directus 9.23.4 → 9.25.0

package/dist/services/assets.d.ts

@@ -1,18 +0,0 @@
-/// <reference types="node" />
-import type { Range, Stat } from '@directus/storage';
-import type { Accountability } from '@directus/shared/types';
-import type { Knex } from 'knex';
-import type { Readable } from 'node:stream';
-import type { AbstractServiceOptions, TransformationParams, TransformationPreset } from '../types';
-import { AuthorizationService } from './authorization';
-export declare class AssetsService {
-    knex: Knex;
-    accountability: Accountability | null;
-    authorizationService: AuthorizationService;
-    constructor(options: AbstractServiceOptions);
-    getAsset(id: string, transformation: TransformationParams | TransformationPreset, range?: Range): Promise<{
-        stream: Readable;
-        file: any;
-        stat: Stat;
-    }>;
-}

package/dist/services/assets.js

@@ -1,179 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AssetsService = void 0;
-const lodash_1 = require("lodash");
-const mime_types_1 = require("mime-types");
-const object_hash_1 = __importDefault(require("object-hash"));
-const path_1 = __importDefault(require("path"));
-const sharp_1 = __importDefault(require("sharp"));
-const uuid_validate_1 = __importDefault(require("uuid-validate"));
-const database_1 = __importDefault(require("../database"));
-const env_1 = __importDefault(require("../env"));
-const exceptions_1 = require("../exceptions");
-const service_unavailable_1 = require("../exceptions/service-unavailable");
-const logger_1 = __importDefault(require("../logger"));
-const storage_1 = require("../storage");
-const get_milliseconds_1 = require("../utils/get-milliseconds");
-const TransformationUtils = __importStar(require("../utils/transformations"));
-const authorization_1 = require("./authorization");
-class AssetsService {
-    knex;
-    accountability;
-    authorizationService;
-    constructor(options) {
-        this.knex = options.knex || (0, database_1.default)();
-        this.accountability = options.accountability || null;
-        this.authorizationService = new authorization_1.AuthorizationService(options);
-    }
-    async getAsset(id, transformation, range) {
-        const storage = await (0, storage_1.getStorage)();
-        const publicSettings = await this.knex
-            .select('project_logo', 'public_background', 'public_foreground')
-            .from('directus_settings')
-            .first();
-        const systemPublicKeys = Object.values(publicSettings || {});
-        /**
-         * This is a little annoying. Postgres will error out if you're trying to search in `where`
-         * with a wrong type. In case of directus_files where id is a uuid, we'll have to verify the
-         * validity of the uuid ahead of time.
-         */
-        const isValidUUID = (0, uuid_validate_1.default)(id, 4);
-        if (isValidUUID === false)
-            throw new exceptions_1.ForbiddenException();
-        if (systemPublicKeys.includes(id) === false && this.accountability?.admin !== true) {
-            await this.authorizationService.checkAccess('read', 'directus_files', id);
-        }
-        const file = (await this.knex.select('*').from('directus_files').where({ id }).first());
-        if (!file)
-            throw new exceptions_1.ForbiddenException();
-        const exists = await storage.location(file.storage).exists(file.filename_disk);
-        if (!exists)
-            throw new exceptions_1.ForbiddenException();
-        if (range) {
-            const missingRangeLimits = range.start === undefined && range.end === undefined;
-            const endBeforeStart = range.start !== undefined && range.end !== undefined && range.end <= range.start;
-            const startOverflow = range.start !== undefined && range.start >= file.filesize;
-            const endUnderflow = range.end !== undefined && range.end <= 0;
-            if (missingRangeLimits || endBeforeStart || startOverflow || endUnderflow) {
-                throw new exceptions_1.RangeNotSatisfiableException(range);
-            }
-            const lastByte = file.filesize - 1;
-            if (range.end) {
-                if (range.start === undefined) {
-                    // fetch chunk from tail
-                    range.start = file.filesize - range.end;
-                    range.end = lastByte;
-                }
-                if (range.end >= file.filesize) {
-                    // fetch entire file
-                    range.end = lastByte;
-                }
-            }
-            if (range.start) {
-                if (range.end === undefined) {
-                    // fetch entire file
-                    range.end = lastByte;
-                }
-                if (range.start < 0) {
-                    // fetch file from head
-                    range.start = 0;
-                }
-            }
-        }
-        const type = file.type;
-        const transforms = TransformationUtils.resolvePreset(transformation, file);
-        // We can only transform JPEG, PNG, and WebP
-        if (type && transforms.length > 0 && ['image/jpeg', 'image/png', 'image/webp', 'image/tiff'].includes(type)) {
-            const maybeNewFormat = TransformationUtils.maybeExtractFormat(transforms);
-            const assetFilename = path_1.default.basename(file.filename_disk, path_1.default.extname(file.filename_disk)) +
-                getAssetSuffix(transforms) +
-                (maybeNewFormat ? `.${maybeNewFormat}` : path_1.default.extname(file.filename_disk));
-            const exists = await storage.location(file.storage).exists(assetFilename);
-            if (maybeNewFormat) {
-                file.type = (0, mime_types_1.contentType)(assetFilename) || null;
-            }
-            if (exists) {
-                return {
-                    stream: await storage.location(file.storage).read(assetFilename, range),
-                    file,
-                    stat: await storage.location(file.storage).stat(assetFilename),
-                };
-            }
-            // Check image size before transforming. Processing an image that's too large for the
-            // system memory will kill the API. Sharp technically checks for this too in it's
-            // limitInputPixels, but we should have that check applied before starting the read streams
-            const { width, height } = file;
-            if (!width ||
-                !height ||
-                width > env_1.default['ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION'] ||
-                height > env_1.default['ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION']) {
-                throw new exceptions_1.IllegalAssetTransformation(`Image is too large to be transformed, or image size couldn't be determined.`);
-            }
-            const { queue, process } = sharp_1.default.counters();
-            if (queue + process > env_1.default['ASSETS_TRANSFORM_MAX_CONCURRENT']) {
-                throw new service_unavailable_1.ServiceUnavailableException('Server too busy', {
-                    service: 'files',
-                });
-            }
-            const readStream = await storage.location(file.storage).read(file.filename_disk, range);
-            const transformer = (0, sharp_1.default)({
-                limitInputPixels: Math.pow(env_1.default['ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION'], 2),
-                sequentialRead: true,
-                failOn: env_1.default['ASSETS_INVALID_IMAGE_SENSITIVITY_LEVEL'],
-            });
-            transformer.timeout({
-                seconds: (0, lodash_1.clamp)(Math.round((0, get_milliseconds_1.getMilliseconds)(env_1.default['ASSETS_TRANSFORM_TIMEOUT'], 0) / 1000), 1, 3600),
-            });
-            if (transforms.find((transform) => transform[0] === 'rotate') === undefined)
-                transformer.rotate();
-            transforms.forEach(([method, ...args]) => transformer[method].apply(transformer, args));
-            readStream.on('error', (e) => {
-                logger_1.default.error(e, `Couldn't transform file ${file.id}`);
-                readStream.unpipe(transformer);
-            });
-            await storage.location(file.storage).write(assetFilename, readStream.pipe(transformer), type);
-            return {
-                stream: await storage.location(file.storage).read(assetFilename, range),
-                stat: await storage.location(file.storage).stat(assetFilename),
-                file,
-            };
-        }
-        else {
-            const readStream = await storage.location(file.storage).read(file.filename_disk, range);
-            const stat = await storage.location(file.storage).stat(file.filename_disk);
-            return { stream: readStream, file, stat };
-        }
-    }
-}
-exports.AssetsService = AssetsService;
-const getAssetSuffix = (transforms) => {
-    if (Object.keys(transforms).length === 0)
-        return '';
-    return `__${(0, object_hash_1.default)(transforms)}`;
-};

package/dist/services/authentication.d.ts

@@ -1,21 +0,0 @@
-import { Accountability, SchemaOverview } from '@directus/shared/types';
-import type { Knex } from 'knex';
-import type { AbstractServiceOptions, LoginResult } from '../types';
-import { ActivityService } from './activity';
-export declare class AuthenticationService {
-    knex: Knex;
-    accountability: Accountability | null;
-    activityService: ActivityService;
-    schema: SchemaOverview;
-    constructor(options: AbstractServiceOptions);
-    /**
-     * Retrieve the tokens for a given user email.
-     *
-     * Password is optional to allow usage of this function within the SSO flow and extensions. Make sure
-     * to handle password existence checks elsewhere
-     */
-    login(providerName: string | undefined, payload: Record<string, any>, otp?: string): Promise<LoginResult>;
-    refresh(refreshToken: string): Promise<Record<string, any>>;
-    logout(refreshToken: string): Promise<void>;
-    verifyPassword(userID: string, password: string): Promise<void>;
-}

package/dist/services/authentication.js

@@ -1,332 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthenticationService = void 0;
-const types_1 = require("@directus/shared/types");
-const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
-const lodash_1 = require("lodash");
-const perf_hooks_1 = require("perf_hooks");
-const auth_1 = require("../auth");
-const constants_1 = require("../constants");
-const database_1 = __importDefault(require("../database"));
-const emitter_1 = __importDefault(require("../emitter"));
-const env_1 = __importDefault(require("../env"));
-const exceptions_1 = require("../exceptions");
-const rate_limiter_1 = require("../rate-limiter");
-const get_milliseconds_1 = require("../utils/get-milliseconds");
-const stall_1 = require("../utils/stall");
-const activity_1 = require("./activity");
-const settings_1 = require("./settings");
-const tfa_1 = require("./tfa");
-const loginAttemptsLimiter = (0, rate_limiter_1.createRateLimiter)('RATE_LIMITER', { duration: 0 });
-class AuthenticationService {
-    knex;
-    accountability;
-    activityService;
-    schema;
-    constructor(options) {
-        this.knex = options.knex || (0, database_1.default)();
-        this.accountability = options.accountability || null;
-        this.activityService = new activity_1.ActivityService({ knex: this.knex, schema: options.schema });
-        this.schema = options.schema;
-    }
-    /**
-     * Retrieve the tokens for a given user email.
-     *
-     * Password is optional to allow usage of this function within the SSO flow and extensions. Make sure
-     * to handle password existence checks elsewhere
-     */
-    async login(providerName = constants_1.DEFAULT_AUTH_PROVIDER, payload, otp) {
-        const { nanoid } = await import('nanoid');
-        const STALL_TIME = env_1.default['LOGIN_STALL_TIME'];
-        const timeStart = perf_hooks_1.performance.now();
-        const provider = (0, auth_1.getAuthProvider)(providerName);
-        let userId;
-        try {
-            userId = await provider.getUserID((0, lodash_1.cloneDeep)(payload));
-        }
-        catch (err) {
-            await (0, stall_1.stall)(STALL_TIME, timeStart);
-            throw err;
-        }
-        const user = await this.knex
-            .select('u.id', 'u.first_name', 'u.last_name', 'u.email', 'u.password', 'u.status', 'u.role', 'r.admin_access', 'r.app_access', 'u.tfa_secret', 'u.provider', 'u.external_identifier', 'u.auth_data')
-            .from('directus_users as u')
-            .leftJoin('directus_roles as r', 'u.role', 'r.id')
-            .where('u.id', userId)
-            .first();
-        const updatedPayload = await emitter_1.default.emitFilter('auth.login', payload, {
-            status: 'pending',
-            user: user?.id,
-            provider: providerName,
-        }, {
-            database: this.knex,
-            schema: this.schema,
-            accountability: this.accountability,
-        });
-        const emitStatus = (status) => {
-            emitter_1.default.emitAction('auth.login', {
-                payload: updatedPayload,
-                status,
-                user: user?.id,
-                provider: providerName,
-            }, {
-                database: this.knex,
-                schema: this.schema,
-                accountability: this.accountability,
-            });
-        };
-        if (user?.status !== 'active') {
-            emitStatus('fail');
-            if (user?.status === 'suspended') {
-                await (0, stall_1.stall)(STALL_TIME, timeStart);
-                throw new exceptions_1.UserSuspendedException();
-            }
-            else {
-                await (0, stall_1.stall)(STALL_TIME, timeStart);
-                throw new exceptions_1.InvalidCredentialsException();
-            }
-        }
-        else if (user.provider !== providerName) {
-            await (0, stall_1.stall)(STALL_TIME, timeStart);
-            throw new exceptions_1.InvalidProviderException();
-        }
-        const settingsService = new settings_1.SettingsService({
-            knex: this.knex,
-            schema: this.schema,
-        });
-        const { auth_login_attempts: allowedAttempts } = await settingsService.readSingleton({
-            fields: ['auth_login_attempts'],
-        });
-        if (allowedAttempts !== null) {
-            loginAttemptsLimiter.points = allowedAttempts;
-            try {
-                await loginAttemptsLimiter.consume(user.id);
-            }
-            catch {
-                await this.knex('directus_users').update({ status: 'suspended' }).where({ id: user.id });
-                user.status = 'suspended';
-                // This means that new attempts after the user has been re-activated will be accepted
-                await loginAttemptsLimiter.set(user.id, 0, 0);
-            }
-        }
-        try {
-            await provider.login((0, lodash_1.clone)(user), (0, lodash_1.cloneDeep)(updatedPayload));
-        }
-        catch (e) {
-            emitStatus('fail');
-            await (0, stall_1.stall)(STALL_TIME, timeStart);
-            throw e;
-        }
-        if (user.tfa_secret && !otp) {
-            emitStatus('fail');
-            await (0, stall_1.stall)(STALL_TIME, timeStart);
-            throw new exceptions_1.InvalidOTPException(`"otp" is required`);
-        }
-        if (user.tfa_secret && otp) {
-            const tfaService = new tfa_1.TFAService({ knex: this.knex, schema: this.schema });
-            const otpValid = await tfaService.verifyOTP(user.id, otp);
-            if (otpValid === false) {
-                emitStatus('fail');
-                await (0, stall_1.stall)(STALL_TIME, timeStart);
-                throw new exceptions_1.InvalidOTPException(`"otp" is invalid`);
-            }
-        }
-        const tokenPayload = {
-            id: user.id,
-            role: user.role,
-            app_access: user.app_access,
-            admin_access: user.admin_access,
-        };
-        const customClaims = await emitter_1.default.emitFilter('auth.jwt', tokenPayload, {
-            status: 'pending',
-            user: user?.id,
-            provider: providerName,
-            type: 'login',
-        }, {
-            database: this.knex,
-            schema: this.schema,
-            accountability: this.accountability,
-        });
-        const accessToken = jsonwebtoken_1.default.sign(customClaims, env_1.default['SECRET'], {
-            expiresIn: env_1.default['ACCESS_TOKEN_TTL'],
-            issuer: 'directus',
-        });
-        const refreshToken = nanoid(64);
-        const refreshTokenExpiration = new Date(Date.now() + (0, get_milliseconds_1.getMilliseconds)(env_1.default['REFRESH_TOKEN_TTL'], 0));
-        await this.knex('directus_sessions').insert({
-            token: refreshToken,
-            user: user.id,
-            expires: refreshTokenExpiration,
-            ip: this.accountability?.ip,
-            user_agent: this.accountability?.userAgent,
-            origin: this.accountability?.origin,
-        });
-        await this.knex('directus_sessions').delete().where('expires', '<', new Date());
-        if (this.accountability) {
-            await this.activityService.createOne({
-                action: types_1.Action.LOGIN,
-                user: user.id,
-                ip: this.accountability.ip,
-                user_agent: this.accountability.userAgent,
-                origin: this.accountability.origin,
-                collection: 'directus_users',
-                item: user.id,
-            });
-        }
-        await this.knex('directus_users').update({ last_access: new Date() }).where({ id: user.id });
-        emitStatus('success');
-        if (allowedAttempts !== null) {
-            await loginAttemptsLimiter.set(user.id, 0, 0);
-        }
-        await (0, stall_1.stall)(STALL_TIME, timeStart);
-        return {
-            accessToken,
-            refreshToken,
-            expires: (0, get_milliseconds_1.getMilliseconds)(env_1.default['ACCESS_TOKEN_TTL']),
-            id: user.id,
-        };
-    }
-    async refresh(refreshToken) {
-        const { nanoid } = await import('nanoid');
-        if (!refreshToken) {
-            throw new exceptions_1.InvalidCredentialsException();
-        }
-        const record = await this.knex
-            .select({
-            session_expires: 's.expires',
-            user_id: 'u.id',
-            user_first_name: 'u.first_name',
-            user_last_name: 'u.last_name',
-            user_email: 'u.email',
-            user_password: 'u.password',
-            user_status: 'u.status',
-            user_provider: 'u.provider',
-            user_external_identifier: 'u.external_identifier',
-            user_auth_data: 'u.auth_data',
-            role_id: 'r.id',
-            role_admin_access: 'r.admin_access',
-            role_app_access: 'r.app_access',
-            share_id: 'd.id',
-            share_item: 'd.item',
-            share_role: 'd.role',
-            share_collection: 'd.collection',
-            share_start: 'd.date_start',
-            share_end: 'd.date_end',
-            share_times_used: 'd.times_used',
-            share_max_uses: 'd.max_uses',
-        })
-            .from('directus_sessions AS s')
-            .leftJoin('directus_users AS u', 's.user', 'u.id')
-            .leftJoin('directus_shares AS d', 's.share', 'd.id')
-            .leftJoin('directus_roles AS r', (join) => {
-            join.onIn('r.id', [this.knex.ref('u.role'), this.knex.ref('d.role')]);
-        })
-            .where('s.token', refreshToken)
-            .andWhere('s.expires', '>=', new Date())
-            .andWhere((subQuery) => {
-            subQuery.whereNull('d.date_end').orWhere('d.date_end', '>=', new Date());
-        })
-            .andWhere((subQuery) => {
-            subQuery.whereNull('d.date_start').orWhere('d.date_start', '<=', new Date());
-        })
-            .first();
-        if (!record || (!record.share_id && !record.user_id)) {
-            throw new exceptions_1.InvalidCredentialsException();
-        }
-        if (record.user_id) {
-            const provider = (0, auth_1.getAuthProvider)(record.user_provider);
-            await provider.refresh({
-                id: record.user_id,
-                first_name: record.user_first_name,
-                last_name: record.user_last_name,
-                email: record.user_email,
-                password: record.user_password,
-                status: record.user_status,
-                provider: record.user_provider,
-                external_identifier: record.user_external_identifier,
-                auth_data: record.user_auth_data,
-                role: record.role_id,
-                app_access: record.role_app_access,
-                admin_access: record.role_admin_access,
-            });
-        }
-        const tokenPayload = {
-            id: record.user_id,
-            role: record.role_id,
-            app_access: record.role_app_access,
-            admin_access: record.role_admin_access,
-        };
-        if (record.share_id) {
-            tokenPayload.share = record.share_id;
-            tokenPayload.role = record.share_role;
-            tokenPayload.share_scope = {
-                collection: record.share_collection,
-                item: record.share_item,
-            };
-            tokenPayload.app_access = false;
-            tokenPayload.admin_access = false;
-            delete tokenPayload.id;
-        }
-        const customClaims = await emitter_1.default.emitFilter('auth.jwt', tokenPayload, {
-            status: 'pending',
-            user: record.user_id,
-            provider: record.user_provider,
-            type: 'refresh',
-        }, {
-            database: this.knex,
-            schema: this.schema,
-            accountability: this.accountability,
-        });
-        const accessToken = jsonwebtoken_1.default.sign(customClaims, env_1.default['SECRET'], {
-            expiresIn: env_1.default['ACCESS_TOKEN_TTL'],
-            issuer: 'directus',
-        });
-        const newRefreshToken = nanoid(64);
-        const refreshTokenExpiration = new Date(Date.now() + (0, get_milliseconds_1.getMilliseconds)(env_1.default['REFRESH_TOKEN_TTL'], 0));
-        await this.knex('directus_sessions')
-            .update({
-            token: newRefreshToken,
-            expires: refreshTokenExpiration,
-        })
-            .where({ token: refreshToken });
-        if (record.user_id) {
-            await this.knex('directus_users').update({ last_access: new Date() }).where({ id: record.user_id });
-        }
-        return {
-            accessToken,
-            refreshToken: newRefreshToken,
-            expires: (0, get_milliseconds_1.getMilliseconds)(env_1.default['ACCESS_TOKEN_TTL']),
-            id: record.user_id,
-        };
-    }
-    async logout(refreshToken) {
-        const record = await this.knex
-            .select('u.id', 'u.first_name', 'u.last_name', 'u.email', 'u.password', 'u.status', 'u.role', 'u.provider', 'u.external_identifier', 'u.auth_data')
-            .from('directus_sessions as s')
-            .innerJoin('directus_users as u', 's.user', 'u.id')
-            .where('s.token', refreshToken)
-            .first();
-        if (record) {
-            const user = record;
-            const provider = (0, auth_1.getAuthProvider)(user.provider);
-            await provider.logout((0, lodash_1.clone)(user));
-            await this.knex.delete().from('directus_sessions').where('token', refreshToken);
-        }
-    }
-    async verifyPassword(userID, password) {
-        const user = await this.knex
-            .select('id', 'first_name', 'last_name', 'email', 'password', 'status', 'role', 'provider', 'external_identifier', 'auth_data')
-            .from('directus_users')
-            .where('id', userID)
-            .first();
-        if (!user) {
-            throw new exceptions_1.InvalidCredentialsException();
-        }
-        const provider = (0, auth_1.getAuthProvider)(user.provider);
-        await provider.verify((0, lodash_1.clone)(user), password);
-    }
-}
-exports.AuthenticationService = AuthenticationService;

package/dist/services/authorization.d.ts

@@ -1,17 +0,0 @@
-import type { Accountability, PermissionsAction, SchemaOverview } from '@directus/shared/types';
-import type { Knex } from 'knex';
-import type { AbstractServiceOptions, AST, Item, PrimaryKey } from '../types';
-import { PayloadService } from './payload';
-export declare class AuthorizationService {
-    knex: Knex;
-    accountability: Accountability | null;
-    payloadService: PayloadService;
-    schema: SchemaOverview;
-    constructor(options: AbstractServiceOptions);
-    processAST(ast: AST, action?: PermissionsAction): Promise<AST>;
-    /**
-     * Checks if the provided payload matches the configured permissions, and adds the presets to the payload.
-     */
-    validatePayload(action: PermissionsAction, collection: string, data: Partial<Item>): Partial<Item>;
-    checkAccess(action: PermissionsAction, collection: string, pk: PrimaryKey | PrimaryKey[]): Promise<void>;
-}