@directus/api 10.1.0 → 11.0.0

package/dist/app.js

@@ -32,6 +32,7 @@ import schemaRouter from './controllers/schema.js';
 import serverRouter from './controllers/server.js';
 import settingsRouter from './controllers/settings.js';
 import sharesRouter from './controllers/shares.js';
+import translationsRouter from './controllers/translations.js';
 import usersRouter from './controllers/users.js';
 import utilsRouter from './controllers/utils.js';
 import webhooksRouter from './controllers/webhooks.js';
@@ -111,11 +112,10 @@ export default async function createApp() {
             // friendly. Ref #10806
             upgradeInsecureRequests: null,
             // These are required for MapLibre
-            // https://cdn.directus.io is required for images/videos in the official docs
             workerSrc: ["'self'", 'blob:'],
             childSrc: ["'self'", 'blob:'],
-            imgSrc: ["'self'", 'data:', 'blob:', 'https://cdn.directus.io'],
-            mediaSrc: ["'self'", 'https://cdn.directus.io'],
+            imgSrc: ["'self'", 'data:', 'blob:'],
+            mediaSrc: ["'self'"],
             connectSrc: ["'self'", 'https://*'],
         },
     }, getConfigFromEnv('CONTENT_SECURITY_POLICY_'))));
@@ -213,6 +213,7 @@ export default async function createApp() {
     app.use('/panels', panelsRouter);
     app.use('/permissions', permissionsRouter);
     app.use('/presets', presetsRouter);
+    app.use('/translations', translationsRouter);
     app.use('/relations', relationsRouter);
     app.use('/revisions', revisionsRouter);
     app.use('/roles', rolesRouter);

package/dist/auth/drivers/oauth2.js

@@ -117,7 +117,7 @@ export class OAuth2AuthDriver extends LocalAuthDriver {
         if (userId) {
             // Run hook so the end user has the chance to augment the
             // user that is about to be updated
-            const updatedUserPayload = await emitter.emitFilter(`auth.update`, { auth_data: userPayload.auth_data }, {
+            const updatedUserPayload = await emitter.emitFilter(`auth.update`, { auth_data: userPayload.auth_data ?? null }, {
                 identifier,
                 provider: this.config['provider'],
                 providerPayload: { accessToken: tokenSet.access_token, userInfo },

package/dist/auth/drivers/openid.js

@@ -136,7 +136,7 @@ export class OpenIDAuthDriver extends LocalAuthDriver {
         if (userId) {
             // Run hook so the end user has the chance to augment the
             // user that is about to be updated
-            const updatedUserPayload = await emitter.emitFilter(`auth.update`, { auth_data: userPayload.auth_data }, {
+            const updatedUserPayload = await emitter.emitFilter(`auth.update`, { auth_data: userPayload.auth_data ?? null }, {
                 identifier,
                 provider: this.config['provider'],
                 providerPayload: { accessToken: tokenSet.access_token, userInfo },

package/dist/cli/utils/create-env/env-stub.liquid

@@ -43,6 +43,10 @@ PUBLIC_URL="/"
 # Whether or not to enable GraphQL Introspection [true]
 # GRAPHQL_INTROSPECTION=true
 
+# Limit the maximum amount of items that can get requested in one query.
+# QUERY_LIMIT_DEFAULT=100
+# QUERY_LIMIT_MAX=Infinity
+
 # The maximum number of items for batch mutations when creating, updating and deleting. ["Infinity"]
 # MAX_BATCH_MUTATION="Infinity"
 
@@ -149,6 +153,9 @@ CACHE_ENABLED=false
 # Automatically purge the cache on create, update, and delete actions. [false]
 # CACHE_AUTO_PURGE=true
 
+# List of collections that prevent cache purging when `CACHE_AUTO_PURGE` is enabled. ["directus_activity,directus_presets"]
+# CACHE_AUTO_PURGE_IGNORE_LIST="directus_activity,directus_presets"
+
 # memory | redis | memcache
 CACHE_STORE=memory
 

package/dist/constants.d.ts

@@ -14,4 +14,3 @@ export declare const OAS_REQUIRED_SCHEMAS: string[];
 export declare const SUPPORTED_IMAGE_TRANSFORM_FORMATS: string[];
 /** Formats where metadata extraction is supported */
 export declare const SUPPORTED_IMAGE_METADATA_FORMATS: string[];
-export declare const REDACT_TEXT = "--redact--";

package/dist/constants.js

@@ -67,4 +67,3 @@ export const SUPPORTED_IMAGE_METADATA_FORMATS = [
     'image/tiff',
     'image/avif',
 ];
-export const REDACT_TEXT = '--redact--';

package/dist/controllers/assets.js

@@ -106,21 +106,17 @@ asyncHandler(async (req, res) => {
         schema: req.schema,
     });
     const vary = ['Origin', 'Cache-Control'];
-    const transformation = res.locals['transformation'].key
+    const transformationParams = res.locals['transformation'].key
         ? res.locals['shortcuts'].find((transformation) => transformation['key'] === res.locals['transformation'].key)
         : res.locals['transformation'];
-    if (transformation.format === 'auto') {
-        let format;
+    let acceptFormat;
+    if (transformationParams.format === 'auto') {
         if (req.headers.accept?.includes('image/avif')) {
-            format = 'avif';
+            acceptFormat = 'avif';
         }
         else if (req.headers.accept?.includes('image/webp')) {
-            format = 'webp';
+            acceptFormat = 'webp';
         }
-        else {
-            format = 'jpg';
-        }
-        transformation.format = format;
         vary.push('Accept');
     }
     let range = undefined;
@@ -140,7 +136,7 @@ asyncHandler(async (req, res) => {
             }
         }
     }
-    const { stream, file, stat } = await service.getAsset(id, transformation, range);
+    const { stream, file, stat } = await service.getAsset(id, { transformationParams, acceptFormat }, range);
     const filename = req.params['filename'] ?? file.filename_download;
     res.attachment(filename);
     res.setHeader('Content-Type', file.type);

package/dist/controllers/files.js

@@ -1,10 +1,13 @@
 import formatTitle from '@directus/format-title';
 import { toArray } from '@directus/utils';
 import Busboy from 'busboy';
+import bytes from 'bytes';
 import express from 'express';
 import Joi from 'joi';
+import { minimatch } from 'minimatch';
 import path from 'path';
 import env from '../env.js';
+import { ContentTooLargeException } from '../exceptions/content-too-large.js';
 import { ForbiddenException, InvalidPayloadException } from '../exceptions/index.js';
 import { respond } from '../middleware/respond.js';
 import useCollection from '../middleware/use-collection.js';
@@ -28,7 +31,13 @@ export const multipartHandler = (req, res, next) => {
             'content-type': 'application/octet-stream',
         };
     }
-    const busboy = Busboy({ headers, defParamCharset: 'utf8' });
+    const busboy = Busboy({
+        headers,
+        defParamCharset: 'utf8',
+        limits: {
+            fileSize: env['FILES_MAX_UPLOAD_SIZE'] ? bytes(env['FILES_MAX_UPLOAD_SIZE']) : undefined,
+        },
+    });
     const savedFiles = [];
     const service = new FilesService({ accountability: req.accountability, schema: req.schema });
     const existingPrimaryKey = req.params['pk'] || undefined;
@@ -57,6 +66,11 @@ export const multipartHandler = (req, res, next) => {
         if (!filename) {
             return busboy.emit('error', new InvalidPayloadException(`File is missing filename`));
         }
+        const allowedPatterns = toArray(env['FILES_MIME_TYPE_ALLOW_LIST']);
+        const mimeTypeAllowed = allowedPatterns.some((pattern) => minimatch(mimeType, pattern));
+        if (mimeTypeAllowed === false) {
+            return busboy.emit('error', new InvalidPayloadException(`File is of invalid content type`));
+        }
         fileCount++;
         if (!existingPrimaryKey) {
             if (!payload.title) {
@@ -71,6 +85,10 @@ export const multipartHandler = (req, res, next) => {
         };
         // Clear the payload for the next to-be-uploaded file
         payload = {};
+        fileStream.on('limit', () => {
+            const error = new ContentTooLargeException(`Uploaded file is too large`);
+            next(error);
+        });
         try {
             const primaryKey = await service.uploadOne(fileStream, payloadWithRequiredFields, existingPrimaryKey);
             savedFiles.push(primaryKey);

package/dist/controllers/permissions.js

@@ -51,16 +51,19 @@ const readHandler = asyncHandler(async (req, res, next) => {
         schema: req.schema,
     });
     let result;
+    // TODO fix this at the service level
+    // temporary fix for missing permissions https://github.com/directus/directus/issues/18654
+    const temporaryQuery = { ...req.sanitizedQuery, limit: -1 };
     if (req.singleton) {
-        result = await service.readSingleton(req.sanitizedQuery);
+        result = await service.readSingleton(temporaryQuery);
     }
     else if (req.body.keys) {
-        result = await service.readMany(req.body.keys, req.sanitizedQuery);
+        result = await service.readMany(req.body.keys, temporaryQuery);
     }
     else {
-        result = await service.readByQuery(req.sanitizedQuery);
+        result = await service.readByQuery(temporaryQuery);
     }
-    const meta = await metaService.getMetaForQuery('directus_permissions', req.sanitizedQuery);
+    const meta = await metaService.getMetaForQuery('directus_permissions', temporaryQuery);
     res.locals['payload'] = { data: result, meta };
     return next();
 });

package/dist/controllers/translations.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/dist/controllers/translations.js

@@ -0,0 +1,149 @@
+import express from 'express';
+import { ForbiddenException } from '../exceptions/index.js';
+import { respond } from '../middleware/respond.js';
+import useCollection from '../middleware/use-collection.js';
+import { validateBatch } from '../middleware/validate-batch.js';
+import { TranslationsService } from '../services/translations.js';
+import { MetaService } from '../services/meta.js';
+import asyncHandler from '../utils/async-handler.js';
+import { sanitizeQuery } from '../utils/sanitize-query.js';
+const router = express.Router();
+router.use(useCollection('directus_translations'));
+router.post('/', asyncHandler(async (req, res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const savedKeys = [];
+    if (Array.isArray(req.body)) {
+        const keys = await service.createMany(req.body);
+        savedKeys.push(...keys);
+    }
+    else {
+        const primaryKey = await service.createOne(req.body);
+        savedKeys.push(primaryKey);
+    }
+    try {
+        if (Array.isArray(req.body)) {
+            const records = await service.readMany(savedKeys, req.sanitizedQuery);
+            res.locals['payload'] = { data: records };
+        }
+        else {
+            const record = await service.readOne(savedKeys[0], req.sanitizedQuery);
+            res.locals['payload'] = { data: record };
+        }
+    }
+    catch (error) {
+        if (error instanceof ForbiddenException) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+const readHandler = asyncHandler(async (req, res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const metaService = new MetaService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    let result;
+    if (req.singleton) {
+        result = await service.readSingleton(req.sanitizedQuery);
+    }
+    else if (req.body.keys) {
+        result = await service.readMany(req.body.keys, req.sanitizedQuery);
+    }
+    else {
+        result = await service.readByQuery(req.sanitizedQuery);
+    }
+    const meta = await metaService.getMetaForQuery('directus_translations', req.sanitizedQuery);
+    res.locals['payload'] = { data: result, meta };
+    return next();
+});
+router.get('/', validateBatch('read'), readHandler, respond);
+router.search('/', validateBatch('read'), readHandler, respond);
+router.get('/:pk', asyncHandler(async (req, res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const record = await service.readOne(req.params['pk'], req.sanitizedQuery);
+    res.locals['payload'] = { data: record || null };
+    return next();
+}), respond);
+router.patch('/', validateBatch('update'), asyncHandler(async (req, res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    let keys = [];
+    if (Array.isArray(req.body)) {
+        keys = await service.updateBatch(req.body);
+    }
+    else if (req.body.keys) {
+        keys = await service.updateMany(req.body.keys, req.body.data);
+    }
+    else {
+        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
+        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
+    }
+    try {
+        const result = await service.readMany(keys, req.sanitizedQuery);
+        res.locals['payload'] = { data: result || null };
+    }
+    catch (error) {
+        if (error instanceof ForbiddenException) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+router.patch('/:pk', asyncHandler(async (req, res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const primaryKey = await service.updateOne(req.params['pk'], req.body);
+    try {
+        const record = await service.readOne(primaryKey, req.sanitizedQuery);
+        res.locals['payload'] = { data: record || null };
+    }
+    catch (error) {
+        if (error instanceof ForbiddenException) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+router.delete('/', validateBatch('delete'), asyncHandler(async (req, _res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    if (Array.isArray(req.body)) {
+        await service.deleteMany(req.body);
+    }
+    else if (req.body.keys) {
+        await service.deleteMany(req.body.keys);
+    }
+    else {
+        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
+        await service.deleteByQuery(sanitizedQuery);
+    }
+    return next();
+}), respond);
+router.delete('/:pk', asyncHandler(async (req, _res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    await service.deleteOne(req.params['pk']);
+    return next();
+}), respond);
+export default router;

package/dist/controllers/users.js

@@ -126,7 +126,7 @@ router.patch('/me/track/page', asyncHandler(async (req, _res, next) => {
         throw new InvalidPayloadException(`"last_page" key is required.`);
     }
     const service = new UsersService({ schema: req.schema });
-    await service.updateOne(req.accountability.user, { last_page: req.body.last_page });
+    await service.updateOne(req.accountability.user, { last_page: req.body.last_page }, { autoPurgeCache: false });
     return next();
 }), respond);
 router.patch('/', validateBatch('update'), asyncHandler(async (req, res, next) => {

package/dist/database/migrations/20230525A-add-preview-settings.d.ts

@@ -0,0 +1,3 @@
+import type { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20230525A-add-preview-settings.js

@@ -0,0 +1,10 @@
+export async function up(knex) {
+    await knex.schema.alterTable('directus_collections', (table) => {
+        table.string('preview_url').nullable();
+    });
+}
+export async function down(knex) {
+    await knex.schema.alterTable('directus_collections', (table) => {
+        table.dropColumn('preview_url');
+    });
+}

package/dist/database/migrations/20230526A-migrate-translation-strings.d.ts

@@ -0,0 +1,3 @@
+import type { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20230526A-migrate-translation-strings.js

@@ -0,0 +1,54 @@
+import { set } from 'lodash-es';
+import { v4 as uuid } from 'uuid';
+function transformStringsNewFormat(oldStrings) {
+    return oldStrings.reduce((result, item) => {
+        if (!item.key || !item.translations)
+            return result;
+        for (const [language, value] of Object.entries(item.translations)) {
+            result.push({ id: uuid(), key: item.key, language, value });
+        }
+        return result;
+    }, []);
+}
+function transformStringsOldFormat(newStrings) {
+    const keyCache = {};
+    for (const { key, language, value } of newStrings) {
+        set(keyCache, [key, language], value);
+    }
+    return Object.entries(keyCache).map(([key, translations]) => ({ key, translations }));
+}
+export async function up(knex) {
+    await knex.schema.createTable('directus_translations', (table) => {
+        table.uuid('id').primary().notNullable();
+        table.string('language').notNullable();
+        table.string('key').notNullable();
+        table.text('value').notNullable();
+    });
+    const data = await knex.select('translation_strings', 'id').from('directus_settings').first();
+    if (data?.translation_strings && data?.id) {
+        const parsedTranslationStrings = typeof data.translation_strings === 'string' ? JSON.parse(data.translation_strings) : data.translation_strings;
+        const newTranslationStrings = transformStringsNewFormat(parsedTranslationStrings);
+        for (const item of newTranslationStrings) {
+            await knex('directus_translations').insert(item);
+        }
+    }
+    await knex.schema.alterTable('directus_settings', (table) => {
+        table.dropColumn('translation_strings');
+    });
+}
+export async function down(knex) {
+    const data = await knex.select('language', 'key', 'value').from('directus_translations');
+    const settingsId = await knex.select('id').from('directus_settings').first();
+    await knex.schema.alterTable('directus_settings', (table) => {
+        table.json('translation_strings');
+    });
+    if (settingsId?.id && data) {
+        const oldTranslationStrings = transformStringsOldFormat(data);
+        await knex('directus_settings')
+            .where({ id: settingsId.id })
+            .update({
+            translation_strings: JSON.stringify(oldTranslationStrings),
+        });
+    }
+    await knex.schema.dropTable('directus_translations');
+}

package/dist/database/run-ast.js

@@ -151,7 +151,7 @@ async function getDBQuery(schema, knex, table, fieldNodes, query) {
     const preProcess = getColumnPreprocessor(knex, schema, table);
     const queryCopy = clone(query);
     const helpers = getHelpers(knex);
-    queryCopy.limit = typeof queryCopy.limit === 'number' ? queryCopy.limit : 100;
+    queryCopy.limit = typeof queryCopy.limit === 'number' ? queryCopy.limit : Number(env['QUERY_LIMIT_DEFAULT']);
     // Queries with aggregates and groupBy will not have duplicate result
     if (queryCopy.aggregate || queryCopy.group) {
         const flatQuery = knex.select(fieldNodes.map(preProcess)).from(table);
@@ -322,13 +322,13 @@ function mergeWithParentItems(schema, nestedItem, parentItem, nestedNode) {
             });
             parentItem[nestedNode.fieldKey].push(...itemChildren);
             if (nestedNode.query.page && nestedNode.query.page > 1) {
-                parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].slice((nestedNode.query.limit ?? 100) * (nestedNode.query.page - 1));
+                parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].slice((nestedNode.query.limit ?? Number(env['QUERY_LIMIT_DEFAULT'])) * (nestedNode.query.page - 1));
             }
             if (nestedNode.query.offset && nestedNode.query.offset >= 0) {
                 parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].slice(nestedNode.query.offset);
             }
             if (nestedNode.query.limit !== -1) {
-                parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].slice(0, nestedNode.query.limit ?? 100);
+                parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].slice(0, nestedNode.query.limit ?? Number(env['QUERY_LIMIT_DEFAULT']));
             }
             parentItem[nestedNode.fieldKey] = parentItem[nestedNode.fieldKey].sort((a, b) => {
                 // This is pre-filled in get-ast-from-query

package/dist/database/system-data/app-access-permissions/app-access-permissions.yaml

@@ -57,6 +57,9 @@
 - collection: directus_settings
   action: read
 
+- collection: directus_translations
+  action: read
+
 - collection: directus_notifications
   action: read
   permissions:

package/dist/database/system-data/collections/collections.yaml

@@ -14,42 +14,55 @@ data:
   - collection: directus_activity
     note: $t:directus_collection.directus_activity
     accountability: null
+
   - collection: directus_collections
     icon: list_alt
     note: $t:directus_collection.directus_collections
+
   - collection: directus_fields
     icon: input
     note: $t:directus_collection.directus_fields
+
   - collection: directus_files
     icon: folder
     note: $t:directus_collection.directus_files
     display_template: '{{ $thumbnail }} {{ title }}'
+
   - collection: directus_folders
     note: $t:directus_collection.directus_folders
     display_template: '{{ name }}'
+
   - collection: directus_migrations
     note: $t:directus_collection.directus_migrations
+
   - collection: directus_permissions
     icon: admin_panel_settings
     note: $t:directus_collection.directus_permissions
+
   - collection: directus_presets
     icon: bookmark
     note: $t:directus_collection.directus_presets
     accountability: null
+
   - collection: directus_relations
     icon: merge_type
     note: $t:directus_collection.directus_relations
+
   - collection: directus_revisions
     note: $t:directus_collection.directus_revisions
     accountability: null
+
   - collection: directus_roles
     icon: supervised_user_circle
     note: $t:directus_collection.directus_roles
+
   - collection: directus_sessions
     note: $t:directus_collection.directus_sessions
+
   - collection: directus_settings
     singleton: true
     note: $t:directus_collection.directus_settings
+
   - collection: directus_users
     archive_field: status
     archive_value: archived
@@ -57,18 +70,28 @@ data:
     icon: people_alt
     note: $t:directus_collection.directus_users
     display_template: '{{ first_name }} {{ last_name }}'
+
   - collection: directus_webhooks
     note: $t:directus_collection.directus_webhooks
+
   - collection: directus_dashboards
     note: $t:directus_collection.directus_dashboards
+
   - collection: directus_panels
     note: $t:directus_collection.directus_panels
+
   - collection: directus_notifications
     note: $t:directus_collection.directus_notifications
+
   - collection: directus_shares
     icon: share
     note: $t:directus_collection.directus_shares
+
   - collection: directus_flows
     note: $t:directus_collection.directus_flows
+
   - collection: directus_operations
     note: $t:directus_collection.directus_operations
+
+  - collection: directus_translations
+    note: $t:directus_collection.directus_translations

package/dist/database/system-data/fields/collections.yaml

@@ -100,6 +100,22 @@ fields:
               placeholder: $t:field_options.directus_collections.translation_placeholder
     width: full
 
+  - field: preview_divider
+    special:
+      - alias
+      - no-data
+    interface: presentation-divider
+    options:
+      icon: preview
+      title: $t:field_options.directus_collections.preview_divider
+    width: full
+
+  - field: preview_url
+    interface: system-display-template
+    options:
+      collectionField: collection
+    width: full
+
   - field: archive_divider
     special:
       - alias

package/dist/database/system-data/fields/settings.yaml

@@ -375,11 +375,6 @@ fields:
             options:
               placeholder: $t:fields.directus_settings.attribution_placeholder
 
-  - field: translation_strings
-    special:
-      - cast-json
-    hidden: true
-
   - field: image_editor
     interface: presentation-divider
     options:

package/dist/database/system-data/fields/translations.yaml

@@ -0,0 +1,27 @@
+table: directus_translations
+
+fields:
+  - field: id
+    hidden: true
+    sort: 1
+    special:
+      - uuid
+  - field: key
+    width: half
+    sort: 2
+    required: true
+    interface: input
+    options:
+      font: monospace
+      placeholder: '$t:translation_key_placeholder'
+  - field: language
+    interface: system-language
+    width: half
+    sort: 3
+    required: true
+  - field: value
+    interface: input-multiline
+    sort: 4
+    required: true
+    options:
+      placeholder: '$t:enter_a_value'