@directus/api 10.2.0 → 11.0.1

package/dist/app.js

@@ -32,6 +32,7 @@ import schemaRouter from './controllers/schema.js';
 import serverRouter from './controllers/server.js';
 import settingsRouter from './controllers/settings.js';
 import sharesRouter from './controllers/shares.js';
+import translationsRouter from './controllers/translations.js';
 import usersRouter from './controllers/users.js';
 import utilsRouter from './controllers/utils.js';
 import webhooksRouter from './controllers/webhooks.js';
@@ -111,11 +112,10 @@ export default async function createApp() {
             // friendly. Ref #10806
             upgradeInsecureRequests: null,
             // These are required for MapLibre
-            // https://cdn.directus.io is required for images/videos in the official docs
             workerSrc: ["'self'", 'blob:'],
             childSrc: ["'self'", 'blob:'],
-            imgSrc: ["'self'", 'data:', 'blob:', 'https://cdn.directus.io'],
-            mediaSrc: ["'self'", 'https://cdn.directus.io'],
+            imgSrc: ["'self'", 'data:', 'blob:'],
+            mediaSrc: ["'self'"],
             connectSrc: ["'self'", 'https://*'],
         },
     }, getConfigFromEnv('CONTENT_SECURITY_POLICY_'))));
@@ -213,6 +213,7 @@ export default async function createApp() {
     app.use('/panels', panelsRouter);
     app.use('/permissions', permissionsRouter);
     app.use('/presets', presetsRouter);
+    app.use('/translations', translationsRouter);
     app.use('/relations', relationsRouter);
     app.use('/revisions', revisionsRouter);
     app.use('/roles', rolesRouter);

package/dist/cli/utils/create-env/env-stub.liquid

@@ -153,6 +153,9 @@ CACHE_ENABLED=false
 # Automatically purge the cache on create, update, and delete actions. [false]
 # CACHE_AUTO_PURGE=true
 
+# List of collections that prevent cache purging when `CACHE_AUTO_PURGE` is enabled. ["directus_activity,directus_presets"]
+# CACHE_AUTO_PURGE_IGNORE_LIST="directus_activity,directus_presets"
+
 # memory | redis | memcache
 CACHE_STORE=memory
 

package/dist/constants.d.ts

@@ -14,4 +14,3 @@ export declare const OAS_REQUIRED_SCHEMAS: string[];
 export declare const SUPPORTED_IMAGE_TRANSFORM_FORMATS: string[];
 /** Formats where metadata extraction is supported */
 export declare const SUPPORTED_IMAGE_METADATA_FORMATS: string[];
-export declare const REDACT_TEXT = "--redact--";

package/dist/constants.js

@@ -67,4 +67,3 @@ export const SUPPORTED_IMAGE_METADATA_FORMATS = [
     'image/tiff',
     'image/avif',
 ];
-export const REDACT_TEXT = '--redact--';

package/dist/controllers/files.js

@@ -1,10 +1,13 @@
 import formatTitle from '@directus/format-title';
 import { toArray } from '@directus/utils';
 import Busboy from 'busboy';
+import bytes from 'bytes';
 import express from 'express';
 import Joi from 'joi';
+import { minimatch } from 'minimatch';
 import path from 'path';
 import env from '../env.js';
+import { ContentTooLargeException } from '../exceptions/content-too-large.js';
 import { ForbiddenException, InvalidPayloadException } from '../exceptions/index.js';
 import { respond } from '../middleware/respond.js';
 import useCollection from '../middleware/use-collection.js';
@@ -28,7 +31,13 @@ export const multipartHandler = (req, res, next) => {
             'content-type': 'application/octet-stream',
         };
     }
-    const busboy = Busboy({ headers, defParamCharset: 'utf8' });
+    const busboy = Busboy({
+        headers,
+        defParamCharset: 'utf8',
+        limits: {
+            fileSize: env['FILES_MAX_UPLOAD_SIZE'] ? bytes(env['FILES_MAX_UPLOAD_SIZE']) : undefined,
+        },
+    });
     const savedFiles = [];
     const service = new FilesService({ accountability: req.accountability, schema: req.schema });
     const existingPrimaryKey = req.params['pk'] || undefined;
@@ -57,6 +66,11 @@ export const multipartHandler = (req, res, next) => {
         if (!filename) {
             return busboy.emit('error', new InvalidPayloadException(`File is missing filename`));
         }
+        const allowedPatterns = toArray(env['FILES_MIME_TYPE_ALLOW_LIST']);
+        const mimeTypeAllowed = allowedPatterns.some((pattern) => minimatch(mimeType, pattern));
+        if (mimeTypeAllowed === false) {
+            return busboy.emit('error', new InvalidPayloadException(`File is of invalid content type`));
+        }
         fileCount++;
         if (!existingPrimaryKey) {
             if (!payload.title) {
@@ -71,6 +85,10 @@ export const multipartHandler = (req, res, next) => {
         };
         // Clear the payload for the next to-be-uploaded file
         payload = {};
+        fileStream.on('limit', () => {
+            const error = new ContentTooLargeException(`Uploaded file is too large`);
+            next(error);
+        });
         try {
             const primaryKey = await service.uploadOne(fileStream, payloadWithRequiredFields, existingPrimaryKey);
             savedFiles.push(primaryKey);

package/dist/controllers/permissions.js

@@ -51,16 +51,19 @@ const readHandler = asyncHandler(async (req, res, next) => {
         schema: req.schema,
     });
     let result;
+    // TODO fix this at the service level
+    // temporary fix for missing permissions https://github.com/directus/directus/issues/18654
+    const temporaryQuery = { ...req.sanitizedQuery, limit: -1 };
     if (req.singleton) {
-        result = await service.readSingleton(req.sanitizedQuery);
+        result = await service.readSingleton(temporaryQuery);
     }
     else if (req.body.keys) {
-        result = await service.readMany(req.body.keys, req.sanitizedQuery);
+        result = await service.readMany(req.body.keys, temporaryQuery);
     }
     else {
-        result = await service.readByQuery(req.sanitizedQuery);
+        result = await service.readByQuery(temporaryQuery);
     }
-    const meta = await metaService.getMetaForQuery('directus_permissions', req.sanitizedQuery);
+    const meta = await metaService.getMetaForQuery('directus_permissions', temporaryQuery);
     res.locals['payload'] = { data: result, meta };
     return next();
 });

package/dist/controllers/translations.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/dist/controllers/translations.js

@@ -0,0 +1,149 @@
+import express from 'express';
+import { ForbiddenException } from '../exceptions/index.js';
+import { respond } from '../middleware/respond.js';
+import useCollection from '../middleware/use-collection.js';
+import { validateBatch } from '../middleware/validate-batch.js';
+import { TranslationsService } from '../services/translations.js';
+import { MetaService } from '../services/meta.js';
+import asyncHandler from '../utils/async-handler.js';
+import { sanitizeQuery } from '../utils/sanitize-query.js';
+const router = express.Router();
+router.use(useCollection('directus_translations'));
+router.post('/', asyncHandler(async (req, res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const savedKeys = [];
+    if (Array.isArray(req.body)) {
+        const keys = await service.createMany(req.body);
+        savedKeys.push(...keys);
+    }
+    else {
+        const primaryKey = await service.createOne(req.body);
+        savedKeys.push(primaryKey);
+    }
+    try {
+        if (Array.isArray(req.body)) {
+            const records = await service.readMany(savedKeys, req.sanitizedQuery);
+            res.locals['payload'] = { data: records };
+        }
+        else {
+            const record = await service.readOne(savedKeys[0], req.sanitizedQuery);
+            res.locals['payload'] = { data: record };
+        }
+    }
+    catch (error) {
+        if (error instanceof ForbiddenException) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+const readHandler = asyncHandler(async (req, res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const metaService = new MetaService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    let result;
+    if (req.singleton) {
+        result = await service.readSingleton(req.sanitizedQuery);
+    }
+    else if (req.body.keys) {
+        result = await service.readMany(req.body.keys, req.sanitizedQuery);
+    }
+    else {
+        result = await service.readByQuery(req.sanitizedQuery);
+    }
+    const meta = await metaService.getMetaForQuery('directus_translations', req.sanitizedQuery);
+    res.locals['payload'] = { data: result, meta };
+    return next();
+});
+router.get('/', validateBatch('read'), readHandler, respond);
+router.search('/', validateBatch('read'), readHandler, respond);
+router.get('/:pk', asyncHandler(async (req, res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const record = await service.readOne(req.params['pk'], req.sanitizedQuery);
+    res.locals['payload'] = { data: record || null };
+    return next();
+}), respond);
+router.patch('/', validateBatch('update'), asyncHandler(async (req, res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    let keys = [];
+    if (Array.isArray(req.body)) {
+        keys = await service.updateBatch(req.body);
+    }
+    else if (req.body.keys) {
+        keys = await service.updateMany(req.body.keys, req.body.data);
+    }
+    else {
+        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
+        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
+    }
+    try {
+        const result = await service.readMany(keys, req.sanitizedQuery);
+        res.locals['payload'] = { data: result || null };
+    }
+    catch (error) {
+        if (error instanceof ForbiddenException) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+router.patch('/:pk', asyncHandler(async (req, res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const primaryKey = await service.updateOne(req.params['pk'], req.body);
+    try {
+        const record = await service.readOne(primaryKey, req.sanitizedQuery);
+        res.locals['payload'] = { data: record || null };
+    }
+    catch (error) {
+        if (error instanceof ForbiddenException) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+router.delete('/', validateBatch('delete'), asyncHandler(async (req, _res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    if (Array.isArray(req.body)) {
+        await service.deleteMany(req.body);
+    }
+    else if (req.body.keys) {
+        await service.deleteMany(req.body.keys);
+    }
+    else {
+        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
+        await service.deleteByQuery(sanitizedQuery);
+    }
+    return next();
+}), respond);
+router.delete('/:pk', asyncHandler(async (req, _res, next) => {
+    const service = new TranslationsService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    await service.deleteOne(req.params['pk']);
+    return next();
+}), respond);
+export default router;

package/dist/controllers/users.js

@@ -126,7 +126,7 @@ router.patch('/me/track/page', asyncHandler(async (req, _res, next) => {
         throw new InvalidPayloadException(`"last_page" key is required.`);
     }
     const service = new UsersService({ schema: req.schema });
-    await service.updateOne(req.accountability.user, { last_page: req.body.last_page });
+    await service.updateOne(req.accountability.user, { last_page: req.body.last_page }, { autoPurgeCache: false });
     return next();
 }), respond);
 router.patch('/', validateBatch('update'), asyncHandler(async (req, res, next) => {

package/dist/database/migrations/20230525A-add-preview-settings.d.ts

@@ -0,0 +1,3 @@
+import type { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20230525A-add-preview-settings.js

@@ -0,0 +1,10 @@
+export async function up(knex) {
+    await knex.schema.alterTable('directus_collections', (table) => {
+        table.string('preview_url').nullable();
+    });
+}
+export async function down(knex) {
+    await knex.schema.alterTable('directus_collections', (table) => {
+        table.dropColumn('preview_url');
+    });
+}

package/dist/database/migrations/20230526A-migrate-translation-strings.d.ts

@@ -0,0 +1,3 @@
+import type { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20230526A-migrate-translation-strings.js

@@ -0,0 +1,54 @@
+import { set } from 'lodash-es';
+import { v4 as uuid } from 'uuid';
+function transformStringsNewFormat(oldStrings) {
+    return oldStrings.reduce((result, item) => {
+        if (!item.key || !item.translations)
+            return result;
+        for (const [language, value] of Object.entries(item.translations)) {
+            result.push({ id: uuid(), key: item.key, language, value });
+        }
+        return result;
+    }, []);
+}
+function transformStringsOldFormat(newStrings) {
+    const keyCache = {};
+    for (const { key, language, value } of newStrings) {
+        set(keyCache, [key, language], value);
+    }
+    return Object.entries(keyCache).map(([key, translations]) => ({ key, translations }));
+}
+export async function up(knex) {
+    await knex.schema.createTable('directus_translations', (table) => {
+        table.uuid('id').primary().notNullable();
+        table.string('language').notNullable();
+        table.string('key').notNullable();
+        table.text('value').notNullable();
+    });
+    const data = await knex.select('translation_strings', 'id').from('directus_settings').first();
+    if (data?.translation_strings && data?.id) {
+        const parsedTranslationStrings = typeof data.translation_strings === 'string' ? JSON.parse(data.translation_strings) : data.translation_strings;
+        const newTranslationStrings = transformStringsNewFormat(parsedTranslationStrings);
+        for (const item of newTranslationStrings) {
+            await knex('directus_translations').insert(item);
+        }
+    }
+    await knex.schema.alterTable('directus_settings', (table) => {
+        table.dropColumn('translation_strings');
+    });
+}
+export async function down(knex) {
+    const data = await knex.select('language', 'key', 'value').from('directus_translations');
+    const settingsId = await knex.select('id').from('directus_settings').first();
+    await knex.schema.alterTable('directus_settings', (table) => {
+        table.json('translation_strings');
+    });
+    if (settingsId?.id && data) {
+        const oldTranslationStrings = transformStringsOldFormat(data);
+        await knex('directus_settings')
+            .where({ id: settingsId.id })
+            .update({
+            translation_strings: JSON.stringify(oldTranslationStrings),
+        });
+    }
+    await knex.schema.dropTable('directus_translations');
+}

package/dist/database/system-data/app-access-permissions/app-access-permissions.yaml

@@ -57,6 +57,9 @@
 - collection: directus_settings
   action: read
 
+- collection: directus_translations
+  action: read
+
 - collection: directus_notifications
   action: read
   permissions:

package/dist/database/system-data/collections/collections.yaml

@@ -14,42 +14,55 @@ data:
   - collection: directus_activity
     note: $t:directus_collection.directus_activity
     accountability: null
+
   - collection: directus_collections
     icon: list_alt
     note: $t:directus_collection.directus_collections
+
   - collection: directus_fields
     icon: input
     note: $t:directus_collection.directus_fields
+
   - collection: directus_files
     icon: folder
     note: $t:directus_collection.directus_files
     display_template: '{{ $thumbnail }} {{ title }}'
+
   - collection: directus_folders
     note: $t:directus_collection.directus_folders
     display_template: '{{ name }}'
+
   - collection: directus_migrations
     note: $t:directus_collection.directus_migrations
+
   - collection: directus_permissions
     icon: admin_panel_settings
     note: $t:directus_collection.directus_permissions
+
   - collection: directus_presets
     icon: bookmark
     note: $t:directus_collection.directus_presets
     accountability: null
+
   - collection: directus_relations
     icon: merge_type
     note: $t:directus_collection.directus_relations
+
   - collection: directus_revisions
     note: $t:directus_collection.directus_revisions
     accountability: null
+
   - collection: directus_roles
     icon: supervised_user_circle
     note: $t:directus_collection.directus_roles
+
   - collection: directus_sessions
     note: $t:directus_collection.directus_sessions
+
   - collection: directus_settings
     singleton: true
     note: $t:directus_collection.directus_settings
+
   - collection: directus_users
     archive_field: status
     archive_value: archived
@@ -57,18 +70,28 @@ data:
     icon: people_alt
     note: $t:directus_collection.directus_users
     display_template: '{{ first_name }} {{ last_name }}'
+
   - collection: directus_webhooks
     note: $t:directus_collection.directus_webhooks
+
   - collection: directus_dashboards
     note: $t:directus_collection.directus_dashboards
+
   - collection: directus_panels
     note: $t:directus_collection.directus_panels
+
   - collection: directus_notifications
     note: $t:directus_collection.directus_notifications
+
   - collection: directus_shares
     icon: share
     note: $t:directus_collection.directus_shares
+
   - collection: directus_flows
     note: $t:directus_collection.directus_flows
+
   - collection: directus_operations
     note: $t:directus_collection.directus_operations
+
+  - collection: directus_translations
+    note: $t:directus_collection.directus_translations

package/dist/database/system-data/fields/collections.yaml

@@ -100,6 +100,22 @@ fields:
               placeholder: $t:field_options.directus_collections.translation_placeholder
     width: full
 
+  - field: preview_divider
+    special:
+      - alias
+      - no-data
+    interface: presentation-divider
+    options:
+      icon: preview
+      title: $t:field_options.directus_collections.preview_divider
+    width: full
+
+  - field: preview_url
+    interface: system-display-template
+    options:
+      collectionField: collection
+    width: full
+
   - field: archive_divider
     special:
       - alias

package/dist/database/system-data/fields/settings.yaml

@@ -375,11 +375,6 @@ fields:
             options:
               placeholder: $t:fields.directus_settings.attribution_placeholder
 
-  - field: translation_strings
-    special:
-      - cast-json
-    hidden: true
-
   - field: image_editor
     interface: presentation-divider
     options:

package/dist/database/system-data/fields/translations.yaml

@@ -0,0 +1,27 @@
+table: directus_translations
+
+fields:
+  - field: id
+    hidden: true
+    sort: 1
+    special:
+      - uuid
+  - field: key
+    width: half
+    sort: 2
+    required: true
+    interface: input
+    options:
+      font: monospace
+      placeholder: '$t:translation_key_placeholder'
+  - field: language
+    interface: system-language
+    width: half
+    sort: 3
+    required: true
+  - field: value
+    interface: input-multiline
+    sort: 4
+    required: true
+    options:
+      placeholder: '$t:enter_a_value'

package/dist/env.js

@@ -68,6 +68,7 @@ const allowedEnvironmentVars = [
     'CACHE_TTL',
     'CACHE_CONTROL_S_MAXAGE',
     'CACHE_AUTO_PURGE',
+    'CACHE_AUTO_PURGE_IGNORE_LIST',
     'CACHE_SYSTEM_TTL',
     'CACHE_SCHEMA',
     'CACHE_PERMISSIONS',
@@ -102,6 +103,9 @@ const allowedEnvironmentVars = [
     'STORAGE_.+_HEALTHCHECK_THRESHOLD',
     // metadata
     'FILE_METADATA_ALLOW_LIST',
+    // files
+    'FILES_MAX_UPLOAD_SIZE',
+    'FILES_CONTENT_TYPE_ALLOW_LIST',
     // assets
     'ASSETS_CACHE_TTL',
     'ASSETS_TRANSFORM_MAX_CONCURRENT',
@@ -157,6 +161,13 @@ const allowedEnvironmentVars = [
     'MESSENGER_REDIS_HOST',
     'MESSENGER_REDIS_PORT',
     'MESSENGER_REDIS_PASSWORD',
+    // synchronization
+    'SYNCHRONIZATION_STORE',
+    'SYNCHRONIZATION_NAMESPACE',
+    'SYNCHRONIZATION_REDIS',
+    'SYNCHRONIZATION_REDIS_HOST',
+    'SYNCHRONIZATION_REDIS_PORT',
+    'SYNCHRONIZATION_REDIS_PASSWORD',
     // emails
     'EMAIL_FROM',
     'EMAIL_TRANSPORT',
@@ -233,6 +244,7 @@ const defaults = {
     CACHE_TTL: '5m',
     CACHE_NAMESPACE: 'system-cache',
     CACHE_AUTO_PURGE: false,
+    CACHE_AUTO_PURGE_IGNORE_LIST: 'directus_activity,directus_presets',
     CACHE_CONTROL_S_MAXAGE: '0',
     CACHE_SCHEMA: true,
     CACHE_PERMISSIONS: true,
@@ -272,6 +284,7 @@ const defaults = {
     PRESSURE_LIMITER_MAX_MEMORY_RSS: false,
     PRESSURE_LIMITER_MAX_MEMORY_HEAP_USED: false,
     PRESSURE_LIMITER_RETRY_AFTER: false,
+    FILES_MIME_TYPE_ALLOW_LIST: '*/*',
 };
 // Allows us to force certain environment variable into a type, instead of relying
 // on the auto-parsed type in processValues. ref #3705
@@ -285,6 +298,7 @@ const typeMap = {
     DB_PORT: 'number',
     DB_EXCLUDE_TABLES: 'array',
     CACHE_SKIP_ALLOWED: 'boolean',
+    CACHE_AUTO_PURGE_IGNORE_LIST: 'array',
     IMPORT_IP_DENY_LIST: 'array',
     FILE_METADATA_ALLOW_LIST: 'array',
     GRAPHQL_INTROSPECTION: 'boolean',

package/dist/exceptions/content-too-large.d.ts

@@ -0,0 +1,4 @@
+import { BaseException } from '@directus/exceptions';
+export declare class ContentTooLargeException extends BaseException {
+    constructor(message: string);
+}

package/dist/exceptions/content-too-large.js

@@ -0,0 +1,6 @@
+import { BaseException } from '@directus/exceptions';
+export class ContentTooLargeException extends BaseException {
+    constructor(message) {
+        super(message, 413, 'CONTENT_TOO_LARGE');
+    }
+}