@directus/api 10.1.0 → 10.2.0

package/dist/auth/drivers/oauth2.js

@@ -117,7 +117,7 @@ export class OAuth2AuthDriver extends LocalAuthDriver {
         if (userId) {
             // Run hook so the end user has the chance to augment the
             // user that is about to be updated
-            const updatedUserPayload = await emitter.emitFilter(`auth.update`, { auth_data: userPayload.auth_data }, {
+            const updatedUserPayload = await emitter.emitFilter(`auth.update`, { auth_data: userPayload.auth_data ?? null }, {
                 identifier,
                 provider: this.config['provider'],
                 providerPayload: { accessToken: tokenSet.access_token, userInfo },

package/dist/auth/drivers/openid.js

@@ -136,7 +136,7 @@ export class OpenIDAuthDriver extends LocalAuthDriver {
         if (userId) {
             // Run hook so the end user has the chance to augment the
             // user that is about to be updated
-            const updatedUserPayload = await emitter.emitFilter(`auth.update`, { auth_data: userPayload.auth_data }, {
+            const updatedUserPayload = await emitter.emitFilter(`auth.update`, { auth_data: userPayload.auth_data ?? null }, {
                 identifier,
                 provider: this.config['provider'],
                 providerPayload: { accessToken: tokenSet.access_token, userInfo },

package/dist/cli/utils/create-env/env-stub.liquid

@@ -43,6 +43,10 @@ PUBLIC_URL="/"
 # Whether or not to enable GraphQL Introspection [true]
 # GRAPHQL_INTROSPECTION=true
 
+# Limit the maximum amount of items that can get requested in one query.
+# QUERY_LIMIT_DEFAULT=100
+# QUERY_LIMIT_MAX=Infinity
+
 # The maximum number of items for batch mutations when creating, updating and deleting. ["Infinity"]
 # MAX_BATCH_MUTATION="Infinity"
 

package/dist/controllers/assets.js

@@ -106,21 +106,17 @@ asyncHandler(async (req, res) => {
         schema: req.schema,
     });
     const vary = ['Origin', 'Cache-Control'];
-    const transformation = res.locals['transformation'].key
+    const transformationParams = res.locals['transformation'].key
         ? res.locals['shortcuts'].find((transformation) => transformation['key'] === res.locals['transformation'].key)
         : res.locals['transformation'];
-    if (transformation.format === 'auto') {
-        let format;
+    let acceptFormat;
+    if (transformationParams.format === 'auto') {
         if (req.headers.accept?.includes('image/avif')) {
-            format = 'avif';
+            acceptFormat = 'avif';
         }
         else if (req.headers.accept?.includes('image/webp')) {
-            format = 'webp';
+            acceptFormat = 'webp';
         }
-        else {
-            format = 'jpg';
-        }
-        transformation.format = format;
         vary.push('Accept');
     }
     let range = undefined;
@@ -140,7 +136,7 @@ asyncHandler(async (req, res) => {
             }
         }
     }
-    const { stream, file, stat } = await service.getAsset(id, transformation, range);
+    const { stream, file, stat } = await service.getAsset(id, { transformationParams, acceptFormat }, range);
     const filename = req.params['filename'] ?? file.filename_download;
     res.attachment(filename);
     res.setHeader('Content-Type', file.type);

package/dist/database/run-ast.js

@@ -151,7 +151,7 @@ async function getDBQuery(schema, knex, table, fieldNodes, query) {
     const preProcess = getColumnPreprocessor(knex, schema, table);
     const queryCopy = clone(query);
     const helpers = getHelpers(knex);
-    queryCopy.limit = typeof queryCopy.limit === 'number' ? queryCopy.limit : 100;
+    queryCopy.limit = typeof queryCopy.limit === 'number' ? queryCopy.limit : Number(env['QUERY_LIMIT_DEFAULT']);
     // Queries with aggregates and groupBy will not have duplicate result
     if (queryCopy.aggregate || queryCopy.group) {
         const flatQuery = knex.select(fieldNodes.map(preProcess)).from(table);
@@ -322,13 +322,13 @@ function mergeWithParentItems(schema, nestedItem, parentItem, nestedNode) {
             });
             parentItem[nestedNode.fieldKey].push(...itemChildren);
             if (nestedNode.query.page && nestedNode.query.page > 1) {
-                parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].slice((nestedNode.query.limit ?? 100) * (nestedNode.query.page - 1));
+                parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].slice((nestedNode.query.limit ?? Number(env['QUERY_LIMIT_DEFAULT'])) * (nestedNode.query.page - 1));
             }
             if (nestedNode.query.offset && nestedNode.query.offset >= 0) {
                 parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].slice(nestedNode.query.offset);
             }
             if (nestedNode.query.limit !== -1) {
-                parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].slice(0, nestedNode.query.limit ?? 100);
+                parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].slice(0, nestedNode.query.limit ?? Number(env['QUERY_LIMIT_DEFAULT']));
             }
             parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].sort((a, b) => {
                 // This is pre-filled in get-ast-from-query

package/dist/env.js

@@ -25,6 +25,8 @@ const allowedEnvironmentVars = [
     'GRAPHQL_INTROSPECTION',
     'MAX_BATCH_MUTATION',
     'LOGGER_.+',
+    'QUERY_LIMIT_MAX',
+    'QUERY_LIMIT_DEFAULT',
     'ROBOTS_TXT',
     // server
     'SERVER_.+',
@@ -196,6 +198,7 @@ const defaults = {
     PUBLIC_URL: '/',
     MAX_PAYLOAD_SIZE: '1mb',
     MAX_RELATIONAL_DEPTH: 10,
+    QUERY_LIMIT_DEFAULT: 100,
     MAX_BATCH_MUTATION: Infinity,
     ROBOTS_TXT: 'User-agent: *\nDisallow: /',
     DB_EXCLUDE_TABLES: 'spatial_ref_sys,sysdiagrams',

package/dist/services/assets.d.ts

@@ -3,14 +3,14 @@ import type { Range, Stat } from '@directus/storage';
 import type { Accountability } from '@directus/types';
 import type { Knex } from 'knex';
 import type { Readable } from 'node:stream';
-import type { AbstractServiceOptions, TransformationParams } from '../types/index.js';
+import type { AbstractServiceOptions, TransformationSet } from '../types/index.js';
 import { AuthorizationService } from './authorization.js';
 export declare class AssetsService {
     knex: Knex;
     accountability: Accountability | null;
     authorizationService: AuthorizationService;
     constructor(options: AbstractServiceOptions);
-    getAsset(id: string, transformation: TransformationParams, range?: Range): Promise<{
+    getAsset(id: string, transformation: TransformationSet, range?: Range): Promise<{
         stream: Readable;
         file: any;
         stat: Stat;

package/dist/services/fields.js

@@ -311,7 +311,9 @@ export class FieldsService {
             }
             if (hookAdjustedField.schema) {
                 const existingColumn = await this.schemaInspector.columnInfo(collection, hookAdjustedField.field);
-                if (!isEqual(sanitizeColumn(existingColumn), hookAdjustedField.schema)) {
+                // Sanitize column only when applying snapshot diff as opts is only passed from /utils/apply-diff.ts
+                const columnToCompare = opts?.bypassLimits && opts.autoPurgeSystemCache === false ? sanitizeColumn(existingColumn) : existingColumn;
+                if (!isEqual(columnToCompare, hookAdjustedField.schema)) {
                     try {
                         await this.knex.schema.alterTable(collection, (table) => {
                             if (!hookAdjustedField.schema)

package/dist/services/graphql/index.js

@@ -1539,6 +1539,15 @@ export class GraphQLService {
                         },
                     }),
                 },
+                queryLimit: {
+                    type: new GraphQLObjectType({
+                        name: 'server_info_query_limit',
+                        fields: {
+                            default: { type: GraphQLInt },
+                            max: { type: GraphQLInt },
+                        },
+                    }),
+                },
             });
         }
         if (this.accountability?.admin === true) {

package/dist/services/server.js

@@ -64,6 +64,10 @@ export class ServerService {
             info['flows'] = {
                 execAllowedModules: env['FLOWS_EXEC_ALLOWED_MODULES'] ? toArray(env['FLOWS_EXEC_ALLOWED_MODULES']) : [],
             };
+            info['queryLimit'] = {
+                default: env['QUERY_LIMIT_DEFAULT'],
+                max: Number.isFinite(env['QUERY_LIMIT_MAX']) ? env['QUERY_LIMIT_MAX'] : -1,
+            };
         }
         if (this.accountability?.admin === true) {
             const { osType, osVersion } = getOSInfo();

package/dist/types/assets.d.ts

@@ -6,10 +6,15 @@ export type TransformationMap = {
 };
 export type Transformation = TransformationMap[keyof TransformationMap];
 export type TransformationResize = Pick<ResizeOptions, 'width' | 'height' | 'fit' | 'withoutEnlargement'>;
+export type TransformationFormat = 'jpg' | 'jpeg' | 'png' | 'webp' | 'tiff' | 'avif';
 export type TransformationParams = {
     key?: string;
     transforms?: Transformation[];
-    format?: 'auto' | 'jpg' | 'jpeg' | 'png' | 'webp' | 'tiff' | 'avif';
+    format?: TransformationFormat | 'auto';
     quality?: number;
 } & TransformationResize;
+export type TransformationSet = {
+    transformationParams: TransformationParams;
+    acceptFormat?: TransformationFormat | undefined;
+};
 export {};

package/dist/utils/apply-query.js

@@ -198,7 +198,7 @@ export function applyFilter(knex, schema, rootQuery, rootFilter, collection, ali
             }
             const filterPath = getFilterPath(key, value);
             if (filterPath.length > 1 ||
-                (!(key.includes('(') && key.includes(')')) && schema.collections[collection].fields[key].type === 'alias')) {
+                (!(key.includes('(') && key.includes(')')) && schema.collections[collection]?.fields[key]?.type === 'alias')) {
                 const hasMultiRelational = addJoin({
                     path: filterPath,
                     collection,
@@ -238,7 +238,7 @@ export function applyFilter(knex, schema, rootQuery, rootFilter, collection, ali
             const { relation, relationType } = getRelationInfo(relations, collection, pathRoot);
             const { operator: filterOperator, value: filterValue } = getOperation(key, value);
             if (filterPath.length > 1 ||
-                (!(key.includes('(') && key.includes(')')) && schema.collections[collection].fields[key].type === 'alias')) {
+                (!(key.includes('(') && key.includes(')')) && schema.collections[collection]?.fields[key]?.type === 'alias')) {
                 if (!relation)
                     continue;
                 if (relationType === 'o2m' || relationType === 'o2a') {

package/dist/utils/sanitize-query.js

@@ -1,15 +1,24 @@
 import { parseFilter, parseJSON } from '@directus/utils';
 import { flatten, get, isPlainObject, merge, set } from 'lodash-es';
+import { getEnv } from '../env.js';
 import logger from '../logger.js';
 import { Meta } from '../types/index.js';
 export function sanitizeQuery(rawQuery, accountability) {
     const query = {};
+    const env = getEnv();
+    const hasMaxLimit = 'QUERY_LIMIT_MAX' in env &&
+        Number(env['QUERY_LIMIT_MAX']) >= 0 &&
+        !Number.isNaN(Number(env['QUERY_LIMIT_MAX'])) &&
+        Number.isFinite(Number(env['QUERY_LIMIT_MAX']));
     if (rawQuery['limit'] !== undefined) {
         const limit = sanitizeLimit(rawQuery['limit']);
         if (typeof limit === 'number') {
-            query.limit = limit;
+            query.limit = limit === -1 && hasMaxLimit ? Number(env['QUERY_LIMIT_MAX']) : limit;
         }
     }
+    else if (hasMaxLimit) {
+        query.limit = Math.min(Number(env['QUERY_LIMIT_DEFAULT']), Number(env['QUERY_LIMIT_MAX']));
+    }
     if (rawQuery['fields']) {
         query.fields = sanitizeFields(rawQuery['fields']);
     }

package/dist/utils/transformations.d.ts

@@ -1,5 +1,5 @@
-import type { File, Transformation, TransformationParams } from '../types/index.js';
-export declare function resolvePreset(input: TransformationParams, file: File): Transformation[];
+import type { File, Transformation, TransformationSet } from '../types/index.js';
+export declare function resolvePreset({ transformationParams, acceptFormat }: TransformationSet, file: File): Transformation[];
 /**
  * Try to extract a file format from an array of `Transformation`'s.
  */

package/dist/utils/transformations.js

@@ -1,27 +1,44 @@
-export function resolvePreset(input, file) {
-    const transforms = input.transforms ? [...input.transforms] : [];
-    if (input.format || input.quality) {
+export function resolvePreset({ transformationParams, acceptFormat }, file) {
+    const transforms = transformationParams.transforms ? [...transformationParams.transforms] : [];
+    if (transformationParams.format || transformationParams.quality) {
         transforms.push([
             'toFormat',
-            input.format || file.type.split('/')[1],
+            getFormat(file, transformationParams.format, acceptFormat),
             {
-                quality: input.quality ? Number(input.quality) : undefined,
+                quality: transformationParams.quality ? Number(transformationParams.quality) : undefined,
             },
         ]);
     }
-    if (input.width || input.height) {
+    if (transformationParams.width || transformationParams.height) {
         transforms.push([
             'resize',
             {
-                width: input.width ? Number(input.width) : undefined,
-                height: input.height ? Number(input.height) : undefined,
-                fit: input.fit,
-                withoutEnlargement: input.withoutEnlargement ? Boolean(input.withoutEnlargement) : undefined,
+                width: transformationParams.width ? Number(transformationParams.width) : undefined,
+                height: transformationParams.height ? Number(transformationParams.height) : undefined,
+                fit: transformationParams.fit,
+                withoutEnlargement: transformationParams.withoutEnlargement
+                    ? Boolean(transformationParams.withoutEnlargement)
+                    : undefined,
             },
         ]);
     }
     return transforms;
 }
+function getFormat(file, format, acceptFormat) {
+    const fileType = file.type?.split('/')[1];
+    if (format) {
+        if (format !== 'auto') {
+            return format;
+        }
+        if (acceptFormat) {
+            return acceptFormat;
+        }
+        if (fileType && ['avif', 'webp', 'tiff'].includes(fileType)) {
+            return 'png';
+        }
+    }
+    return fileType || 'jpg';
+}
 /**
  * Try to extract a file format from an array of `Transformation`'s.
  */

package/dist/utils/validate-query.js

@@ -9,7 +9,9 @@ const querySchema = Joi.object({
     group: Joi.array().items(Joi.string()),
     sort: Joi.array().items(Joi.string()),
     filter: Joi.object({}).unknown(),
-    limit: Joi.number().integer().min(-1),
+    limit: 'QUERY_LIMIT_MAX' in env && env['QUERY_LIMIT_MAX'] !== -1
+        ? Joi.number().integer().min(-1).max(env['QUERY_LIMIT_MAX']) // min should be 0
+        : Joi.number().integer().min(-1),
     offset: Joi.number().integer().min(0),
     page: Joi.number().integer().min(0),
     meta: Joi.array().items(Joi.string().valid('total_count', 'filter_count')),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "10.1.0",
+  "version": "10.2.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -139,23 +139,23 @@
     "tsx": "3.12.6",
     "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
-    "vm2": "3.9.17",
+    "vm2": "3.9.18",
     "wellknown": "0.5.0",
-    "@directus/app": "10.1.0",
+    "@directus/app": "10.2.0",
     "@directus/constants": "10.1.0",
     "@directus/exceptions": "10.0.1",
-    "@directus/extensions-sdk": "10.1.0",
-    "@directus/pressure": "1.0.0",
-    "@directus/schema": "10.0.0",
+    "@directus/extensions-sdk": "10.1.1",
+    "@directus/pressure": "1.0.1",
+    "@directus/schema": "10.0.1",
     "@directus/specs": "10.1.0",
     "@directus/storage": "10.0.1",
-    "@directus/storage-driver-azure": "10.0.1",
-    "@directus/storage-driver-cloudinary": "10.0.1",
-    "@directus/storage-driver-gcs": "10.0.1",
-    "@directus/storage-driver-local": "10.0.1",
-    "@directus/storage-driver-s3": "10.0.1",
+    "@directus/storage-driver-azure": "10.0.2",
+    "@directus/storage-driver-cloudinary": "10.0.2",
+    "@directus/storage-driver-gcs": "10.0.2",
+    "@directus/storage-driver-local": "10.0.2",
+    "@directus/storage-driver-s3": "10.0.2",
     "@directus/update-check": "10.0.1",
-    "@directus/utils": "10.0.1"
+    "@directus/utils": "10.0.2"
   },
   "devDependencies": {
     "@directus/tsconfig": "0.0.7",
@@ -203,7 +203,7 @@
     "supertest": "6.3.3",
     "typescript": "5.0.4",
     "vitest": "0.31.0",
-    "@directus/types": "10.0.0"
+    "@directus/types": "10.0.1"
   },
   "optionalDependencies": {
     "@keyv/redis": "2.5.7",