformation, range);
+    const { stream, file, stat } = asset;
     const filename = req.params['filename'] ?? file.filename_download;
     res.attachment(filename);
     res.setHeader('Content-Type', file.type);
@@ -170,10 +174,7 @@ asyncHandler(async (req, res) => {
     if ('download' in req.query === false) {
         res.setHeader('Content-Disposition', contentDisposition(filename, { type: 'inline' }));
     }
-    if (req.method.toLowerCase() === 'head') {
-        res.status(200);
-        res.setHeader('Accept-Ranges', 'bytes');
-        res.setHeader('Content-Length', stat.size);
+    if (!stream) {
         return res.end();
     }
     let isDataSent = false;

package/dist/flows.d.ts

@@ -23,8 +23,9 @@ declare class FlowManager {
     private unload;
     private executeFlow;
     /**
-     * Return a copy of the event data whose payload has its concealed fields masked, as they would be on read.
-     * The data is returned as is when there is nothing to conceal.
+     * Return a copy of the trigger data with its secrets masked: the concealed fields of an event payload, as they
+     * would be on read, and the credentials (authorization header, cookies, access_token query parameter) of a
+     * webhook or manual request. The data is returned as is when there is nothing to conceal.
      */
     private concealEventPayload;
     /**

package/dist/flows.js

@@ -27,6 +27,11 @@ const redactLogs = fastRedact({
     paths: ['*.headers.authorization', '*.access_token', '*.headers.cookie'],
     serialize: false,
 });
+const redactRequestCredentials = fastRedact({
+    censor: '--redacted--',
+    paths: ['headers.authorization', 'headers.cookie', 'query.access_token'],
+    serialize: false,
+});
 export function getFlowManager() {
     if (flowManager) {
         return flowManager;
@@ -337,10 +342,13 @@ class FlowManager {
         return undefined;
     }
     /**
-     * Return a copy of the event data whose payload has its concealed fields masked, as they would be on read.
-     * The data is returned as is when there is nothing to conceal.
+     * Return a copy of the trigger data with its secrets masked: the concealed fields of an event payload, as they
+     * would be on read, and the credentials (authorization header, cookies, access_token query parameter) of a
+     * webhook or manual request. The data is returned as is when there is nothing to conceal.
      */
     async concealEventPayload(flow, data, knex, schema) {
+        if (flow.trigger === 'webhook' || flow.trigger === 'manual')
+            return redactRequestCredentials(cloneDeep(data));
         if (flow.trigger !== 'event')
             return data;
         const { collection, payload } = data;

package/dist/middleware/graphql.js

@@ -2,6 +2,8 @@ import { parseJSON } from '@wbce-d9/utils';
 import { getOperationAST, parse, Source } from 'graphql';
 import { InvalidPayloadException, InvalidQueryException, MethodNotAllowedException } from '../exceptions/index.js';
 import asyncHandler from '../utils/async-handler.js';
+import { getGraphQLQueryCost } from '../utils/get-graphql-query-cost.js';
+import { consumeRateLimit } from './rate-limiter-ip.js';
 export const parseGraphQL = asyncHandler(async (req, res, next) => {
     if (req.method !== 'GET' && req.method !== 'POST') {
         throw new MethodNotAllowedException('GraphQL only supports GET and POST requests.', { allow: ['GET', 'POST'] });
@@ -52,6 +54,12 @@ export const parseGraphQL = asyncHandler(async (req, res, next) => {
     if (operationAST?.operation === 'mutation') {
         res.locals['cache'] = false;
     }
+    // A GraphQL request costs one rate limit point per root field. The request itself already consumed one point,
+    // so only the remaining cost is consumed here. Does nothing when the rate limiter is disabled.
+    const cost = getGraphQLQueryCost(document, operationAST);
+    if (cost > 1) {
+        await consumeRateLimit(req, res, cost - 1);
+    }
     res.locals['graphqlParams'] = {
         document,
         query,

package/dist/middleware/graphql.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/middleware/rate-limiter-ip.d.ts

@@ -1,5 +1,13 @@
-import type { RequestHandler } from 'express';
-import type { RateLimiterMemcache, RateLimiterMemory, RateLimiterRedis } from 'rate-limiter-flexible';
+import type { Request, RequestHandler, Response } from 'express';
+import type { RateLimiterAbstract, RateLimiterMemcache, RateLimiterMemory, RateLimiterRedis } from 'rate-limiter-flexible';
 declare let checkRateLimit: RequestHandler;
 export declare let rateLimiter: RateLimiterRedis | RateLimiterMemcache | RateLimiterMemory;
+/**
+ * Consume rate limit points for the client IP of the request. A request can consume more than one
+ * point when its cost is higher than a regular request, so expensive operations (like a GraphQL
+ * document selecting many root fields) are accounted for in the same budget.
+ * Does nothing when the rate limiter is disabled.
+ */
+export declare function createRateLimitConsumer(limiter: RateLimiterAbstract | undefined): (req: Request, res: Response, points?: number) => Promise<void>;
+export declare const consumeRateLimit: (req: Request, res: Response, points?: number) => Promise<void>;
 export default checkRateLimit;

package/dist/middleware/rate-limiter-ip.js

@@ -11,8 +11,22 @@ if (env['RATE_LIMITER_ENABLED'] === true) {
     validateEnv(['RATE_LIMITER_STORE', 'RATE_LIMITER_DURATION', 'RATE_LIMITER_POINTS']);
     rateLimiter = createRateLimiter('RATE_LIMITER');
     checkRateLimit = asyncHandler(async (req, res, next) => {
+        await consumeRateLimit(req, res, 1);
+        next();
+    });
+}
+/**
+ * Consume rate limit points for the client IP of the request. A request can consume more than one
+ * point when its cost is higher than a regular request, so expensive operations (like a GraphQL
+ * document selecting many root fields) are accounted for in the same budget.
+ * Does nothing when the rate limiter is disabled.
+ */
+export function createRateLimitConsumer(limiter) {
+    return async function consumeRateLimit(req, res, points = 1) {
+        if (!limiter)
+            return;
         try {
-            await rateLimiter.consume(getIPFromReq(req), 1);
+            await limiter.consume(getIPFromReq(req), points);
         }
         catch (rateLimiterRes) {
             if (rateLimiterRes instanceof Error)
@@ -23,7 +37,7 @@ if (env['RATE_LIMITER_ENABLED'] === true) {
                 reset: new Date(Date.now() + rateLimiterRes.msBeforeNext),
             });
         }
-        next();
-    });
+    };
 }
+export const consumeRateLimit = createRateLimitConsumer(rateLimiter);
 export default checkRateLimit;

package/dist/middleware/rate-limiter-ip.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/assets.d.ts

@@ -15,4 +15,10 @@ export declare class AssetsService {
         file: any;
         stat: Stat;
     }>;
+    getAssetInfo(id: string, transformation: TransformationParams, range?: Range): Promise<{
+        file: any;
+        stat: Stat;
+        stream?: never;
+    }>;
+    private resolveAsset;
 }

package/dist/services/assets.js

@@ -27,6 +27,19 @@ export class AssetsService {
     }
     async getAsset(id, transformation, range) {
         const storage = await getStorage();
+        const { file, filename, stat } = await this.resolveAsset(storage, id, transformation, range);
+        return {
+            stream: await storage.location(file.storage).read(filename, range),
+            file,
+            stat,
+        };
+    }
+    async getAssetInfo(id, transformation, range) {
+        const storage = await getStorage();
+        const { file, stat } = await this.resolveAsset(storage, id, transformation, range);
+        return { file, stat };
+    }
+    async resolveAsset(storage, id, transformation, range) {
         const publicSettings = await this.knex
             .select('project_logo', 'public_background', 'public_foreground')
             .from('directus_settings')
@@ -93,7 +106,7 @@ export class AssetsService {
             }
             if (exists) {
                 return {
-                    stream: await storage.location(file.storage).read(assetFilename, range),
+                    filename: assetFilename,
                     file,
                     stat: await storage.location(file.storage).stat(assetFilename),
                 };
@@ -114,7 +127,6 @@ export class AssetsService {
                     service: 'files',
                 });
             }
-            const readStream = await storage.location(file.storage).read(file.filename_disk, range);
             const transformer = sharp({
                 limitInputPixels: Math.pow(env['ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION'], 2),
                 sequentialRead: true,
@@ -126,21 +138,28 @@ export class AssetsService {
             if (transforms.find((transform) => transform[0] === 'rotate') === undefined)
                 transformer.rotate();
             transforms.forEach(([method, ...args]) => transformer[method].apply(transformer, args));
+            // Sharp validates synchronously: only open the stream once the request is known to be valid
+            const readStream = await storage.location(file.storage).read(file.filename_disk, range);
             readStream.on('error', (e) => {
                 logger.error(e, `Couldn't transform file ${file.id}`);
                 readStream.unpipe(transformer);
             });
-            await storage.location(file.storage).write(assetFilename, readStream.pipe(transformer), type);
+            try {
+                await storage.location(file.storage).write(assetFilename, readStream.pipe(transformer), type);
+            }
+            catch (error) {
+                readStream.destroy();
+                throw error;
+            }
             return {
-                stream: await storage.location(file.storage).read(assetFilename, range),
+                filename: assetFilename,
                 stat: await storage.location(file.storage).stat(assetFilename),
                 file,
             };
         }
         else {
-            const readStream = await storage.location(file.storage).read(file.filename_disk, range);
             const stat = await storage.location(file.storage).stat(file.filename_disk);
-            return { stream: readStream, file, stat };
+            return { filename: file.filename_disk, file, stat };
         }
     }
 }

package/dist/services/assets.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/graphql/index.js

@@ -45,6 +45,7 @@ import { GraphQLHash } from './types/hash.js';
 import { GraphQLStringOrFloat } from './types/string-or-float.js';
 import { GraphQLVoid } from './types/void.js';
 import { addPathToValidationError } from './utils/add-path-to-validation-error.js';
+import { dedupeQueryResolvers } from './utils/dedupe-query-resolvers.js';
 import processError from './utils/process-error.js';
 const validationRules = Array.from(specifiedRules);
 if (env['GRAPHQL_INTROSPECTION'] === false) {
@@ -212,7 +213,9 @@ export class GraphQLService {
         if (type === 'sdl') {
             return schemaComposer.toSDL();
         }
-        return schemaComposer.buildSchema();
+        const builtSchema = schemaComposer.buildSchema();
+        dedupeQueryResolvers(builtSchema);
+        return builtSchema;
         /**
          * Construct an object of types for every collection, using the permitted fields per action type
          * as it's fields.

package/dist/services/graphql/utils/dedupe-query-resolvers.d.ts

@@ -0,0 +1,9 @@
+import type { GraphQLSchema } from 'graphql';
+/**
+ * Make root query fields that are repeated under several aliases with the same arguments resolve
+ * only once per execution, so a single request can't multiply expensive resolvers (eg. server_health).
+ * Only fields returning a leaf type are concerned: as they have no selection, their result only
+ * depends on their arguments.
+ * Results are cached on the schema, which must therefore be built for a single execution.
+ */
+export declare function dedupeQueryResolvers(schema: GraphQLSchema): void;

package/dist/services/graphql/utils/dedupe-query-resolvers.js

@@ -0,0 +1,24 @@
+import { getNamedType, isLeafType } from 'graphql';
+import hash from 'object-hash';
+/**
+ * Make root query fields that are repeated under several aliases with the same arguments resolve
+ * only once per execution, so a single request can't multiply expensive resolvers (eg. server_health).
+ * Only fields returning a leaf type are concerned: as they have no selection, their result only
+ * depends on their arguments.
+ * Results are cached on the schema, which must therefore be built for a single execution.
+ */
+export function dedupeQueryResolvers(schema) {
+    const fields = schema.getQueryType()?.getFields() ?? {};
+    const results = new Map();
+    for (const field of Object.values(fields)) {
+        const resolve = field.resolve;
+        if (!resolve || !isLeafType(getNamedType(field.type)))
+            continue;
+        field.resolve = (source, args, context, info) => {
+            const key = hash({ field: info.fieldName, args });
+            if (!results.has(key))
+                results.set(key, resolve(source, args, context, info));
+            return results.get(key);
+        };
+    }
+}

package/dist/services/graphql/utils/dedupe-query-resolvers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/get-graphql-query-cost.d.ts

@@ -0,0 +1,12 @@
+import type { DocumentNode, OperationDefinitionNode } from 'graphql';
+/**
+ * Cost of a GraphQL document in rate limit points: one point per root field of the executed
+ * operation. Every root field is resolved on its own, so it is one unit of work (a collection read,
+ * a mutation, ...) whatever its arguments: repeating fields under aliases with different arguments
+ * consumes points instead of being free. Nested fields are not counted, as they are resolved from
+ * the root field.
+ * The operation is resolved by the caller (getOperationAST); when there is none (invalid document or
+ * missing operation name), the cost is 0: validation rejects those, and the request still costs its
+ * base point.
+ */
+export declare function getGraphQLQueryCost(document: DocumentNode, operation: OperationDefinitionNode | null | undefined): number;

package/dist/utils/get-graphql-query-cost.js

@@ -0,0 +1,45 @@
+import { Kind } from 'graphql';
+/**
+ * Cost of a GraphQL document in rate limit points: one point per root field of the executed
+ * operation. Every root field is resolved on its own, so it is one unit of work (a collection read,
+ * a mutation, ...) whatever its arguments: repeating fields under aliases with different arguments
+ * consumes points instead of being free. Nested fields are not counted, as they are resolved from
+ * the root field.
+ * The operation is resolved by the caller (getOperationAST); when there is none (invalid document or
+ * missing operation name), the cost is 0: validation rejects those, and the request still costs its
+ * base point.
+ */
+export function getGraphQLQueryCost(document, operation) {
+    if (!operation)
+        return 0;
+    const fragments = new Map();
+    for (const definition of document.definitions) {
+        if (definition.kind === Kind.FRAGMENT_DEFINITION)
+            fragments.set(definition.name.value, definition);
+    }
+    return countRootFields(operation.selectionSet, fragments, new Set());
+}
+function countRootFields(selectionSet, fragments, visited) {
+    let fields = 0;
+    for (const selection of selectionSet.selections) {
+        if (selection.kind === Kind.FIELD) {
+            // A pointer resolved by the GraphQL engine, not by one of our resolvers
+            if (selection.name.value === '__typename')
+                continue;
+            fields++;
+        }
+        else if (selection.kind === Kind.INLINE_FRAGMENT) {
+            fields += countRootFields(selection.selectionSet, fragments, visited);
+        }
+        else if (selection.kind === Kind.FRAGMENT_SPREAD) {
+            if (visited.has(selection.name.value))
+                continue;
+            const fragment = fragments.get(selection.name.value);
+            if (fragment) {
+                visited.add(selection.name.value);
+                fields += countRootFields(fragment.selectionSet, fragments, visited);
+            }
+        }
+    }
+    return fields;
+}

package/dist/utils/get-graphql-query-cost.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.7.2",
+  "version": "12.7.3",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -126,7 +126,7 @@
     "ms": "2.1.3",
     "node-cron": "3.0.2",
     "node-machine-id": "1.1.12",
-    "nodemailer": "10.0.12",
+    "nodemailer": "10.2.1",
     "object-hash": "3.0.0",
     "openid-client": "6.8.2",
     "otplib": "12.0.1",
@@ -136,7 +136,7 @@
     "qs": "6.16.0",
     "rate-limiter-flexible": "2.4.1",
     "samlify": "2.13.1",
-    "sanitize-html": "2.17.7",
+    "sanitize-html": "2.18.1",
     "sharp": "0.35.5",
     "snappy": "7.2.2",
     "stream-json": "3.7.0",
@@ -144,20 +144,20 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
+    "@wbce-d9/app": "11.3.1",
     "@wbce-d9/constants": "10.0.0",
     "@wbce-d9/exceptions": "10.0.1",
-    "@wbce-d9/app": "11.3.0",
     "@wbce-d9/extensions-sdk": "10.1.0",
+    "@wbce-d9/schema": "10.0.0",
+    "@wbce-d9/specs": "9.26.5",
+    "@wbce-d9/storage-driver-cloudinary": "10.0.7",
     "@wbce-d9/storage": "10.0.0",
     "@wbce-d9/storage-driver-azure": "10.0.5",
-    "@wbce-d9/specs": "9.26.5",
     "@wbce-d9/storage-driver-gcs": "10.0.5",
-    "@wbce-d9/schema": "10.0.0",
-    "@wbce-d9/storage-driver-local": "10.0.5",
-    "@wbce-d9/storage-driver-s3": "10.0.5",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.6",
-    "@wbce-d9/update-check": "10.0.4",
-    "@wbce-d9/utils": "10.0.5"
+    "@wbce-d9/storage-driver-s3": "10.0.6",
+    "@wbce-d9/utils": "10.0.5",
+    "@wbce-d9/update-check": "10.0.5",
+    "@wbce-d9/storage-driver-local": "10.0.5"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
@@ -171,11 +171,11 @@
     "@types/supertest": "2.0.12",
     "@types/uuid": "9.0.1",
     "@types/wellknown": "0.5.4",
-    "@vitest/coverage-v8": "4.1.11",
+    "@vitest/coverage-v8": "4.1.12",
     "@wbce-d9/tsconfig": "2.0.0",
     "supertest": "6.3.3",
     "typescript": "5.0.4",
-    "vitest": "4.1.11",
+    "vitest": "4.1.12",
     "@types/async": "3.2.19",
     "@types/busboy": "1.5.0",
     "@types/bytes": "3.1.1",