@directus/api 10.0.0 → 10.2.0

package/dist/utils/apply-query.js

@@ -188,8 +188,9 @@ export function applyFilter(knex, schema, rootQuery, rootFilter, collection, ali
             if (key === '_or' || key === '_and') {
                 // If the _or array contains an empty object (full permissions), we should short-circuit and ignore all other
                 // permission checks, as {} already matches full permissions.
-                if (key === '_or' && value.some((subFilter) => Object.keys(subFilter).length === 0))
+                if (key === '_or' && value.some((subFilter) => Object.keys(subFilter).length === 0)) {
                     continue;
+                }
                 value.forEach((subFilter) => {
                     addJoins(dbQuery, subFilter, collection);
                 });
@@ -197,7 +198,7 @@ export function applyFilter(knex, schema, rootQuery, rootFilter, collection, ali
             }
             const filterPath = getFilterPath(key, value);
             if (filterPath.length > 1 ||
-                (!(key.includes('(') && key.includes(')')) && schema.collections[collection].fields[key].type === 'alias')) {
+                (!(key.includes('(') && key.includes(')')) && schema.collections[collection]?.fields[key]?.type === 'alias')) {
                 const hasMultiRelational = addJoin({
                     path: filterPath,
                     collection,
@@ -237,7 +238,7 @@ export function applyFilter(knex, schema, rootQuery, rootFilter, collection, ali
             const { relation, relationType } = getRelationInfo(relations, collection, pathRoot);
             const { operator: filterOperator, value: filterValue } = getOperation(key, value);
             if (filterPath.length > 1 ||
-                (!(key.includes('(') && key.includes(')')) && schema.collections[collection].fields[key].type === 'alias')) {
+                (!(key.includes('(') && key.includes(')')) && schema.collections[collection]?.fields[key]?.type === 'alias')) {
                 if (!relation)
                     continue;
                 if (relationType === 'o2m' || relationType === 'o2a') {
@@ -484,8 +485,10 @@ export async function applySearch(schema, dbQuery, searchQuery, collection) {
             }
             else if (['bigInteger', 'integer', 'decimal', 'float'].includes(field.type)) {
                 const number = Number(searchQuery);
-                if (!isNaN(number))
+                // only cast finite base10 numeric values
+                if (validateNumber(searchQuery, number)) {
                     this.orWhere({ [`${collection}.${name}`]: number });
+                }
             }
             else if (field.type === 'uuid' && validate(searchQuery)) {
                 this.orWhere({ [`${collection}.${name}`]: searchQuery });
@@ -493,6 +496,13 @@ export async function applySearch(schema, dbQuery, searchQuery, collection) {
         });
     });
 }
+function validateNumber(value, parsed) {
+    if (isNaN(parsed) || !Number.isFinite(parsed))
+        return false;
+    // casting parsed value back to string should be equal the original value
+    // (prevent unintended number parsing, e.g. String(7) !== "ob111")
+    return String(parsed) === value;
+}
 export function applyAggregate(dbQuery, aggregate, collection) {
     for (const [operation, fields] of Object.entries(aggregate)) {
         if (!fields)

package/dist/utils/sanitize-error.d.ts

@@ -0,0 +1 @@
+export declare function sanitizeError<T extends Error>(error: T): T;

package/dist/utils/sanitize-error.js

@@ -0,0 +1,7 @@
+export function sanitizeError(error) {
+    // clear the stack
+    if (error.stack !== undefined) {
+        delete error.stack;
+    }
+    return error;
+}

package/dist/utils/sanitize-query.js

@@ -1,15 +1,24 @@
 import { parseFilter, parseJSON } from '@directus/utils';
 import { flatten, get, isPlainObject, merge, set } from 'lodash-es';
+import { getEnv } from '../env.js';
 import logger from '../logger.js';
 import { Meta } from '../types/index.js';
 export function sanitizeQuery(rawQuery, accountability) {
     const query = {};
+    const env = getEnv();
+    const hasMaxLimit = 'QUERY_LIMIT_MAX' in env &&
+        Number(env['QUERY_LIMIT_MAX']) >= 0 &&
+        !Number.isNaN(Number(env['QUERY_LIMIT_MAX'])) &&
+        Number.isFinite(Number(env['QUERY_LIMIT_MAX']));
     if (rawQuery['limit'] !== undefined) {
         const limit = sanitizeLimit(rawQuery['limit']);
         if (typeof limit === 'number') {
-            query.limit = limit;
+            query.limit = limit === -1 && hasMaxLimit ? Number(env['QUERY_LIMIT_MAX']) : limit;
         }
     }
+    else if (hasMaxLimit) {
+        query.limit = Math.min(Number(env['QUERY_LIMIT_DEFAULT']), Number(env['QUERY_LIMIT_MAX']));
+    }
     if (rawQuery['fields']) {
         query.fields = sanitizeFields(rawQuery['fields']);
     }
@@ -25,7 +34,7 @@ export function sanitizeQuery(rawQuery, accountability) {
     if (rawQuery['filter']) {
         query.filter = sanitizeFilter(rawQuery['filter'], accountability || null);
     }
-    if (rawQuery['offset']) {
+    if (rawQuery['offset'] !== undefined) {
         query.offset = sanitizeOffset(rawQuery['offset']);
     }
     if (rawQuery['page']) {

package/dist/utils/transformations.d.ts

@@ -1,5 +1,5 @@
-import type { File, Transformation, TransformationParams } from '../types/index.js';
-export declare function resolvePreset(input: TransformationParams, file: File): Transformation[];
+import type { File, Transformation, TransformationSet } from '../types/index.js';
+export declare function resolvePreset({ transformationParams, acceptFormat }: TransformationSet, file: File): Transformation[];
 /**
  * Try to extract a file format from an array of `Transformation`'s.
  */

package/dist/utils/transformations.js

@@ -1,25 +1,44 @@
-export function resolvePreset(input, file) {
-    const transforms = input.transforms ?? [];
-    if (input.format || input.quality)
+export function resolvePreset({ transformationParams, acceptFormat }, file) {
+    const transforms = transformationParams.transforms ? [...transformationParams.transforms] : [];
+    if (transformationParams.format || transformationParams.quality) {
         transforms.push([
             'toFormat',
-            input.format || file.type.split('/')[1],
+            getFormat(file, transformationParams.format, acceptFormat),
             {
-                quality: input.quality ? Number(input.quality) : undefined,
+                quality: transformationParams.quality ? Number(transformationParams.quality) : undefined,
             },
         ]);
-    if (input.width || input.height)
+    }
+    if (transformationParams.width || transformationParams.height) {
         transforms.push([
             'resize',
             {
-                width: input.width ? Number(input.width) : undefined,
-                height: input.height ? Number(input.height) : undefined,
-                fit: input.fit,
-                withoutEnlargement: input.withoutEnlargement ? Boolean(input.withoutEnlargement) : undefined,
+                width: transformationParams.width ? Number(transformationParams.width) : undefined,
+                height: transformationParams.height ? Number(transformationParams.height) : undefined,
+                fit: transformationParams.fit,
+                withoutEnlargement: transformationParams.withoutEnlargement
+                    ? Boolean(transformationParams.withoutEnlargement)
+                    : undefined,
             },
         ]);
+    }
     return transforms;
 }
+function getFormat(file, format, acceptFormat) {
+    const fileType = file.type?.split('/')[1];
+    if (format) {
+        if (format !== 'auto') {
+            return format;
+        }
+        if (acceptFormat) {
+            return acceptFormat;
+        }
+        if (fileType && ['avif', 'webp', 'tiff'].includes(fileType)) {
+            return 'png';
+        }
+    }
+    return fileType || 'jpg';
+}
 /**
  * Try to extract a file format from an array of `Transformation`'s.
  */

package/dist/utils/validate-query.js

@@ -9,7 +9,9 @@ const querySchema = Joi.object({
     group: Joi.array().items(Joi.string()),
     sort: Joi.array().items(Joi.string()),
     filter: Joi.object({}).unknown(),
-    limit: Joi.number().integer().min(-1),
+    limit: 'QUERY_LIMIT_MAX' in env && env['QUERY_LIMIT_MAX'] !== -1
+        ? Joi.number().integer().min(-1).max(env['QUERY_LIMIT_MAX']) // min should be 0
+        : Joi.number().integer().min(-1),
     offset: Joi.number().integer().min(0),
     page: Joi.number().integer().min(0),
     meta: Joi.array().items(Joi.string().valid('total_count', 'filter_count')),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "10.0.0",
+  "version": "10.2.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -58,9 +58,7 @@
   },
   "main": "dist/index.js",
   "files": [
-    "dist",
-    "!**/*.test.js",
-    "!**/__*__/"
+    "dist"
   ],
   "dependencies": {
     "@authenio/samlify-node-xmllint": "2.0.0",
@@ -141,22 +139,23 @@
     "tsx": "3.12.6",
     "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
-    "vm2": "3.9.17",
+    "vm2": "3.9.18",
     "wellknown": "0.5.0",
-    "@directus/app": "10.0.0",
-    "@directus/constants": "10.0.0",
-    "@directus/exceptions": "10.0.0",
-    "@directus/extensions-sdk": "10.0.0",
-    "@directus/schema": "10.0.0",
-    "@directus/specs": "10.0.0",
-    "@directus/storage": "10.0.0",
-    "@directus/storage-driver-azure": "10.0.0",
-    "@directus/storage-driver-cloudinary": "10.0.0",
-    "@directus/storage-driver-gcs": "10.0.0",
-    "@directus/storage-driver-local": "10.0.0",
-    "@directus/storage-driver-s3": "10.0.0",
-    "@directus/update-check": "10.0.0",
-    "@directus/utils": "10.0.0"
+    "@directus/app": "10.2.0",
+    "@directus/constants": "10.1.0",
+    "@directus/exceptions": "10.0.1",
+    "@directus/extensions-sdk": "10.1.1",
+    "@directus/pressure": "1.0.1",
+    "@directus/schema": "10.0.1",
+    "@directus/specs": "10.1.0",
+    "@directus/storage": "10.0.1",
+    "@directus/storage-driver-azure": "10.0.2",
+    "@directus/storage-driver-cloudinary": "10.0.2",
+    "@directus/storage-driver-gcs": "10.0.2",
+    "@directus/storage-driver-local": "10.0.2",
+    "@directus/storage-driver-s3": "10.0.2",
+    "@directus/update-check": "10.0.1",
+    "@directus/utils": "10.0.2"
   },
   "devDependencies": {
     "@directus/tsconfig": "0.0.7",
@@ -197,14 +196,14 @@
     "@types/uuid": "9.0.1",
     "@types/uuid-validate": "0.0.1",
     "@types/wellknown": "0.5.4",
-    "@vitest/coverage-c8": "0.30.1",
+    "@vitest/coverage-c8": "0.31.0",
     "copyfiles": "2.4.1",
     "form-data": "4.0.0",
     "knex-mock-client": "2.0.0",
     "supertest": "6.3.3",
     "typescript": "5.0.4",
-    "vitest": "0.30.1",
-    "@directus/types": "10.0.0"
+    "vitest": "0.31.0",
+    "@directus/types": "10.0.1"
   },
   "optionalDependencies": {
     "@keyv/redis": "2.5.7",
@@ -221,7 +220,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "build": "tsc --build && copyfiles \"src/**/*.{yaml,liquid}\" -u 1 dist",
+    "build": "tsc --project tsconfig.prod.json && copyfiles \"src/**/*.{yaml,liquid}\" -u 1 dist",
     "cli": "NODE_ENV=development SERVE_APP=false tsx src/cli/run.ts",
     "dev": "NODE_ENV=development SERVE_APP=false tsx watch --clear-screen=false src/start.ts",
     "test": "vitest --watch=false"

package/dist/app.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/controllers/files.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/database/migrations/run.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/env.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/logger.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/middleware/authenticate.test.d.ts

@@ -1 +0,0 @@
-import '../../src/types/express.d.ts';

package/dist/middleware/extract-token.test.d.ts

@@ -1 +0,0 @@
-import '../../src/types/express.d.ts';

package/dist/middleware/validate-batch.test.d.ts

@@ -1 +0,0 @@
-import '../../src/types/express.d.ts';

package/dist/operations/condition/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/exec/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/item-create/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/item-delete/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/item-read/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/item-update/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/log/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/mail/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/notification/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/request/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/sleep/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/transform/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/operations/trigger/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/request/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/request/request-interceptor.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/request/response-interceptor.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/request/validate-ip.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/services/files.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/services/graphql/utils/process-error.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/services/items.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/services/payload.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/services/roles.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/services/schema.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/services/specifications.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/services/users.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/services/webhooks.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/get-storage-driver.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/register-drivers.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/storage/register-locations.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/apply-diff.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/apply-function-to-column-name.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/apply-snapshot.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/async-handler.test.d.ts

@@ -1 +0,0 @@
-import '../../src/types/express.d.ts';

package/dist/utils/calculate-field-depth.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/filter-items.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-auth-providers.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-cache-headers.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-cache-key.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-collection-from-alias.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-column-path.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-config-from-env.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-date-formatted.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-graphql-query-and-variables.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-milliseconds.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-relation-info.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-relation-type.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-string-byte-size.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/get-versioned-hash.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/is-directus-jwt.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/jwt.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/map-values-deep.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/md.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/merge-permissions.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/sanitize-query.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/sanitize-schema.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/should-skip-cache.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/stall.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/strip-function.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/url.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/user-name.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/validate-diff.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/validate-env.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/validate-keys.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/validate-query.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/utils/validate-snapshot.test.d.ts

@@ -1 +0,0 @@
-export {};