Merge branch 'main' into fix-21658-collection-sorting

directus · May 8, 2024 · 40d0ac8 · 40d0ac8
2 parents e8cde05 + 438b423
commit 40d0ac8
Show file tree

Hide file tree

Showing 184 changed files with 2,339 additions and 857 deletions.
diff --git a/.changeset/big-kiwis-happen.md b/.changeset/big-kiwis-happen.md
diff --git a/.changeset/big-shrimps-prove.md b/.changeset/big-shrimps-prove.md
diff --git a/.changeset/blue-lies-double.md b/.changeset/blue-lies-double.md
diff --git a/.changeset/brave-chairs-switch.md b/.changeset/brave-chairs-switch.md
diff --git a/.changeset/bright-mirrors-rush.md b/.changeset/bright-mirrors-rush.md
diff --git a/.changeset/chilly-papayas-drive.md b/.changeset/chilly-papayas-drive.md
diff --git a/.changeset/curvy-fishes-work.md b/.changeset/curvy-fishes-work.md
diff --git a/.changeset/fluffy-walls-destroy.md b/.changeset/fluffy-walls-destroy.md
diff --git a/.changeset/four-eggs-wait.md b/.changeset/four-eggs-wait.md
diff --git a/.changeset/good-elephants-knock.md b/.changeset/good-elephants-knock.md
diff --git a/.changeset/green-sloths-sparkle.md b/.changeset/green-sloths-sparkle.md
diff --git a/.changeset/late-lions-pump.md b/.changeset/late-lions-pump.md
diff --git a/.changeset/little-ducks-own.md b/.changeset/little-ducks-own.md
diff --git a/.changeset/long-toes-pull.md b/.changeset/long-toes-pull.md
diff --git a/.changeset/lucky-rivers-taste.md b/.changeset/lucky-rivers-taste.md
diff --git a/.changeset/purple-shirts-care.md b/.changeset/purple-shirts-care.md
diff --git a/.changeset/quick-onions-beam.md b/.changeset/quick-onions-beam.md
diff --git a/.changeset/rude-brooms-cry.md b/.changeset/rude-brooms-cry.md
diff --git a/.changeset/rude-carrots-confess.md b/.changeset/rude-carrots-confess.md
diff --git a/.changeset/rude-cougars-suffer.md b/.changeset/rude-cougars-suffer.md
diff --git a/.changeset/selfish-sloths-double.md b/.changeset/selfish-sloths-double.md
diff --git a/.changeset/seven-brooms-applaud.md b/.changeset/seven-brooms-applaud.md
diff --git a/.changeset/shiny-avocados-eat.md b/.changeset/shiny-avocados-eat.md
diff --git a/.changeset/six-bags-play.md b/.changeset/six-bags-play.md
diff --git a/.changeset/six-tigers-pull.md b/.changeset/six-tigers-pull.md
diff --git a/.changeset/smooth-ears-buy.md b/.changeset/smooth-ears-buy.md
diff --git a/.changeset/smooth-games-hug.md b/.changeset/smooth-games-hug.md
diff --git a/.changeset/soft-pigs-applaud.md b/.changeset/soft-pigs-applaud.md
diff --git a/.changeset/strong-bulldogs-type.md b/.changeset/strong-bulldogs-type.md
diff --git a/.changeset/stupid-dingos-drop.md b/.changeset/stupid-dingos-drop.md
diff --git a/.changeset/stupid-laws-jog.md b/.changeset/stupid-laws-jog.md
diff --git a/.changeset/stupid-singers-smash.md b/.changeset/stupid-singers-smash.md
diff --git a/.changeset/swift-dryers-shake.md b/.changeset/swift-dryers-shake.md
diff --git a/.changeset/thick-chicken-swim.md b/.changeset/thick-chicken-swim.md
diff --git a/.changeset/tough-rocks-do.md b/.changeset/tough-rocks-do.md
diff --git a/.changeset/twelve-owls-tickle.md b/.changeset/twelve-owls-tickle.md
diff --git a/.changeset/twelve-sloths-beg.md b/.changeset/twelve-sloths-beg.md
diff --git a/.changeset/unlucky-bugs-refuse.md b/.changeset/unlucky-bugs-refuse.md
diff --git a/.changeset/warm-bees-glow.md b/.changeset/warm-bees-glow.md
diff --git a/.changeset/yellow-tigers-explain.md b/.changeset/yellow-tigers-explain.md
diff --git a/api/package.json b/api/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@directus/api",
-	"version": "19.0.2",
+	"version": "19.1.0",
 	"description": "Directus is a real-time API and App dashboard for managing SQL database content",
 	"keywords": [
 		"directus",
@@ -170,7 +170,7 @@
 		"snappy": "7.2.2",
 		"stream-json": "1.8.0",
 		"tar": "7.0.1",
-		"tsx": "4.9.0",
+		"tsx": "4.9.3",
 		"wellknown": "0.5.0",
 		"ws": "8.17.0",
 		"zod": "3.23.6",

diff --git a/api/src/app.test.ts b/api/src/app.test.ts
@@ -71,7 +71,6 @@ vi.mock('./utils/validate-env.js');
 
 beforeEach(() => {
 	vi.mocked(useEnv).mockReturnValue({
-		KEY: 'xxxxxxx-xxxxxx-xxxxxxxx-xxxxxxxxxx',
 		SECRET: 'abcdef',
 		SERVE_APP: 'true',
 		PUBLIC_URL: 'http://localhost:8055/directus',

diff --git a/api/src/app.ts b/api/src/app.ts
@@ -65,7 +65,6 @@ import schema from './middleware/schema.js';
 import { initTelemetry } from './telemetry/index.js';
 import { getConfigFromEnv } from './utils/get-config-from-env.js';
 import { Url } from './utils/url.js';
-import { validateEnv } from './utils/validate-env.js';
 import { validateStorage } from './utils/validate-storage.js';
 
 const require = createRequire(import.meta.url);
@@ -75,16 +74,7 @@ export default async function createApp(): Promise<express.Application> {
 	const logger = useLogger();
 	const helmet = await import('helmet');
 
-	validateEnv(['KEY', 'SECRET']);
-
-	if (!new Url(env['PUBLIC_URL'] as string).isAbsolute()) {
-		logger.warn('PUBLIC_URL should be a full URL');
-	}
-
-	await validateStorage();
-
 	await validateDatabaseConnection();
-	await validateDatabaseExtensions();
 
 	if ((await isInstalled()) === false) {
 		logger.error(`Database doesn't have Directus tables installed.`);
@@ -95,6 +85,19 @@ export default async function createApp(): Promise<express.Application> {
 		logger.warn(`Database migrations have not all been run`);
 	}
 
+	if (!env['SECRET']) {
+		logger.warn(
+			`"SECRET" env variable is missing. Using a random value instead. Tokens will not persist between restarts. This is not appropriate for production usage.`,
+		);
+	}
+
+	if (!new Url(env['PUBLIC_URL'] as string).isAbsolute()) {
+		logger.warn('"PUBLIC_URL" should be a full URL');
+	}
+
+	await validateDatabaseExtensions();
+	await validateStorage();
+
 	await registerAuthProviders();
 
 	const extensionManager = getExtensionManager();

diff --git a/api/src/auth/drivers/oauth2.ts b/api/src/auth/drivers/oauth2.ts
@@ -31,6 +31,7 @@ import { getIPFromReq } from '../../utils/get-ip-from-req.js';
 import { isLoginRedirectAllowed } from '../../utils/is-login-redirect-allowed.js';
 import { Url } from '../../utils/url.js';
 import { LocalAuthDriver } from './local.js';
+import { getSecret } from '../../utils/get-secret.js';
 
 export class OAuth2AuthDriver extends LocalAuthDriver {
 	client: Client;
@@ -306,7 +307,7 @@ export function createOAuth2AuthRouter(providerName: string): Router {
 				throw new InvalidPayloadError({ reason: `URL "${redirect}" can't be used to redirect after login` });
 			}
 
-			const token = jwt.sign({ verifier: codeVerifier, redirect, prompt }, env['SECRET'] as string, {
+			const token = jwt.sign({ verifier: codeVerifier, redirect, prompt }, getSecret(), {
 				expiresIn: '5m',
 				issuer: 'directus',
 			});
@@ -338,7 +339,7 @@ export function createOAuth2AuthRouter(providerName: string): Router {
 			let tokenData;
 
 			try {
-				tokenData = jwt.verify(req.cookies[`oauth2.${providerName}`], env['SECRET'] as string, {
+				tokenData = jwt.verify(req.cookies[`oauth2.${providerName}`], getSecret(), {
 					issuer: 'directus',
 				}) as {
 					verifier: string;