directus

1
import type { ExtensionSandboxRequestedScopes } from '@directus/extensions';
2
import encodeUrl from 'encodeurl';
3
import globToRegExp from 'glob-to-regexp';
4
import type { Reference } from 'isolated-vm';
5
import { getAxios } from '../../../../../request/index.js';
6

7
export function requestGenerator(requestedScopes: ExtensionSandboxRequestedScopes): (
8
	url: Reference<string>,
9
	options: Reference<{
10
		method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
11
		body?: Record<string, any> | string;
12
		headers?: Record<string, string>;
13
	}>,
14
) => Promise<{
15
	status: number;
16
	statusText: string;
17
	headers: Record<string, any>;
18
	data: string;
19
}> {
20
	return async (url, options) => {
21
		if (url.typeof !== 'string') throw new TypeError('Request url has to be of type string');
22

23
		if (options.typeof !== 'undefined' && options.typeof !== 'object') {
24
			throw new TypeError('Request options has to be of type object');
25
		}
26

27
		const urlCopied = await url.copy();
28

29
		const permissions = requestedScopes.request;
30

31
		if (permissions === undefined) throw new Error('No permission to access "request"');
32

33
		const urlAllowed = permissions.urls.some((urlScope) => {
34
			const regex = globToRegExp(urlScope);
35
			return regex.test(urlCopied);
36
		});
37

38
		if (urlAllowed === false) {
39
			throw new Error(`No permission to request "${urlCopied}"`);
40
		}
41

42
		const method = options.typeof !== 'undefined' ? await options.get('method', { reference: true }) : undefined;
43
		const body = options.typeof !== 'undefined' ? await options.get('body', { reference: true }) : undefined;
44
		const headers = options.typeof !== 'undefined' ? await options.get('headers', { reference: true }) : undefined;
45

46
		if (method !== undefined && method.typeof !== 'undefined' && method.typeof !== 'string') {
47
			throw new TypeError('Request method has to be of type string');
48
		}
49

50
		if (body !== undefined && body.typeof !== 'undefined' && body.typeof !== 'string' && body.typeof !== 'object') {
51
			throw new TypeError('Request body has to be of type string or object');
52
		}
53

54
		if (headers !== undefined && headers.typeof !== 'undefined' && headers.typeof !== 'object') {
55
			throw new TypeError('Request headers has to be of type object');
56
		}
57

58
		const methodCopied = await method?.copy();
59
		const bodyCopied = await body?.copy();
60
		const headersCopied = await headers?.copy();
61

62
		if (!permissions.methods.includes(methodCopied ?? 'GET')) {
63
			throw new Error(`No permission to use request method "${methodCopied}"`);
64
		}
65

66
		const axios = await getAxios();
67

68
		const result = await axios({
69
			url: encodeUrl(urlCopied),
70
			method: methodCopied ?? 'GET',
71
			data: bodyCopied ?? null,
72
			headers: headersCopied ?? {},
73
		});
74

75
		return { status: result.status, statusText: result.statusText, headers: result.headers, data: result.data };
76
	};
77
}
78