@directus/api/dist/utils/get-accountability-for-token.js

Directus is a real-time API and App dashboard for managing SQL database content

import database_default from "../database/index.js";
import { fetchRolesTree } from "../permissions/lib/fetch-roles-tree.js";
import { fetchGlobalAccess } from "../permissions/modules/fetch-global-access/fetch-global-access.js";
import { getSecret } from "./get-secret.js";
import { createDefaultAccountability } from "../permissions/utils/create-default-accountability.js";
import { verifyAccessJWT } from "./jwt.js";
import isDirectusJWT from "./is-directus-jwt.js";
import { parseOAuthScope } from "./parse-oauth-scope.js";
import { verifySessionJWT } from "./verify-session-jwt.js";
import { InvalidCredentialsError } from "@directus/errors";

//#region src/utils/get-accountability-for-token.ts
async function getAccountabilityForToken(token, accountability) {
	if (!accountability) accountability = createDefaultAccountability();
	const database = database_default();
	if (token) if (isDirectusJWT(token)) {
		const payload = verifyAccessJWT(token, getSecret());
		if ("session" in payload) {
			const { oauth_client } = await verifySessionJWT(payload);
			accountability.session = payload.session;
			if (oauth_client !== null) {
				let aud;
				if (Array.isArray(payload.aud)) aud = payload.aud;
				else if (payload.aud) aud = [String(payload.aud)];
				else aud = [];
				accountability.oauth = {
					client: oauth_client,
					scopes: parseOAuthScope(payload.scope),
					aud
				};
			}
		}
		if (payload.share) accountability.share = payload.share;
		if (payload.id) accountability.user = payload.id;
		accountability.role = payload.role;
		accountability.roles = await fetchRolesTree(payload.role, { knex: database });
		const { admin, app } = await fetchGlobalAccess(accountability, { knex: database });
		accountability.admin = admin;
		accountability.app = app;
	} else {
		const user = await database.select("directus_users.id", "directus_users.role").from("directus_users").where({
			"directus_users.token": token,
			status: "active"
		}).first();
		if (!user) throw new InvalidCredentialsError();
		accountability.user = user.id;
		accountability.role = user.role;
		accountability.roles = await fetchRolesTree(user.role, { knex: database });
		const { admin, app } = await fetchGlobalAccess(accountability, { knex: database });
		accountability.admin = admin;
		accountability.app = app;
	}
	return accountability;
}

//#endregion
export { getAccountabilityForToken };