@directus/api 13.1.0-beta.0 → 13.1.1

package/dist/services/items.js

@@ -116,8 +116,20 @@ export class ItemsService {
             const { payload: payloadWithA2O, revisions: revisionsA2O, nestedActionEvents: nestedActionEventsA2O, } = await payloadService.processA2O(payloadWithM2O, opts);
             const payloadWithoutAliases = pick(payloadWithA2O, without(fields, ...aliases));
             const payloadWithTypeCasting = await payloadService.processValues('create', payloadWithoutAliases);
-            // In case of manual string / UUID primary keys, the PK already exists in the object we're saving.
+            // The primary key can already exist in the payload.
+            // In case of manual string / UUID primary keys it's always provided at this point.
+            // In case of an integer primary key, it might be provided as the user can specify the value manually.
             let primaryKey = payloadWithTypeCasting[primaryKeyField];
+            // If a PK of type number was provided, although the PK is set the auto_increment,
+            // depending on the database, the sequence might need to be reset to protect future PK collisions.
+            let autoIncrementSequenceNeedsToBeReset = false;
+            const pkField = this.schema.collections[this.collection].fields[primaryKeyField];
+            if (primaryKey &&
+                !opts.bypassAutoIncrementSequenceReset &&
+                pkField.type === 'integer' &&
+                pkField.defaultValue === 'AUTO_INCREMENT') {
+                autoIncrementSequenceNeedsToBeReset = true;
+            }
             try {
                 const result = await trx
                     .insert(payloadWithoutAliases)
@@ -125,7 +137,7 @@ export class ItemsService {
                     .returning(primaryKeyField)
                     .then((result) => result[0]);
                 const returnedKey = typeof result === 'object' ? result[primaryKeyField] : result;
-                if (this.schema.collections[this.collection].fields[primaryKeyField].type === 'uuid') {
+                if (pkField.type === 'uuid') {
                     primaryKey = getHelpers(trx).schema.formatUUID(primaryKey ?? returnedKey);
                 }
                 else {
@@ -146,6 +158,8 @@ export class ItemsService {
                 // to read from it
                 payload[primaryKeyField] = primaryKey;
             }
+            // At this point, the primary key is guaranteed to be set.
+            primaryKey = primaryKey;
             const { revisions: revisionsO2M, nestedActionEvents: nestedActionEventsO2M } = await payloadService.processO2M(payloadWithPresets, primaryKey, opts);
             nestedActionEvents.push(...nestedActionEventsM2O);
             nestedActionEvents.push(...nestedActionEventsA2O);
@@ -189,6 +203,9 @@ export class ItemsService {
                     }
                 }
             }
+            if (autoIncrementSequenceNeedsToBeReset) {
+                await getHelpers(trx).sequence.resetAutoIncrementSequence(this.collection, primaryKeyField);
+            }
             return primaryKey;
         });
         if (opts.emitEvents !== false) {
@@ -241,12 +258,20 @@ export class ItemsService {
             });
             const primaryKeys = [];
             const nestedActionEvents = [];
-            for (const payload of data) {
+            const pkField = this.schema.collections[this.collection].primary;
+            for (const [index, payload] of data.entries()) {
+                let bypassAutoIncrementSequenceReset = true;
+                // the auto_increment sequence needs to be reset if the current item contains a manual PK and
+                // if it's the last item of the batch or if the next item doesn't include a PK and hence one needs to be generated
+                if (payload[pkField] && (index === data.length - 1 || !data[index + 1]?.[pkField])) {
+                    bypassAutoIncrementSequenceReset = false;
+                }
                 const primaryKey = await service.createOne(payload, {
                     ...(opts || {}),
                     autoPurgeCache: false,
                     bypassEmitAction: (params) => nestedActionEvents.push(params),
                     mutationTracker: opts.mutationTracker,
+                    bypassAutoIncrementSequenceReset,
                 });
                 primaryKeys.push(primaryKey);
             }

package/dist/services/users.d.ts

@@ -26,6 +26,10 @@ export declare class UsersService extends ItemsService {
      * Create url for inviting users
      */
     private inviteUrl;
+    /**
+     * Validate array of emails. Intended to be used with create/update users
+     */
+    private validateEmail;
     /**
      * Create a new user
      */

package/dist/services/users.js

@@ -1,5 +1,6 @@
 import { getSimpleHash, toArray } from '@directus/utils';
 import { FailedValidationError, joiValidationErrorItemToErrorExtensions } from '@directus/validation';
+import Joi from 'joi';
 import jwt from 'jsonwebtoken';
 import { cloneDeep, isEmpty } from 'lodash-es';
 import { performance } from 'perf_hooks';
@@ -130,6 +131,22 @@ export class UsersService extends ItemsService {
         inviteURL.setQuery('token', token);
         return inviteURL.toString();
     }
+    /**
+     * Validate array of emails. Intended to be used with create/update users
+     */
+    validateEmail(input) {
+        const emails = Array.isArray(input) ? input : [input];
+        const schema = Joi.string().email().required();
+        for (const email of emails) {
+            const { error } = schema.validate(email);
+            if (error) {
+                throw new FailedValidationError({
+                    field: 'email',
+                    type: 'email',
+                });
+            }
+        }
+    }
     /**
      * Create a new user
      */
@@ -145,6 +162,7 @@ export class UsersService extends ItemsService {
         const passwords = data['map']((payload) => payload['password']).filter((password) => password);
         try {
             if (emails.length) {
+                this.validateEmail(emails);
                 await this.checkUniqueEmails(emails);
             }
             if (passwords.length) {
@@ -212,6 +230,7 @@ export class UsersService extends ItemsService {
                         field: 'email',
                     });
                 }
+                this.validateEmail(data['email']);
                 await this.checkUniqueEmails([data['email']], keys[0]);
             }
             if (data['password']) {

package/dist/types/collection.d.ts

@@ -7,7 +7,6 @@ export type CollectionMeta = {
     singleton: boolean;
     icon: string | null;
     translations: Record<string, string>;
-    branches_enabled: boolean;
     item_duplication_fields: string[] | null;
     accountability: 'all' | 'accountability' | null;
     group: string | null;

package/dist/types/items.d.ts

@@ -47,6 +47,7 @@ export type MutationOptions = {
      */
     mutationTracker?: MutationTracker | undefined;
     preMutationError?: DirectusError | undefined;
+    bypassAutoIncrementSequenceReset?: boolean;
 };
 export type ActionEventParams = {
     event: string | string[];

package/dist/utils/sanitize-query.js

@@ -46,9 +46,6 @@ export function sanitizeQuery(rawQuery, accountability) {
     if (rawQuery['search'] && typeof rawQuery['search'] === 'string') {
         query.search = rawQuery['search'];
     }
-    if (rawQuery['branch']) {
-        query.branch = rawQuery['branch'];
-    }
     if (rawQuery['export']) {
         query.export = rawQuery['export'];
     }

package/dist/utils/validate-query.js

@@ -17,7 +17,6 @@ const querySchema = Joi.object({
     meta: Joi.array().items(Joi.string().valid('total_count', 'filter_count')),
     search: Joi.string(),
     export: Joi.string().valid('csv', 'json', 'xml', 'yaml'),
-    branch: Joi.string(),
     aggregate: Joi.object(),
     deep: Joi.object(),
     alias: Joi.object(),

package/dist/websocket/controllers/base.d.ts

@@ -30,6 +30,7 @@ export default abstract class SocketController {
         maxConnections: number;
     };
     protected getRateLimiter(): RateLimiterAbstract | null;
+    private catchInvalidMessages;
     protected handleUpgrade(request: IncomingMessage, socket: internal.Duplex, head: Buffer): Promise<void>;
     protected handleStrictUpgrade({ request, socket, head }: UpgradeContext, query: ParsedUrlQuery): Promise<void>;
     protected handleHandshakeUpgrade({ request, socket, head }: UpgradeContext): Promise<void>;

package/dist/websocket/controllers/base.js

@@ -67,6 +67,19 @@ export default class SocketController {
         }
         return null;
     }
+    catchInvalidMessages(ws) {
+        /**
+         * This fix was done to prevent the API from crashing on receiving invalid WebSocket frames
+         * https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
+         * https://github.com/websockets/ws/issues/2098
+         */
+        // @ts-ignore <- required because "_socket" is not typed on WS
+        ws._socket.prependListener('data', (data) => data.toString());
+        ws.on('error', (error) => {
+            if (error.message)
+                logger.debug(error.message);
+        });
+    }
     async handleUpgrade(request, socket, head) {
         const { pathname, query } = parse(request.url, true);
         if (pathname !== this.endpoint)
@@ -87,6 +100,7 @@ export default class SocketController {
             return;
         }
         this.server.handleUpgrade(request, socket, head, async (ws) => {
+            this.catchInvalidMessages(ws);
             const state = { accountability: null, expires_at: null };
             this.server.emit('connection', ws, state);
         });
@@ -109,12 +123,14 @@ export default class SocketController {
             return;
         }
         this.server.handleUpgrade(request, socket, head, async (ws) => {
+            this.catchInvalidMessages(ws);
             const state = { accountability, expires_at };
             this.server.emit('connection', ws, state);
         });
     }
     async handleHandshakeUpgrade({ request, socket, head }) {
         this.server.handleUpgrade(request, socket, head, async (ws) => {
+            this.catchInvalidMessages(ws);
             try {
                 const payload = await waitForAnyMessage(ws, this.authentication.timeout);
                 if (getMessageType(payload) !== 'auth')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "13.1.0-beta.0",
+  "version": "13.1.1",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "keywords": [
     "directus",
@@ -131,7 +131,7 @@
     "rollup": "3.22.0",
     "samlify": "2.8.10",
     "sanitize-html": "2.10.0",
-    "sharp": "0.32.1",
+    "sharp": "0.32.5",
     "snappy": "7.2.2",
     "stream-json": "1.7.5",
     "strip-bom-stream": "5.0.0",
@@ -143,22 +143,22 @@
     "ws": "8.12.1",
     "zod": "3.21.4",
     "zod-validation-error": "1.0.1",
-    "@directus/app": "10.8.0-beta.0",
-    "@directus/constants": "10.2.4-beta.0",
+    "@directus/app": "10.9.0",
+    "@directus/constants": "10.2.3",
     "@directus/errors": "0.0.2",
-    "@directus/extensions-sdk": "10.1.10-beta.0",
-    "@directus/pressure": "1.0.9-beta.0",
+    "@directus/extensions-sdk": "10.1.11",
+    "@directus/pressure": "1.0.10",
     "@directus/schema": "10.0.2",
     "@directus/specs": "10.2.0",
     "@directus/storage": "10.0.5",
-    "@directus/storage-driver-azure": "10.0.10-beta.0",
-    "@directus/storage-driver-cloudinary": "10.0.10-beta.0",
-    "@directus/storage-driver-gcs": "10.0.10-beta.0",
-    "@directus/storage-driver-local": "10.0.10-beta.0",
-    "@directus/storage-driver-s3": "10.0.10-beta.0",
-    "@directus/storage-driver-supabase": "1.0.2-beta.0",
-    "@directus/utils": "10.0.10-beta.0",
-    "@directus/validation": "0.0.5-beta.0"
+    "@directus/storage-driver-azure": "10.0.11",
+    "@directus/storage-driver-cloudinary": "10.0.11",
+    "@directus/storage-driver-gcs": "10.0.11",
+    "@directus/storage-driver-local": "10.0.11",
+    "@directus/storage-driver-s3": "10.0.11",
+    "@directus/storage-driver-supabase": "1.0.3",
+    "@directus/utils": "10.0.11",
+    "@directus/validation": "0.0.6"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
@@ -207,7 +207,7 @@
     "vitest": "0.31.1",
     "@directus/random": "0.2.2",
     "@directus/tsconfig": "1.0.0",
-    "@directus/types": "10.1.6-beta.0"
+    "@directus/types": "10.1.6"
   },
   "optionalDependencies": {
     "@keyv/redis": "2.5.8",

package/dist/controllers/branches.d.ts

@@ -1,2 +0,0 @@
-declare const router: import("express-serve-static-core").Router;
-export default router;

package/dist/controllers/branches.js

@@ -1,190 +0,0 @@
-import { isDirectusError } from '@directus/errors';
-import express from 'express';
-import { assign } from 'lodash-es';
-import { ErrorCode, InvalidPayloadError } from '../errors/index.js';
-import { respond } from '../middleware/respond.js';
-import useCollection from '../middleware/use-collection.js';
-import { validateBatch } from '../middleware/validate-batch.js';
-import { BranchesService } from '../services/branches.js';
-import { MetaService } from '../services/meta.js';
-import asyncHandler from '../utils/async-handler.js';
-import { sanitizeQuery } from '../utils/sanitize-query.js';
-const router = express.Router();
-router.use(useCollection('directus_branches'));
-router.post('/', asyncHandler(async (req, res, next) => {
-    const service = new BranchesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    const savedKeys = [];
-    if (Array.isArray(req.body)) {
-        const keys = await service.createMany(req.body);
-        savedKeys.push(...keys);
-    }
-    else {
-        const primaryKey = await service.createOne(req.body);
-        savedKeys.push(primaryKey);
-    }
-    try {
-        if (Array.isArray(req.body)) {
-            const records = await service.readMany(savedKeys, req.sanitizedQuery);
-            res.locals['payload'] = { data: records };
-        }
-        else {
-            const record = await service.readOne(savedKeys[0], req.sanitizedQuery);
-            res.locals['payload'] = { data: record };
-        }
-    }
-    catch (error) {
-        if (isDirectusError(error, ErrorCode.Forbidden)) {
-            return next();
-        }
-        throw error;
-    }
-    return next();
-}), respond);
-const readHandler = asyncHandler(async (req, res, next) => {
-    const service = new BranchesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    const metaService = new MetaService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    let result;
-    if (req.singleton) {
-        result = await service.readSingleton(req.sanitizedQuery);
-    }
-    else if (req.body.keys) {
-        result = await service.readMany(req.body.keys, req.sanitizedQuery);
-    }
-    else {
-        result = await service.readByQuery(req.sanitizedQuery);
-    }
-    const meta = await metaService.getMetaForQuery(req.collection, req.sanitizedQuery);
-    res.locals['payload'] = { data: result, meta };
-    return next();
-});
-router.get('/', validateBatch('read'), readHandler, respond);
-router.search('/', validateBatch('read'), readHandler, respond);
-router.get('/:pk', asyncHandler(async (req, res, next) => {
-    const service = new BranchesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    const record = await service.readOne(req.params['pk'], req.sanitizedQuery);
-    res.locals['payload'] = { data: record || null };
-    return next();
-}), respond);
-router.patch('/', validateBatch('update'), asyncHandler(async (req, res, next) => {
-    const service = new BranchesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    let keys = [];
-    if (Array.isArray(req.body)) {
-        keys = await service.updateBatch(req.body);
-    }
-    else if (req.body.keys) {
-        keys = await service.updateMany(req.body.keys, req.body.data);
-    }
-    else {
-        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
-        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
-    }
-    try {
-        const result = await service.readMany(keys, req.sanitizedQuery);
-        res.locals['payload'] = { data: result || null };
-    }
-    catch (error) {
-        if (isDirectusError(error, ErrorCode.Forbidden)) {
-            return next();
-        }
-        throw error;
-    }
-    return next();
-}), respond);
-router.patch('/:pk', asyncHandler(async (req, res, next) => {
-    const service = new BranchesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    const primaryKey = await service.updateOne(req.params['pk'], req.body);
-    try {
-        const record = await service.readOne(primaryKey, req.sanitizedQuery);
-        res.locals['payload'] = { data: record || null };
-    }
-    catch (error) {
-        if (isDirectusError(error, ErrorCode.Forbidden)) {
-            return next();
-        }
-        throw error;
-    }
-    return next();
-}), respond);
-router.delete('/', validateBatch('delete'), asyncHandler(async (req, _res, next) => {
-    const service = new BranchesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    if (Array.isArray(req.body)) {
-        await service.deleteMany(req.body);
-    }
-    else if (req.body.keys) {
-        await service.deleteMany(req.body.keys);
-    }
-    else {
-        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
-        await service.deleteByQuery(sanitizedQuery);
-    }
-    return next();
-}), respond);
-router.delete('/:pk', asyncHandler(async (req, _res, next) => {
-    const service = new BranchesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    await service.deleteOne(req.params['pk']);
-    return next();
-}), respond);
-router.get('/:pk/compare', asyncHandler(async (req, res, next) => {
-    const service = new BranchesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    const branch = await service.readOne(req.params['pk']);
-    const { outdated, mainHash } = await service.verifyHash(branch['collection'], branch['item'], branch['hash']);
-    const commits = await service.getBranchCommits(branch['id']);
-    const current = assign({}, ...commits);
-    const fields = Object.keys(current);
-    const mainBranchItem = await service.getMainBranchItem(branch['collection'], branch['item'], fields.length > 0 ? { fields } : undefined);
-    res.locals['payload'] = { data: { outdated, mainHash, current, main: mainBranchItem } };
-    return next();
-}), respond);
-router.post('/:pk/commit', asyncHandler(async (req, res, next) => {
-    const service = new BranchesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    const branch = await service.readOne(req.params['pk']);
-    const mainBranchItem = await service.getMainBranchItem(branch['collection'], branch['item']);
-    await service.commit(req.params['pk'], req.body);
-    const commits = await service.getBranchCommits(req.params['pk']);
-    const result = assign(mainBranchItem, ...commits);
-    res.locals['payload'] = { data: result || null };
-    return next();
-}), respond);
-router.post('/:pk/merge', asyncHandler(async (req, res, next) => {
-    if (typeof req.body.mainHash !== 'string') {
-        throw new InvalidPayloadError({ reason: `"mainHash" field is required` });
-    }
-    const service = new BranchesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    const updatedItemKey = await service.merge(req.params['pk'], req.body.mainHash, req.body?.['fields']);
-    res.locals['payload'] = { data: updatedItemKey || null };
-    return next();
-}), respond);
-export default router;

package/dist/database/migrations/20230823A-add-content-versioning.d.ts

@@ -1,3 +0,0 @@
-import type { Knex } from 'knex';
-export declare function up(knex: Knex): Promise<void>;
-export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20230823A-add-content-versioning.js

@@ -1,26 +0,0 @@
-export async function up(knex) {
-    await knex.schema.createTable('directus_branches', (table) => {
-        table.uuid('id').primary().notNullable();
-        table.string('name').notNullable();
-        table.string('collection', 64).references('collection').inTable('directus_collections').onDelete('CASCADE');
-        table.string('item');
-        table.string('hash').notNullable();
-        table.timestamp('date_created').defaultTo(knex.fn.now());
-        table.uuid('user_created').references('id').inTable('directus_users').onDelete('SET NULL');
-    });
-    await knex.schema.alterTable('directus_collections', (table) => {
-        table.boolean('branches_enabled').notNullable().defaultTo(false);
-    });
-    await knex.schema.alterTable('directus_revisions', (table) => {
-        table.uuid('branch').references('id').inTable('directus_branches').onDelete('CASCADE');
-    });
-}
-export async function down(knex) {
-    await knex.schema.dropTable('directus_branches');
-    await knex.schema.alterTable('directus_collections', (table) => {
-        table.dropColumn('branches_enabled');
-    });
-    await knex.schema.alterTable('directus_revisions', (table) => {
-        table.dropColumn('branch');
-    });
-}

package/dist/database/system-data/fields/branches.yaml

@@ -1,19 +0,0 @@
-table: directus_branches
-
-fields:
-  - field: id
-    special:
-      - uuid
-    readonly: true
-    hidden: true
-  - field: name
-  - field: collection
-  - field: item
-  - field: hash
-  - field: date_created
-    special:
-      - date-created
-      - cast-timestamp
-  - field: user_created
-    special:
-      - user-created

package/dist/services/branches.d.ts

@@ -1,25 +0,0 @@
-import type { Item, PrimaryKey, Query } from '@directus/types';
-import type { AbstractServiceOptions, MutationOptions } from '../types/index.js';
-import { AuthorizationService } from './authorization.js';
-import { CollectionsService } from './collections.js';
-import { ItemsService } from './items.js';
-export declare class BranchesService extends ItemsService {
-    authorizationService: AuthorizationService;
-    collectionsService: CollectionsService;
-    constructor(options: AbstractServiceOptions);
-    private validateCreateData;
-    private validateUpdateData;
-    getMainBranchItem(collection: string, item: PrimaryKey, query?: Query): Promise<Item>;
-    verifyHash(collection: string, item: PrimaryKey, hash: string): Promise<{
-        outdated: boolean;
-        mainHash: string;
-    }>;
-    getBranchCommits(key: PrimaryKey): Promise<Partial<Item>[]>;
-    createOne(data: Partial<Item>, opts?: MutationOptions): Promise<PrimaryKey>;
-    createMany(data: Partial<Item>[], opts?: MutationOptions): Promise<PrimaryKey[]>;
-    updateBatch(data: Partial<Item>[], opts?: MutationOptions): Promise<PrimaryKey[]>;
-    updateMany(keys: PrimaryKey[], data: Partial<Item>, opts?: MutationOptions): Promise<PrimaryKey[]>;
-    updateByQuery(query: Query, data: Partial<Item>, opts?: MutationOptions): Promise<PrimaryKey[]>;
-    commit(key: PrimaryKey, data: Partial<Item>): Promise<Partial<Item>>;
-    merge(branch: PrimaryKey, mainHash: string, fields?: string[]): Promise<import("../types/items.js").PrimaryKey>;
-}