@wbce-d9/api 9.29.0 → 10.1.0

package/dist/auth/drivers/baseoauth.d.ts

@@ -0,0 +1,28 @@
+import type { Client, TokenSet } from 'openid-client';
+import { UsersService } from '../../services/users.js';
+import type { User } from '../../types/index.js';
+import { LocalAuthDriver } from './local.js';
+export interface UserPayload {
+    provider: string;
+    first_name: any;
+    last_name: any;
+    email: any;
+    external_identifier: string;
+    role: string;
+    auth_data: any;
+}
+export declare abstract class BaseOAuthDriver extends LocalAuthDriver {
+    abstract getClient(): Promise<Client>;
+    abstract getredirectUrl(): string;
+    abstract getUserService(): UsersService;
+    abstract getConfig(): Record<string, any>;
+    abstract getClientName(): string;
+    abstract getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[TokenSet, Record<string, unknown>, UserPayload]>;
+    generateCodeVerifier(): string;
+    fetchUserId(identifier: string): Promise<string | undefined>;
+    getUserID(payload: Record<string, any>): Promise<string>;
+    logout(user: User): Promise<void>;
+    login(user: User): Promise<void>;
+    refresh(user: User): Promise<void>;
+    handleError: (e: any) => any;
+}

package/dist/auth/drivers/baseoauth.js

@@ -0,0 +1,162 @@
+import { parseJSON } from '@wbce-d9/utils';
+import { errors, generators } from 'openid-client';
+import getDatabase from '../../database/index.js';
+import emitter from '../../emitter.js';
+import { RecordNotUniqueException } from '../../exceptions/database/record-not-unique.js';
+import { InvalidCredentialsException, InvalidProviderException, InvalidTokenException, ServiceUnavailableException, } from '../../exceptions/index.js';
+import logger from '../../logger.js';
+import { UsersService } from '../../services/users.js';
+import { LocalAuthDriver } from './local.js';
+export class BaseOAuthDriver extends LocalAuthDriver {
+    generateCodeVerifier() {
+        return generators.codeVerifier();
+    }
+    async fetchUserId(identifier) {
+        const user = await this.knex.select('id').from('directus_users').where('external_identifier', identifier).first();
+        return user?.id;
+    }
+    async getUserID(payload) {
+        if (!payload['code'] || !payload['codeVerifier'] || !payload['state']) {
+            logger.warn(`[${this.getClientName()}] No code, codeVerifier or state in payload`);
+            throw new InvalidCredentialsException();
+        }
+        const [tokenSet, userInfo, userPayload] = await this.getTokenSetAndUserInfo(payload);
+        const identifier = userPayload.external_identifier;
+        const userId = await this.fetchUserId(identifier);
+        if (userId) {
+            let updateReq = {};
+            if (this.getConfig()['updateUserOnLogin'] ?? false) {
+                updateReq = {
+                    first_name: userPayload.first_name,
+                    last_name: userPayload.last_name,
+                    email: userPayload.email,
+                };
+            }
+            // Run hook so the end user has the chance to augment the
+            // user that is about to be updated
+            const updatedUserPayload = await emitter.emitFilter(`auth.update`, updateReq, {
+                identifier,
+                provider: this.getConfig()['provider'],
+                providerPayload: { accessToken: tokenSet.access_token, userInfo },
+            }, { database: getDatabase(), schema: this.schema, accountability: null });
+            // Update user to update refresh_token and other properties that might have changed
+            await this.getUserService().updateOne(userId, {
+                ...updatedUserPayload,
+                auth_data: userPayload.auth_data,
+            });
+            return userId;
+        }
+        //  --- NEW USER ----
+        const { provider, allowPublicRegistration, requireVerifiedEmail } = this.getConfig();
+        const isEmailVerified = !requireVerifiedEmail || userInfo['email_verified'];
+        // Is public registration allowed?
+        if (!allowPublicRegistration || !isEmailVerified) {
+            logger.warn(`[${this.getClientName()}] User doesn't exist, and public registration not allowed for provider "${provider}"`);
+            throw new InvalidCredentialsException();
+        }
+        // Run hook so the end user has the chance to augment the
+        // user that is about to be created
+        const updatedUserPayload = await emitter.emitFilter(`auth.create`, userPayload, {
+            identifier,
+            provider: this.getConfig()['provider'],
+            providerPayload: { accessToken: tokenSet.access_token, userInfo },
+        }, { database: getDatabase(), schema: this.schema, accountability: null });
+        try {
+            await this.getUserService().createOne(updatedUserPayload);
+        }
+        catch (e) {
+            if (e instanceof RecordNotUniqueException) {
+                logger.warn(e, `[${this.getClientName()}] Failed to register user. User not unique`);
+                throw new InvalidProviderException();
+            }
+            throw e;
+        }
+        return (await this.fetchUserId(identifier));
+    }
+    async logout(user) {
+        let authData = user.auth_data;
+        if (typeof authData === 'string') {
+            try {
+                authData = parseJSON(authData);
+            }
+            catch {
+                logger.warn(`[${this.getClientName()}] Session data isn't valid JSON: ${authData}`);
+            }
+        }
+        if (authData?.['refreshToken']) {
+            try {
+                const client = await this.getClient();
+                const tokenSet = await client.refresh(authData['refreshToken']);
+                if (tokenSet.refresh_token) {
+                    await client.revoke(tokenSet.refresh_token, 'refresh_token');
+                }
+                await this.getUserService().updateOne(user.id, {
+                    auth_data: null,
+                });
+                logger.info(`[${this.getClientName()}] Session closed for user.`);
+            }
+            catch (e) {
+                throw this.handleError(e);
+            }
+        }
+        else {
+            logger.warn(`[${this.getClientName()}] Session closed for user without auth_data`);
+        }
+    }
+    async login(user) {
+        return this.refresh(user);
+    }
+    async refresh(user) {
+        let authData = user.auth_data;
+        if (typeof authData === 'string') {
+            try {
+                authData = parseJSON(authData);
+            }
+            catch {
+                logger.warn(`[${this.getClientName()}] Session data isn't valid JSON: ${authData}`);
+            }
+        }
+        if (authData?.['refreshToken']) {
+            try {
+                const client = await this.getClient();
+                const tokenSet = await client.refresh(authData['refreshToken']);
+                // Update user refreshToken if provided
+                if (tokenSet.refresh_token) {
+                    await this.getUserService().updateOne(user.id, {
+                        auth_data: JSON.stringify({ refreshToken: tokenSet.refresh_token }),
+                    });
+                }
+            }
+            catch (e) {
+                throw this.handleError(e);
+            }
+        }
+        else {
+            // If no auth connexion, throw user out
+            logger.error(`No [${this.getClientName()}] Session found`);
+            throw new InvalidCredentialsException();
+        }
+    }
+    handleError = (e) => {
+        if (e instanceof errors.OPError) {
+            if (e.error === 'invalid_grant') {
+                // Invalid token
+                logger.trace(e, `[${this.getClientName()}] Invalid grant`);
+                return new InvalidTokenException();
+            }
+            // Server response error
+            logger.trace(e, `[${this.getClientName()}] Unknown OP error`);
+            return new ServiceUnavailableException('Service returned unexpected response', {
+                service: 'openid',
+                message: e.error_description,
+            });
+        }
+        else if (e instanceof errors.RPError) {
+            // Internal client error
+            logger.trace(e, `[${this.getClientName()}] Unknown RP error`);
+            return new InvalidCredentialsException();
+        }
+        logger.trace(e, `[${this.getClientName()}] Unknown error`);
+        return e;
+    };
+}

package/dist/auth/drivers/ldap.js

@@ -1,9 +1,9 @@
 import { Router } from 'express';
 import Joi from 'joi';
 import ldap from 'ldapjs';
+import { GET_SET_HEADER } from '../../constants.js';
 import getDatabase from '../../database/index.js';
 import emitter from '../../emitter.js';
-import env from '../../env.js';
 import { RecordNotUniqueException } from '../../exceptions/database/record-not-unique.js';
 import { InvalidConfigException, InvalidCredentialsException, InvalidPayloadException, InvalidProviderException, ServiceUnavailableException, UnexpectedResponseException, } from '../../exceptions/index.js';
 import logger from '../../logger.js';
@@ -12,7 +12,6 @@ import { AuthenticationService } from '../../services/authentication.js';
 import { UsersService } from '../../services/users.js';
 import asyncHandler from '../../utils/async-handler.js';
 import { getIPFromReq } from '../../utils/get-ip-from-req.js';
-import { getMilliseconds } from '../../utils/get-milliseconds.js';
 import { AuthDriver } from '../auth.js';
 // 0x2: ACCOUNTDISABLE
 // 0x10: LOCKOUT
@@ -315,13 +314,7 @@ export function createLDAPAuthRouter(provider) {
             payload['data']['refresh_token'] = refreshToken;
         }
         if (mode === 'cookie') {
-            res.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, {
-                httpOnly: true,
-                domain: env['REFRESH_TOKEN_COOKIE_DOMAIN'],
-                maxAge: getMilliseconds(env['REFRESH_TOKEN_TTL']),
-                secure: env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false,
-                sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
-            });
+            res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
         }
         res.locals['payload'] = payload;
         return next();

package/dist/auth/drivers/local.js

@@ -2,7 +2,7 @@ import argon2 from 'argon2';
 import { Router } from 'express';
 import Joi from 'joi';
 import { performance } from 'perf_hooks';
-import { COOKIE_OPTIONS } from '../../constants.js';
+import { GET_SET_HEADER } from '../../constants.js';
 import env from '../../env.js';
 import { InvalidCredentialsException, InvalidPayloadException } from '../../exceptions/index.js';
 import { respond } from '../../middleware/respond.js';
@@ -74,7 +74,7 @@ export function createLocalAuthRouter(provider) {
             payload['data']['refresh_token'] = refreshToken;
         }
         if (mode === 'cookie') {
-            res.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, COOKIE_OPTIONS);
+            res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
         }
         res.locals['payload'] = payload;
         return next();

package/dist/auth/drivers/oauth2.d.ts

@@ -1,19 +1,20 @@
 import { Router } from 'express';
-import type { Client } from 'openid-client';
+import type { BaseClient, Client, TokenSet } from 'openid-client';
 import { UsersService } from '../../services/users.js';
-import type { AuthDriverOptions, User } from '../../types/index.js';
-import { LocalAuthDriver } from './local.js';
-export declare class OAuth2AuthDriver extends LocalAuthDriver {
+import type { AuthDriverOptions } from '../../types/index.js';
+import { BaseOAuthDriver, type UserPayload } from './baseoauth.js';
+export declare class OAuth2AuthDriver extends BaseOAuthDriver {
     client: Client;
     redirectUrl: string;
     usersService: UsersService;
     config: Record<string, any>;
+    getClient(): Promise<BaseClient>;
+    getredirectUrl(): string;
+    getUserService(): UsersService;
+    getConfig(): Record<string, any>;
+    getClientName(): string;
     constructor(options: AuthDriverOptions, config: Record<string, any>);
-    generateCodeVerifier(): string;
     generateAuthUrl(codeVerifier: string, prompt?: boolean): string;
-    private fetchUserId;
-    getUserID(payload: Record<string, any>): Promise<string>;
-    login(user: User): Promise<void>;
-    refresh(user: User): Promise<void>;
+    getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[TokenSet, Record<string, unknown>, UserPayload]>;
 }
 export declare function createOAuth2AuthRouter(providerName: string): Router;

package/dist/auth/drivers/oauth2.js

@@ -1,15 +1,12 @@
 import { BaseException } from '@wbce-d9/exceptions';
-import { parseJSON } from '@wbce-d9/utils';
 import express, { Router } from 'express';
 import flatten from 'flat';
 import jwt from 'jsonwebtoken';
-import { errors, generators, Issuer } from 'openid-client';
+import { generators, Issuer } from 'openid-client';
 import { getAuthProvider } from '../../auth.js';
-import getDatabase from '../../database/index.js';
-import emitter from '../../emitter.js';
+import { GET_SET_HEADER } from '../../constants.js';
 import env from '../../env.js';
-import { RecordNotUniqueException } from '../../exceptions/database/record-not-unique.js';
-import { InvalidConfigException, InvalidCredentialsException, InvalidProviderException, InvalidTokenException, ServiceUnavailableException, } from '../../exceptions/index.js';
+import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException } from '../../exceptions/index.js';
 import logger from '../../logger.js';
 import { respond } from '../../middleware/respond.js';
 import { AuthenticationService } from '../../services/authentication.js';
@@ -17,14 +14,28 @@ import { UsersService } from '../../services/users.js';
 import asyncHandler from '../../utils/async-handler.js';
 import { getConfigFromEnv } from '../../utils/get-config-from-env.js';
 import { getIPFromReq } from '../../utils/get-ip-from-req.js';
-import { getMilliseconds } from '../../utils/get-milliseconds.js';
 import { Url } from '../../utils/url.js';
-import { LocalAuthDriver } from './local.js';
-export class OAuth2AuthDriver extends LocalAuthDriver {
+import { BaseOAuthDriver } from './baseoauth.js';
+export class OAuth2AuthDriver extends BaseOAuthDriver {
     client;
     redirectUrl;
     usersService;
     config;
+    getClient() {
+        return Promise.resolve(this.client);
+    }
+    getredirectUrl() {
+        return this.redirectUrl;
+    }
+    getUserService() {
+        return this.usersService;
+    }
+    getConfig() {
+        return this.config;
+    }
+    getClientName() {
+        return 'OAuth2';
+    }
     constructor(options, config) {
         super(options, config);
         const { authorizeUrl, accessUrl, profileUrl, clientId, clientSecret, ...additionalConfig } = config;
@@ -50,9 +61,6 @@ export class OAuth2AuthDriver extends LocalAuthDriver {
             ...clientOptionsOverrides,
         });
     }
-    generateCodeVerifier() {
-        return generators.codeVerifier();
-    }
     generateAuthUrl(codeVerifier, prompt = false) {
         try {
             const codeChallenge = generators.codeChallenge(codeVerifier);
@@ -69,22 +77,10 @@ export class OAuth2AuthDriver extends LocalAuthDriver {
             });
         }
         catch (e) {
-            throw handleError(e);
+            throw this.handleError(e);
         }
     }
-    async fetchUserId(identifier) {
-        const user = await this.knex
-            .select('id')
-            .from('directus_users')
-            .whereRaw('LOWER(??) = ?', ['external_identifier', identifier.toLowerCase()])
-            .first();
-        return user?.id;
-    }
-    async getUserID(payload) {
-        if (!payload['code'] || !payload['codeVerifier'] || !payload['state']) {
-            logger.warn('[OAuth2] No code, codeVerifier or state in payload');
-            throw new InvalidCredentialsException();
-        }
+    async getTokenSetAndUserInfo(payload) {
         let tokenSet;
         let userInfo;
         try {
@@ -92,11 +88,11 @@ export class OAuth2AuthDriver extends LocalAuthDriver {
             userInfo = await this.client.userinfo(tokenSet.access_token);
         }
         catch (e) {
-            throw handleError(e);
+            throw this.handleError(e);
         }
         // Flatten response to support dot indexes
         userInfo = flatten(userInfo);
-        const { provider, emailKey, identifierKey, allowPublicRegistration } = this.config;
+        const { provider, emailKey, identifierKey } = this.config;
         const email = userInfo[emailKey ?? 'email'] ? String(userInfo[emailKey ?? 'email']) : undefined;
         // Fallback to email if explicit identifier not found
         const identifier = userInfo[identifierKey] ? String(userInfo[identifierKey]) : email;
@@ -113,94 +109,9 @@ export class OAuth2AuthDriver extends LocalAuthDriver {
             role: this.config['defaultRoleId'],
             auth_data: tokenSet.refresh_token && JSON.stringify({ refreshToken: tokenSet.refresh_token }),
         };
-        const userId = await this.fetchUserId(identifier);
-        if (userId) {
-            // Run hook so the end user has the chance to augment the
-            // user that is about to be updated
-            const updatedUserPayload = await emitter.emitFilter(`auth.update`, {}, {
-                identifier,
-                provider: this.config['provider'],
-                providerPayload: { accessToken: tokenSet.access_token, userInfo },
-            }, { database: getDatabase(), schema: this.schema, accountability: null });
-            // Update user to update refresh_token and other properties that might have changed
-            await this.usersService.updateOne(userId, updatedUserPayload);
-            return userId;
-        }
-        // Is public registration allowed?
-        if (!allowPublicRegistration) {
-            logger.warn(`[OAuth2] User doesn't exist, and public registration not allowed for provider "${provider}"`);
-            throw new InvalidCredentialsException();
-        }
-        // Run hook so the end user has the chance to augment the
-        // user that is about to be created
-        const updatedUserPayload = await emitter.emitFilter(`auth.create`, userPayload, {
-            identifier,
-            provider: this.config['provider'],
-            providerPayload: { accessToken: tokenSet.access_token, userInfo },
-        }, { database: getDatabase(), schema: this.schema, accountability: null });
-        try {
-            await this.usersService.createOne(updatedUserPayload);
-        }
-        catch (e) {
-            if (e instanceof RecordNotUniqueException) {
-                logger.warn(e, '[OAuth2] Failed to register user. User not unique');
-                throw new InvalidProviderException();
-            }
-            throw e;
-        }
-        return (await this.fetchUserId(identifier));
-    }
-    async login(user) {
-        return this.refresh(user);
-    }
-    async refresh(user) {
-        let authData = user.auth_data;
-        if (typeof authData === 'string') {
-            try {
-                authData = parseJSON(authData);
-            }
-            catch {
-                logger.warn(`[OAuth2] Session data isn't valid JSON: ${authData}`);
-            }
-        }
-        if (authData?.['refreshToken']) {
-            try {
-                const tokenSet = await this.client.refresh(authData['refreshToken']);
-                // Update user refreshToken if provided
-                if (tokenSet.refresh_token) {
-                    await this.usersService.updateOne(user.id, {
-                        auth_data: JSON.stringify({ refreshToken: tokenSet.refresh_token }),
-                    });
-                }
-            }
-            catch (e) {
-                throw handleError(e);
-            }
-        }
+        return [tokenSet, userInfo, userPayload];
     }
 }
-const handleError = (e) => {
-    if (e instanceof errors.OPError) {
-        if (e.error === 'invalid_grant') {
-            // Invalid token
-            logger.trace(e, `[OAuth2] Invalid grant`);
-            return new InvalidTokenException();
-        }
-        // Server response error
-        logger.trace(e, `[OAuth2] Unknown OP error`);
-        return new ServiceUnavailableException('Service returned unexpected response', {
-            service: 'oauth2',
-            message: e.error_description,
-        });
-    }
-    else if (e instanceof errors.RPError) {
-        // Internal client error
-        logger.trace(e, `[OAuth2] Unknown RP error`);
-        return new InvalidCredentialsException();
-    }
-    logger.trace(e, `[OAuth2] Unknown error`);
-    return e;
-};
 export function createOAuth2AuthRouter(providerName) {
     const router = Router();
     router.get('/', (req, res) => {
@@ -275,13 +186,7 @@ export function createOAuth2AuthRouter(providerName) {
         }
         const { accessToken, refreshToken, expires } = authResponse;
         if (redirect) {
-            res.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, {
-                httpOnly: true,
-                domain: env['REFRESH_TOKEN_COOKIE_DOMAIN'],
-                maxAge: getMilliseconds(env['REFRESH_TOKEN_TTL']),
-                secure: env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false,
-                sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
-            });
+            res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
             return res.redirect(redirect);
         }
         res.locals['payload'] = {

package/dist/auth/drivers/openid.d.ts

@@ -1,20 +1,20 @@
 import { Router } from 'express';
-import type { Client } from 'openid-client';
+import type { AuthorizationParameters, BaseClient, Client, TokenSet } from 'openid-client';
 import { UsersService } from '../../services/users.js';
-import type { AuthDriverOptions, User } from '../../types/index.js';
-import { LocalAuthDriver } from './local.js';
-export declare class OpenIDAuthDriver extends LocalAuthDriver {
+import type { AuthDriverOptions } from '../../types/index.js';
+import { BaseOAuthDriver, type UserPayload } from './baseoauth.js';
+export declare class OpenIDAuthDriver extends BaseOAuthDriver {
     client: Promise<Client>;
     redirectUrl: string;
     usersService: UsersService;
     config: Record<string, any>;
+    getClient(): Promise<BaseClient>;
+    getredirectUrl(): string;
+    getUserService(): UsersService;
+    getConfig(): Record<string, any>;
+    getClientName(): string;
     constructor(options: AuthDriverOptions, config: Record<string, any>);
-    generateCodeVerifier(): string;
-    generateAuthUrl(codeVerifier: string, prompt?: boolean): Promise<string>;
-    private fetchUserId;
-    getUserID(payload: Record<string, any>): Promise<string>;
-    logout(user: User): Promise<void>;
-    login(user: User): Promise<void>;
-    refresh(user: User): Promise<void>;
+    generateAuthUrl(codeVerifier: string, prompt?: boolean, additionalParams?: AuthorizationParameters | undefined): Promise<string>;
+    getTokenSetAndUserInfo(payload: Record<string, any>): Promise<[TokenSet, Record<string, unknown>, UserPayload]>;
 }
 export declare function createOpenIDAuthRouter(providerName: string): Router;

package/dist/auth/drivers/openid.js

@@ -1,15 +1,12 @@
 import { BaseException } from '@wbce-d9/exceptions';
-import { parseJSON } from '@wbce-d9/utils';
 import express, { Router } from 'express';
 import flatten from 'flat';
 import jwt from 'jsonwebtoken';
-import { errors, generators, Issuer } from 'openid-client';
+import { generators, Issuer } from 'openid-client';
 import { getAuthProvider } from '../../auth.js';
-import getDatabase from '../../database/index.js';
-import emitter from '../../emitter.js';
+import { GET_SET_HEADER } from '../../constants.js';
 import env from '../../env.js';
-import { RecordNotUniqueException } from '../../exceptions/database/record-not-unique.js';
-import { InvalidConfigException, InvalidCredentialsException, InvalidProviderException, InvalidTokenException, ServiceUnavailableException, } from '../../exceptions/index.js';
+import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException } from '../../exceptions/index.js';
 import logger from '../../logger.js';
 import { respond } from '../../middleware/respond.js';
 import { AuthenticationService } from '../../services/authentication.js';
@@ -17,14 +14,28 @@ import { UsersService } from '../../services/users.js';
 import asyncHandler from '../../utils/async-handler.js';
 import { getConfigFromEnv } from '../../utils/get-config-from-env.js';
 import { getIPFromReq } from '../../utils/get-ip-from-req.js';
-import { getMilliseconds } from '../../utils/get-milliseconds.js';
 import { Url } from '../../utils/url.js';
-import { LocalAuthDriver } from './local.js';
-export class OpenIDAuthDriver extends LocalAuthDriver {
+import { BaseOAuthDriver } from './baseoauth.js';
+export class OpenIDAuthDriver extends BaseOAuthDriver {
     client;
     redirectUrl;
     usersService;
     config;
+    getClient() {
+        return this.client;
+    }
+    getredirectUrl() {
+        return this.redirectUrl;
+    }
+    getUserService() {
+        return this.usersService;
+    }
+    getConfig() {
+        return this.config;
+    }
+    getClientName() {
+        return 'OpenID';
+    }
     constructor(options, config) {
         super(options, config);
         const { issuerUrl, clientId, clientSecret, ...additionalConfig } = config;
@@ -59,10 +70,7 @@ export class OpenIDAuthDriver extends LocalAuthDriver {
             });
         });
     }
-    generateCodeVerifier() {
-        return generators.codeVerifier();
-    }
-    async generateAuthUrl(codeVerifier, prompt = false) {
+    async generateAuthUrl(codeVerifier, prompt = false, additionalParams) {
         try {
             const client = await this.client;
             const codeChallenge = generators.codeChallenge(codeVerifier);
@@ -77,25 +85,14 @@ export class OpenIDAuthDriver extends LocalAuthDriver {
                 // Some providers require state even with PKCE
                 state: codeChallenge,
                 nonce: codeChallenge,
+                ...additionalParams,
             });
         }
         catch (e) {
-            throw handleError(e);
+            throw this.handleError(e);
         }
     }
-    async fetchUserId(identifier) {
-        const user = await this.knex
-            .select('id')
-            .from('directus_users')
-            .whereRaw('LOWER(??) = ?', ['external_identifier', identifier.toLowerCase()])
-            .first();
-        return user?.id;
-    }
-    async getUserID(payload) {
-        if (!payload['code'] || !payload['codeVerifier'] || !payload['state']) {
-            logger.warn('[OpenID] No code, codeVerifier or state in payload');
-            throw new InvalidCredentialsException();
-        }
+    async getTokenSetAndUserInfo(payload) {
         let tokenSet;
         let userInfo;
         try {
@@ -111,11 +108,11 @@ export class OpenIDAuthDriver extends LocalAuthDriver {
             }
         }
         catch (e) {
-            throw handleError(e);
+            throw this.handleError(e);
         }
         // Flatten response to support dot indexes
         userInfo = flatten(userInfo);
-        const { provider, identifierKey, allowPublicRegistration, requireVerifiedEmail } = this.config;
+        const { provider, identifierKey } = this.config;
         const email = userInfo['email'] ? String(userInfo['email']) : undefined;
         // Fallback to email if explicit identifier not found
         const identifier = userInfo[identifierKey ?? 'sub'] ? String(userInfo[identifierKey ?? 'sub']) : email;
@@ -132,126 +129,9 @@ export class OpenIDAuthDriver extends LocalAuthDriver {
             role: this.config['defaultRoleId'],
             auth_data: tokenSet.refresh_token && JSON.stringify({ refreshToken: tokenSet.refresh_token }),
         };
-        const userId = await this.fetchUserId(identifier);
-        if (userId) {
-            // Run hook so the end user has the chance to augment the
-            // user that is about to be updated
-            const updatedUserPayload = await emitter.emitFilter(`auth.update`, {}, {
-                identifier,
-                provider: this.config['provider'],
-                providerPayload: { accessToken: tokenSet.access_token, userInfo },
-            }, { database: getDatabase(), schema: this.schema, accountability: null });
-            // Update user to update refresh_token and other properties that might have changed
-            await this.usersService.updateOne(userId, updatedUserPayload);
-            return userId;
-        }
-        const isEmailVerified = !requireVerifiedEmail || userInfo['email_verified'];
-        // Is public registration allowed?
-        if (!allowPublicRegistration || !isEmailVerified) {
-            logger.warn(`[OpenID] User doesn't exist, and public registration not allowed for provider "${provider}"`);
-            throw new InvalidCredentialsException();
-        }
-        // Run hook so the end user has the chance to augment the
-        // user that is about to be created
-        const updatedUserPayload = await emitter.emitFilter(`auth.create`, userPayload, {
-            identifier,
-            provider: this.config['provider'],
-            providerPayload: { accessToken: tokenSet.access_token, userInfo },
-        }, { database: getDatabase(), schema: this.schema, accountability: null });
-        try {
-            await this.usersService.createOne(updatedUserPayload);
-        }
-        catch (e) {
-            if (e instanceof RecordNotUniqueException) {
-                logger.warn(e, '[OpenID] Failed to register user. User not unique');
-                throw new InvalidProviderException();
-            }
-            throw e;
-        }
-        return (await this.fetchUserId(identifier));
-    }
-    async logout(user) {
-        let authData = user.auth_data;
-        if (typeof authData === 'string') {
-            try {
-                authData = parseJSON(authData);
-            }
-            catch {
-                logger.warn(`[OpenID] Session data isn't valid JSON: ${authData}`);
-            }
-        }
-        if (authData?.['refreshToken']) {
-            try {
-                const client = await this.client;
-                await client.revoke(authData['refreshToken']);
-                await this.usersService.updateOne(user.id, {
-                    auth_data: null,
-                });
-                logger.info(`[OpenID] Session closed for user.`);
-            }
-            catch (e) {
-                throw handleError(e);
-            }
-        }
-    }
-    async login(user) {
-        return this.refresh(user);
-    }
-    async refresh(user) {
-        let authData = user.auth_data;
-        if (typeof authData === 'string') {
-            try {
-                authData = parseJSON(authData);
-            }
-            catch {
-                logger.warn(`[OpenID] Session data isn't valid JSON: ${authData}`);
-            }
-        }
-        if (authData?.['refreshToken']) {
-            try {
-                const client = await this.client;
-                const tokenSet = await client.refresh(authData['refreshToken']);
-                // Update user refreshToken if provided
-                if (tokenSet.refresh_token) {
-                    await this.usersService.updateOne(user.id, {
-                        auth_data: JSON.stringify({ refreshToken: tokenSet.refresh_token }),
-                    });
-                }
-            }
-            catch (e) {
-                if (e.error === 'invalid_grant') {
-                    // Remove invalid token from the user store
-                    await this.usersService.updateOne(user.id, {
-                        auth_data: null,
-                    });
-                }
-                throw handleError(e);
-            }
-        }
+        return [tokenSet, userInfo, userPayload];
     }
 }
-const handleError = (e) => {
-    if (e instanceof errors.OPError) {
-        if (e.error === 'invalid_grant') {
-            // Invalid token
-            logger.trace(e, `[OpenID] Invalid grant`);
-            return new InvalidTokenException();
-        }
-        // Server response error
-        logger.trace(e, `[OpenID] Unknown OP error`);
-        return new ServiceUnavailableException('Service returned unexpected response', {
-            service: 'openid',
-            message: e.error_description,
-        });
-    }
-    else if (e instanceof errors.RPError) {
-        // Internal client error
-        logger.trace(e, `[OpenID] Unknown RP error`);
-        return new InvalidCredentialsException();
-    }
-    logger.trace(e, `[OpenID] Unknown error`);
-    return e;
-};
 export function createOpenIDAuthRouter(providerName) {
     const router = Router();
     router.get('/', asyncHandler(async (req, res) => {
@@ -266,7 +146,10 @@ export function createOpenIDAuthRouter(providerName) {
             httpOnly: true,
             sameSite: 'lax',
         });
-        return res.redirect(await provider.generateAuthUrl(codeVerifier, prompt));
+        const additionalParams = { ...req.query };
+        delete additionalParams['prompt'];
+        delete additionalParams['redirect'];
+        return res.redirect(await provider.generateAuthUrl(codeVerifier, prompt, additionalParams));
     }), respond);
     router.post('/callback', express.urlencoded({ extended: false }), (req, res) => {
         res.redirect(303, `./callback?${new URLSearchParams(req.body)}`);
@@ -328,13 +211,7 @@ export function createOpenIDAuthRouter(providerName) {
         }
         const { accessToken, refreshToken, expires } = authResponse;
         if (redirect) {
-            res.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, {
-                httpOnly: true,
-                domain: env['REFRESH_TOKEN_COOKIE_DOMAIN'],
-                maxAge: getMilliseconds(env['REFRESH_TOKEN_TTL']),
-                secure: env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false,
-                sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
-            });
+            res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
             return res.redirect(redirect);
         }
         res.locals['payload'] = {

package/dist/auth/drivers/saml.js

@@ -3,7 +3,7 @@ import { BaseException } from '@wbce-d9/exceptions';
 import express, { Router } from 'express';
 import * as samlify from 'samlify';
 import { getAuthProvider } from '../../auth.js';
-import { COOKIE_OPTIONS } from '../../constants.js';
+import { COOKIE_OPTIONS, GET_SET_HEADER } from '../../constants.js';
 import getDatabase from '../../database/index.js';
 import emitter from '../../emitter.js';
 import env from '../../env.js';
@@ -121,7 +121,7 @@ export function createSAMLAuthRouter(providerName) {
                 },
             };
             if (relayState) {
-                res.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, COOKIE_OPTIONS);
+                res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
                 return res.redirect(relayState);
             }
             return next();

package/dist/auth.js

@@ -10,10 +10,11 @@ import { getSchema } from './utils/get-schema.js';
 const providerNames = toArray(env['AUTH_PROVIDERS']);
 const providers = new Map();
 export function getAuthProvider(provider) {
-    if (!providers.has(provider)) {
+    const name = provider.toLowerCase();
+    if (!providers.has(name)) {
         throw new InvalidConfigException('Auth provider not configured', { provider });
     }
-    return providers.get(provider);
+    return providers.get(name);
 }
 export async function registerAuthProviders() {
     const options = { knex: getDatabase(), schema: await getSchema() };
@@ -42,7 +43,7 @@ export async function registerAuthProviders() {
             logger.warn(`Invalid "${driver}" auth driver.`);
             return;
         }
-        providers.set(name, provider);
+        providers.set(name.toLowerCase(), provider);
     });
 }
 function getProviderInstance(driver, options, config = {}) {

package/dist/constants.d.ts

@@ -9,6 +9,7 @@ export declare const COLUMN_TRANSFORMS: string[];
 export declare const GENERATE_SPECIAL: string[];
 export declare const UUID_REGEX = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 export declare const COOKIE_OPTIONS: CookieOptions;
+export declare const GET_SET_HEADER: (cookieValue: string) => string;
 export declare const OAS_REQUIRED_SCHEMAS: string[];
 /** Formats from which transformation is supported */
 export declare const SUPPORTED_IMAGE_TRANSFORM_FORMATS: string[];

package/dist/constants.js

@@ -55,6 +55,12 @@ export const COOKIE_OPTIONS = {
     secure: env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false,
     sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
 };
+export const GET_SET_HEADER = (cookieValue) => {
+    const domainHeader = env['REFRESH_TOKEN_COOKIE_DOMAIN'] ? ` Domain=${env['REFRESH_TOKEN_COOKIE_DOMAIN']};` : '';
+    const partitionedHeader = env['REFRESH_TOKEN_COOKIE_PARTITIONED'] == false ? '' : ` Partitioned;`;
+    const cookieHeaderValue = `${env['REFRESH_TOKEN_COOKIE_NAME']}=${cookieValue}; HttpOnly; Max-Age=${getMilliseconds(env['REFRESH_TOKEN_TTL'])}; Secure=${env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false}; SameSite=${env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict'}; Path=/;${domainHeader}${partitionedHeader}`;
+    return cookieHeaderValue;
+};
 export const OAS_REQUIRED_SCHEMAS = ['Diff', 'Schema', 'Query', 'x-metadata'];
 /** Formats from which transformation is supported */
 export const SUPPORTED_IMAGE_TRANSFORM_FORMATS = ['image/jpeg', 'image/png', 'image/webp', 'image/tiff', 'image/avif'];

package/dist/controllers/auth.js

@@ -1,6 +1,6 @@
 import { Router } from 'express';
 import { createLDAPAuthRouter, createLocalAuthRouter, createOAuth2AuthRouter, createOpenIDAuthRouter, createSAMLAuthRouter, } from '../auth/drivers/index.js';
-import { COOKIE_OPTIONS, DEFAULT_AUTH_PROVIDER } from '../constants.js';
+import { DEFAULT_AUTH_PROVIDER, GET_SET_HEADER } from '../constants.js';
 import env from '../env.js';
 import { InvalidPayloadException } from '../exceptions/index.js';
 import logger from '../logger.js';
@@ -68,7 +68,7 @@ router.post('/refresh', asyncHandler(async (req, res, next) => {
         payload['data']['refresh_token'] = refreshToken;
     }
     if (mode === 'cookie') {
-        res.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, COOKIE_OPTIONS);
+        res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
     }
     res.locals['payload'] = payload;
     return next();

package/dist/controllers/shares.js

@@ -1,7 +1,6 @@
 import express from 'express';
 import Joi from 'joi';
-import { COOKIE_OPTIONS, UUID_REGEX } from '../constants.js';
-import env from '../env.js';
+import { GET_SET_HEADER, UUID_REGEX } from '../constants.js';
 import { ForbiddenException, InvalidPayloadException } from '../exceptions/index.js';
 import { respond } from '../middleware/respond.js';
 import useCollection from '../middleware/use-collection.js';
@@ -25,7 +24,7 @@ router.post('/auth', asyncHandler(async (req, res, next) => {
         throw new InvalidPayloadException(error.message);
     }
     const { accessToken, refreshToken, expires } = await service.login(req.body);
-    res.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, COOKIE_OPTIONS);
+    res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
     res.locals['payload'] = { data: { access_token: accessToken, expires } };
     return next();
 }), respond);

package/dist/services/authentication.js

@@ -83,7 +83,7 @@ export class AuthenticationService {
                 throw new InvalidCredentialsException();
             }
         }
-        else if (user.provider !== providerName) {
+        else if (user.provider.toLowerCase() !== providerName.toLowerCase()) {
             await stall(STALL_TIME, timeStart);
             throw new InvalidProviderException();
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "9.29.0",
+  "version": "10.1.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -145,17 +145,17 @@
     "wellknown": "0.5.0",
     "@wbce-d9/app": "9.29.0",
     "@wbce-d9/constants": "9.26.3",
+    "@wbce-d9/exceptions": "9.26.3",
     "@wbce-d9/schema": "9.26.3",
     "@wbce-d9/extensions-sdk": "9.26.5",
-    "@wbce-d9/exceptions": "9.26.3",
     "@wbce-d9/specs": "9.26.3",
     "@wbce-d9/storage": "9.26.3",
     "@wbce-d9/storage-driver-azure": "9.26.5",
     "@wbce-d9/storage-driver-cloudinary": "9.26.5",
-    "@wbce-d9/storage-driver-gcs": "9.26.5",
     "@wbce-d9/storage-driver-local": "9.26.5",
-    "@wbce-d9/utils": "9.28.0",
     "@wbce-d9/storage-driver-s3": "9.26.7",
+    "@wbce-d9/utils": "9.28.0",
+    "@wbce-d9/storage-driver-gcs": "9.26.5",
     "@wbce-d9/update-check": "9.26.3"
   },
   "devDependencies": {