directus 9.2.0 → 9.2.1

package/dist/auth/drivers/ldap.js

@@ -94,7 +94,10 @@ class LDAPAuthDriver extends auth_1.AuthDriver {
         const { userDn, userAttribute, userScope } = this.config;
         return new Promise((resolve, reject) => {
             // Search for the user in LDAP by attribute
-            this.bindClient.search(userDn, { filter: `(${userAttribute !== null && userAttribute !== void 0 ? userAttribute : 'cn'}=${identifier})`, scope: userScope !== null && userScope !== void 0 ? userScope : 'one' }, (err, res) => {
+            this.bindClient.search(userDn, {
+                filter: new ldapjs_1.EqualityFilter({ attribute: userAttribute !== null && userAttribute !== void 0 ? userAttribute : 'cn', value: identifier }),
+                scope: userScope !== null && userScope !== void 0 ? userScope : 'one',
+            }, (err, res) => {
                 if (err) {
                     reject(handleError(err));
                     return;
@@ -151,7 +154,7 @@ class LDAPAuthDriver extends auth_1.AuthDriver {
             // Search for the user info in LDAP by group attribute
             this.bindClient.search(groupDn, {
                 attributes: ['cn'],
-                filter: `(${groupAttribute !== null && groupAttribute !== void 0 ? groupAttribute : 'member'}=${userDn})`,
+                filter: new ldapjs_1.EqualityFilter({ attribute: groupAttribute !== null && groupAttribute !== void 0 ? groupAttribute : 'member', value: userDn }),
                 scope: groupScope !== null && groupScope !== void 0 ? groupScope : 'one',
             }, (err, res) => {
                 if (err) {

package/dist/auth/drivers/oauth2.d.ts

@@ -10,7 +10,7 @@ export declare class OAuth2AuthDriver extends LocalAuthDriver {
     config: Record<string, any>;
     constructor(options: AuthDriverOptions, config: Record<string, any>);
     generateCodeVerifier(): string;
-    generateAuthUrl(codeVerifier: string): string;
+    generateAuthUrl(codeVerifier: string, prompt?: boolean): string;
     private fetchUserId;
     getUserID(payload: Record<string, any>): Promise<string>;
     login(user: User): Promise<SessionData>;

package/dist/auth/drivers/oauth2.js

@@ -32,7 +32,8 @@ class OAuth2AuthDriver extends local_1.LocalAuthDriver {
             authorization_endpoint: authorizeUrl,
             token_endpoint: accessUrl,
             userinfo_endpoint: profileUrl,
-            issuer: additionalConfig.provider,
+            // Required for openid providers (openid flow should be preferred!)
+            issuer: additionalConfig.issuerUrl,
         });
         this.client = new issuer.Client({
             client_id: clientId,
@@ -44,17 +45,20 @@ class OAuth2AuthDriver extends local_1.LocalAuthDriver {
     generateCodeVerifier() {
         return openid_client_1.generators.codeVerifier();
     }
-    generateAuthUrl(codeVerifier) {
+    generateAuthUrl(codeVerifier, prompt = false) {
         var _a;
         try {
             const codeChallenge = openid_client_1.generators.codeChallenge(codeVerifier);
+            const paramsConfig = typeof this.config.params === 'object' ? this.config.params : {};
             return this.client.authorizationUrl({
                 scope: (_a = this.config.scope) !== null && _a !== void 0 ? _a : 'email',
+                access_type: 'offline',
+                prompt: prompt ? 'consent' : undefined,
+                ...paramsConfig,
                 code_challenge: codeChallenge,
                 code_challenge_method: 'S256',
                 // Some providers require state even with PKCE
                 state: codeChallenge,
-                access_type: 'offline',
             });
         }
         catch (e) {
@@ -72,6 +76,7 @@ class OAuth2AuthDriver extends local_1.LocalAuthDriver {
     async getUserID(payload) {
         var _a;
         if (!payload.code || !payload.codeVerifier) {
+            logger_1.default.trace('[OAuth2] No code or codeVerifier in payload');
             throw new exceptions_1.InvalidCredentialsException();
         }
         let tokenSet;
@@ -112,6 +117,7 @@ class OAuth2AuthDriver extends local_1.LocalAuthDriver {
         }
         // Is public registration allowed?
         if (!allowPublicRegistration) {
+            logger_1.default.trace(`[OAuth2] User doesn't exist, and public registration not allowed for provider "${this.config.provider}"`);
             throw new exceptions_1.InvalidCredentialsException();
         }
         await this.usersService.createOne({
@@ -136,35 +142,44 @@ class OAuth2AuthDriver extends local_1.LocalAuthDriver {
                 logger_1.default.warn(`Session data isn't valid JSON: ${authData}`);
             }
         }
-        if (!(authData === null || authData === void 0 ? void 0 : authData.refreshToken)) {
-            return sessionData;
-        }
-        try {
-            const tokenSet = await this.client.refresh(authData.refreshToken);
-            return { accessToken: tokenSet.access_token };
-        }
-        catch (e) {
-            throw handleError(e);
+        if (authData === null || authData === void 0 ? void 0 : authData.refreshToken) {
+            try {
+                const tokenSet = await this.client.refresh(authData.refreshToken);
+                // Update user refreshToken if provided
+                if (tokenSet.refresh_token) {
+                    await this.usersService.updateOne(user.id, {
+                        auth_data: JSON.stringify({ refreshToken: tokenSet.refresh_token }),
+                    });
+                }
+            }
+            catch (e) {
+                throw handleError(e);
+            }
         }
+        return sessionData;
     }
 }
 exports.OAuth2AuthDriver = OAuth2AuthDriver;
 const handleError = (e) => {
     if (e instanceof openid_client_1.errors.OPError) {
         if (e.error === 'invalid_grant') {
+            logger_1.default.trace(e, `[OAuth2] Invalid grant.`);
             // Invalid token
-            return new exceptions_1.InvalidCredentialsException();
+            return new exceptions_1.InvalidTokenException();
         }
+        logger_1.default.trace(e, `[OAuth2] Unknown OP error.`);
         // Server response error
         return new exceptions_1.ServiceUnavailableException('Service returned unexpected response', {
-            service: 'openid',
+            service: 'oauth2',
             message: e.error_description,
         });
     }
     else if (e instanceof openid_client_1.errors.RPError) {
         // Internal client error
+        logger_1.default.trace(e, `[OAuth2] Unknown RP error.`);
         return new exceptions_1.InvalidCredentialsException();
     }
+    logger_1.default.trace(e, `[OAuth2] Unknown error.`);
     return e;
 };
 function createOAuth2AuthRouter(providerName) {
@@ -172,7 +187,8 @@ function createOAuth2AuthRouter(providerName) {
     router.get('/', (req, res) => {
         const provider = (0, auth_1.getAuthProvider)(providerName);
         const codeVerifier = provider.generateCodeVerifier();
-        const token = jsonwebtoken_1.default.sign({ verifier: codeVerifier, redirect: req.query.redirect }, env_1.default.SECRET, {
+        const prompt = !!req.query.prompt;
+        const token = jsonwebtoken_1.default.sign({ verifier: codeVerifier, redirect: req.query.redirect, prompt }, env_1.default.SECRET, {
             expiresIn: '5m',
             issuer: 'directus',
         });
@@ -180,7 +196,7 @@ function createOAuth2AuthRouter(providerName) {
             httpOnly: true,
             sameSite: 'lax',
         });
-        return res.redirect(provider.generateAuthUrl(codeVerifier));
+        return res.redirect(provider.generateAuthUrl(codeVerifier, prompt));
     }, respond_1.respond);
     router.get('/callback', (0, async_handler_1.default)(async (req, res, next) => {
         var _a;
@@ -189,9 +205,10 @@ function createOAuth2AuthRouter(providerName) {
             tokenData = jsonwebtoken_1.default.verify(req.cookies[`oauth2.${providerName}`], env_1.default.SECRET, { issuer: 'directus' });
         }
         catch (e) {
+            logger_1.default.warn(e, `[OAuth2] Couldn't verify OAuth2 cookie`);
             throw new exceptions_1.InvalidCredentialsException();
         }
-        const { verifier, redirect } = tokenData;
+        const { verifier, redirect, prompt } = tokenData;
         const authenticationService = new services_1.AuthenticationService({
             accountability: {
                 ip: req.ip,
@@ -204,7 +221,7 @@ function createOAuth2AuthRouter(providerName) {
         try {
             res.clearCookie(`oauth2.${providerName}`);
             if (!req.query.code || !req.query.state) {
-                logger_1.default.warn(`Couldn't extract OAuth2 code or state from query: ${JSON.stringify(req.query)}`);
+                logger_1.default.warn(`[OAuth2]Couldn't extract OAuth2 code or state from query: ${JSON.stringify(req.query)}`);
             }
             authResponse = await authenticationService.login(providerName, {
                 code: req.query.code,
@@ -213,7 +230,10 @@ function createOAuth2AuthRouter(providerName) {
             });
         }
         catch (error) {
-            logger_1.default.warn(error);
+            // Prompt user for a new refresh_token if invalidated
+            if (error instanceof exceptions_1.InvalidTokenException && !prompt) {
+                return res.redirect(`./?${redirect ? `redirect=${redirect}&` : ''}prompt=true`);
+            }
             if (redirect) {
                 let reason = 'UNKNOWN_EXCEPTION';
                 if (error instanceof exceptions_1.ServiceUnavailableException) {
@@ -222,8 +242,15 @@ function createOAuth2AuthRouter(providerName) {
                 else if (error instanceof exceptions_1.InvalidCredentialsException) {
                     reason = 'INVALID_USER';
                 }
+                else if (error instanceof exceptions_1.InvalidTokenException) {
+                    reason = 'INVALID_TOKEN';
+                }
+                else {
+                    logger_1.default.warn(error, `[OAuth2] Unexpected error during OAuth2 login`);
+                }
                 return res.redirect(`${redirect.split('?')[0]}?reason=${reason}`);
             }
+            logger_1.default.warn(error, `[OAuth2] Unexpected error during OAuth2 login`);
             throw error;
         }
         const { accessToken, refreshToken, expires } = authResponse;

package/dist/auth/drivers/openid.d.ts

@@ -10,7 +10,7 @@ export declare class OpenIDAuthDriver extends LocalAuthDriver {
     config: Record<string, any>;
     constructor(options: AuthDriverOptions, config: Record<string, any>);
     generateCodeVerifier(): string;
-    generateAuthUrl(codeVerifier: string): Promise<string>;
+    generateAuthUrl(codeVerifier: string, prompt?: boolean): Promise<string>;
     private fetchUserId;
     getUserID(payload: Record<string, any>): Promise<string>;
     login(user: User): Promise<SessionData>;

package/dist/auth/drivers/openid.js

@@ -50,18 +50,21 @@ class OpenIDAuthDriver extends local_1.LocalAuthDriver {
     generateCodeVerifier() {
         return openid_client_1.generators.codeVerifier();
     }
-    async generateAuthUrl(codeVerifier) {
+    async generateAuthUrl(codeVerifier, prompt = false) {
         var _a;
         try {
             const client = await this.client;
             const codeChallenge = openid_client_1.generators.codeChallenge(codeVerifier);
+            const paramsConfig = typeof this.config.params === 'object' ? this.config.params : {};
             return client.authorizationUrl({
                 scope: (_a = this.config.scope) !== null && _a !== void 0 ? _a : 'openid profile email',
+                access_type: 'offline',
+                prompt: prompt ? 'consent' : undefined,
+                ...paramsConfig,
                 code_challenge: codeChallenge,
                 code_challenge_method: 'S256',
                 // Some providers require state even with PKCE
                 state: codeChallenge,
-                access_type: 'offline',
             });
         }
         catch (e) {
@@ -144,17 +147,22 @@ class OpenIDAuthDriver extends local_1.LocalAuthDriver {
                 logger_1.default.warn(`Session data isn't valid JSON: ${authData}`);
             }
         }
-        if (!(authData === null || authData === void 0 ? void 0 : authData.refreshToken)) {
-            return sessionData;
-        }
-        try {
-            const client = await this.client;
-            const tokenSet = await client.refresh(authData.refreshToken);
-            return { accessToken: tokenSet.access_token };
-        }
-        catch (e) {
-            throw handleError(e);
+        if (authData === null || authData === void 0 ? void 0 : authData.refreshToken) {
+            try {
+                const client = await this.client;
+                const tokenSet = await client.refresh(authData.refreshToken);
+                // Update user refreshToken if provided
+                if (tokenSet.refresh_token) {
+                    await this.usersService.updateOne(user.id, {
+                        auth_data: JSON.stringify({ refreshToken: tokenSet.refresh_token }),
+                    });
+                }
+            }
+            catch (e) {
+                throw handleError(e);
+            }
         }
+        return sessionData;
     }
 }
 exports.OpenIDAuthDriver = OpenIDAuthDriver;
@@ -162,7 +170,7 @@ const handleError = (e) => {
     if (e instanceof openid_client_1.errors.OPError) {
         if (e.error === 'invalid_grant') {
             // Invalid token
-            return new exceptions_1.InvalidCredentialsException();
+            return new exceptions_1.InvalidTokenException();
         }
         // Server response error
         return new exceptions_1.ServiceUnavailableException('Service returned unexpected response', {
@@ -181,7 +189,8 @@ function createOpenIDAuthRouter(providerName) {
     router.get('/', (0, async_handler_1.default)(async (req, res) => {
         const provider = (0, auth_1.getAuthProvider)(providerName);
         const codeVerifier = provider.generateCodeVerifier();
-        const token = jsonwebtoken_1.default.sign({ verifier: codeVerifier, redirect: req.query.redirect }, env_1.default.SECRET, {
+        const prompt = !!req.query.prompt;
+        const token = jsonwebtoken_1.default.sign({ verifier: codeVerifier, redirect: req.query.redirect, prompt }, env_1.default.SECRET, {
             expiresIn: '5m',
             issuer: 'directus',
         });
@@ -189,7 +198,7 @@ function createOpenIDAuthRouter(providerName) {
             httpOnly: true,
             sameSite: 'lax',
         });
-        return res.redirect(await provider.generateAuthUrl(codeVerifier));
+        return res.redirect(await provider.generateAuthUrl(codeVerifier, prompt));
     }), respond_1.respond);
     router.get('/callback', (0, async_handler_1.default)(async (req, res, next) => {
         var _a;
@@ -198,9 +207,10 @@ function createOpenIDAuthRouter(providerName) {
             tokenData = jsonwebtoken_1.default.verify(req.cookies[`openid.${providerName}`], env_1.default.SECRET, { issuer: 'directus' });
         }
         catch (e) {
+            logger_1.default.warn(e, `[OpenID] Couldn't verify OpenID cookie`);
             throw new exceptions_1.InvalidCredentialsException();
         }
-        const { verifier, redirect } = tokenData;
+        const { verifier, redirect, prompt } = tokenData;
         const authenticationService = new services_1.AuthenticationService({
             accountability: {
                 ip: req.ip,
@@ -213,7 +223,7 @@ function createOpenIDAuthRouter(providerName) {
         try {
             res.clearCookie(`openid.${providerName}`);
             if (!req.query.code || !req.query.state) {
-                logger_1.default.warn(`Couldn't extract OpenID code or state from query: ${JSON.stringify(req.query)}`);
+                logger_1.default.warn(`[OpenID] Couldn't extract OpenID code or state from query: ${JSON.stringify(req.query)}`);
             }
             authResponse = await authenticationService.login(providerName, {
                 code: req.query.code,
@@ -222,6 +232,10 @@ function createOpenIDAuthRouter(providerName) {
             });
         }
         catch (error) {
+            // Prompt user for a new refresh_token if invalidated
+            if (error instanceof exceptions_1.InvalidTokenException && !prompt) {
+                return res.redirect(`./?${redirect ? `redirect=${redirect}&` : ''}prompt=true`);
+            }
             logger_1.default.warn(error);
             if (redirect) {
                 let reason = 'UNKNOWN_EXCEPTION';
@@ -231,6 +245,9 @@ function createOpenIDAuthRouter(providerName) {
                 else if (error instanceof exceptions_1.InvalidCredentialsException) {
                     reason = 'INVALID_USER';
                 }
+                else if (error instanceof exceptions_1.InvalidTokenException) {
+                    reason = 'INVALID_TOKEN';
+                }
                 return res.redirect(`${redirect.split('?')[0]}?reason=${reason}`);
             }
             throw error;

package/dist/exceptions/index.d.ts

@@ -8,6 +8,7 @@ export * from './invalid-ip';
 export * from './invalid-otp';
 export * from './invalid-payload';
 export * from './invalid-query';
+export * from './invalid-token';
 export * from './method-not-allowed';
 export * from './range-not-satisfiable';
 export * from './route-not-found';

package/dist/exceptions/index.js

@@ -20,6 +20,7 @@ __exportStar(require("./invalid-ip"), exports);
 __exportStar(require("./invalid-otp"), exports);
 __exportStar(require("./invalid-payload"), exports);
 __exportStar(require("./invalid-query"), exports);
+__exportStar(require("./invalid-token"), exports);
 __exportStar(require("./method-not-allowed"), exports);
 __exportStar(require("./range-not-satisfiable"), exports);
 __exportStar(require("./route-not-found"), exports);

package/dist/exceptions/invalid-token.d.ts

@@ -0,0 +1,4 @@
+import { BaseException } from '@directus/shared/exceptions';
+export declare class InvalidTokenException extends BaseException {
+    constructor(message?: string);
+}

package/dist/exceptions/invalid-token.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidTokenException = void 0;
+const exceptions_1 = require("@directus/shared/exceptions");
+class InvalidTokenException extends exceptions_1.BaseException {
+    constructor(message = 'Invalid token') {
+        super(message, 403, 'INVALID_TOKEN');
+    }
+}
+exports.InvalidTokenException = InvalidTokenException;

package/dist/utils/apply-query.js

@@ -8,7 +8,6 @@ const lodash_1 = require("lodash");
 const nanoid_1 = require("nanoid");
 const uuid_validate_1 = __importDefault(require("uuid-validate"));
 const exceptions_1 = require("../exceptions");
-const apply_function_to_column_name_1 = require("./apply-function-to-column-name");
 const get_column_1 = require("./get-column");
 const get_relation_type_1 = require("./get-relation-type");
 const helpers_1 = require("../database/helpers");
@@ -44,7 +43,7 @@ function applyQuery(knex, collection, dbQuery, query, schema, subQuery = false)
         applySearch(schema, dbQuery, query.search, collection);
     }
     if (query.group) {
-        dbQuery.groupBy(`${collection}.${query.group.map(apply_function_to_column_name_1.applyFunctionToColumnName)}`);
+        dbQuery.groupBy(query.group.map((column) => (0, get_column_1.getColumn)(knex, collection, column, false)));
     }
     if (query.aggregate) {
         applyAggregate(dbQuery, query.aggregate, collection);

package/dist/utils/merge-permissions.js

@@ -23,13 +23,13 @@ function mergePerm(currentPerm, newPerm) {
     let validation = currentPerm.validation;
     let fields = currentPerm.fields;
     let presets = currentPerm.presets;
-    if (newPerm.permissions && !(0, lodash_1.isEmpty)(newPerm.permissions)) {
+    if (newPerm.permissions) {
         if (currentPerm.permissions && Object.keys(currentPerm.permissions)[0] === '_or') {
             permissions = {
                 _or: [...currentPerm.permissions._or, newPerm.permissions],
             };
         }
-        else if (currentPerm.permissions && !(0, lodash_1.isEmpty)(currentPerm.permissions)) {
+        else if (currentPerm.permissions) {
             permissions = {
                 _or: [currentPerm.permissions, newPerm.permissions],
             };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "directus",
-	"version": "9.2.0",
+	"version": "9.2.1",
 	"license": "GPL-3.0-only",
 	"homepage": "https://github.com/directus/directus#readme",
 	"description": "Directus is a real-time API and App dashboard for managing SQL database content.",
@@ -76,16 +76,16 @@
 	],
 	"dependencies": {
 		"@aws-sdk/client-ses": "^3.40.0",
-		"@directus/app": "9.2.0",
-		"@directus/drive": "9.2.0",
-		"@directus/drive-azure": "9.2.0",
-		"@directus/drive-gcs": "9.2.0",
-		"@directus/drive-s3": "9.2.0",
-		"@directus/extensions-sdk": "9.2.0",
-		"@directus/format-title": "9.2.0",
-		"@directus/schema": "9.2.0",
-		"@directus/shared": "9.2.0",
-		"@directus/specs": "9.2.0",
+		"@directus/app": "9.2.1",
+		"@directus/drive": "9.2.1",
+		"@directus/drive-azure": "9.2.1",
+		"@directus/drive-gcs": "9.2.1",
+		"@directus/drive-s3": "9.2.1",
+		"@directus/extensions-sdk": "9.2.1",
+		"@directus/format-title": "9.2.1",
+		"@directus/schema": "9.2.1",
+		"@directus/shared": "9.2.1",
+		"@directus/specs": "9.2.1",
 		"@godaddy/terminus": "^4.9.0",
 		"@rollup/plugin-alias": "^3.1.2",
 		"@rollup/plugin-virtual": "^2.0.3",
@@ -169,7 +169,7 @@
 		"sqlite3": "^5.0.2",
 		"tedious": "^13.0.0"
 	},
-	"gitHead": "776c105aacfda559a1ebf49cb2220599652f6c48",
+	"gitHead": "1d4e9c425c10bcdc5831ae63c1bd03649648eb5e",
 	"devDependencies": {
 		"@types/async": "3.2.10",
 		"@types/atob": "2.1.2",
@@ -199,7 +199,7 @@
 		"@types/nodemailer": "6.4.4",
 		"@types/object-hash": "2.2.1",
 		"@types/qs": "6.9.7",
-		"@types/sanitize-html": "^2.5.0",
+		"@types/sanitize-html": "2.5.0",
 		"@types/sharp": "0.29.4",
 		"@types/stream-json": "1.7.1",
 		"@types/supertest": "2.0.11",