@directus/api 14.1.0 → 14.1.2

package/dist/constants.js

@@ -55,7 +55,7 @@ export const COOKIE_OPTIONS = {
     secure: env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false,
     sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
 };
-export const OAS_REQUIRED_SCHEMAS = ['Diff', 'Schema', 'Query', 'x-metadata'];
+export const OAS_REQUIRED_SCHEMAS = ['Query', 'x-metadata'];
 /** Formats from which transformation is supported */
 export const SUPPORTED_IMAGE_TRANSFORM_FORMATS = ['image/jpeg', 'image/png', 'image/webp', 'image/tiff', 'image/avif'];
 /** Formats where metadata extraction is supported */

package/dist/controllers/server.js

@@ -11,7 +11,7 @@ router.get('/specs/oas', asyncHandler(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    res.locals['payload'] = await service.oas.generate();
+    res.locals['payload'] = await service.oas.generate(req.headers.host);
     return next();
 }), respond);
 router.get('/specs/graphql/:scope?', asyncHandler(async (req, res) => {

package/dist/database/system-data/fields/settings.yaml

@@ -120,6 +120,8 @@ fields:
   - field: theme_light_overrides
     width: full
     interface: system-theme-overrides
+    options:
+      appearance: light
     group: theming_group
     special:
       - cast-json
@@ -134,6 +136,8 @@ fields:
   - field: theme_dark_overrides
     width: full
     interface: system-theme-overrides
+    options:
+      appearance: dark
     group: theming_group
     special:
       - cast-json

package/dist/database/system-data/fields/users.yaml

@@ -124,6 +124,8 @@ fields:
   - field: theme_light_overrides
     width: full
     interface: system-theme-overrides
+    options:
+      appearance: light
     special:
       - cast-json
 
@@ -137,6 +139,8 @@ fields:
   - field: theme_dark_overrides
     width: full
     interface: system-theme-overrides
+    options:
+      appearance: dark
     special:
       - cast-json
 

package/dist/services/specifications.d.ts

@@ -2,20 +2,14 @@ import type { Accountability, SchemaOverview } from '@directus/types';
 import type { Knex } from 'knex';
 import type { OpenAPIObject } from 'openapi3-ts/oas30';
 import type { AbstractServiceOptions } from '../types/index.js';
-import { CollectionsService } from './collections.js';
-import { FieldsService } from './fields.js';
 import { GraphQLService } from './graphql/index.js';
-import { RelationsService } from './relations.js';
 export declare class SpecificationService {
     accountability: Accountability | null;
     knex: Knex;
     schema: SchemaOverview;
-    fieldsService: FieldsService;
-    collectionsService: CollectionsService;
-    relationsService: RelationsService;
     oas: OASSpecsService;
     graphql: GraphQLSpecsService;
-    constructor(options: AbstractServiceOptions);
+    constructor({ accountability, knex, schema }: AbstractServiceOptions);
 }
 interface SpecificationSubService {
     generate: (_?: any) => Promise<any>;
@@ -24,15 +18,8 @@ declare class OASSpecsService implements SpecificationSubService {
     accountability: Accountability | null;
     knex: Knex;
     schema: SchemaOverview;
-    fieldsService: FieldsService;
-    collectionsService: CollectionsService;
-    relationsService: RelationsService;
-    constructor(options: AbstractServiceOptions, { fieldsService, collectionsService, relationsService, }: {
-        fieldsService: FieldsService;
-        collectionsService: CollectionsService;
-        relationsService: RelationsService;
-    });
-    generate(): Promise<OpenAPIObject>;
+    constructor({ knex, schema, accountability }: AbstractServiceOptions);
+    generate(host?: string): Promise<OpenAPIObject>;
     private generateTags;
     private generatePaths;
     private generateComponents;

package/dist/services/specifications.js

@@ -6,57 +6,39 @@ import getDatabase from '../database/index.js';
 import env from '../env.js';
 import { getRelationType } from '../utils/get-relation-type.js';
 import { version } from '../utils/package.js';
-import { CollectionsService } from './collections.js';
-import { FieldsService } from './fields.js';
 import { GraphQLService } from './graphql/index.js';
-import { RelationsService } from './relations.js';
+import { reduceSchema } from '../utils/reduce-schema.js';
 export class SpecificationService {
     accountability;
     knex;
     schema;
-    fieldsService;
-    collectionsService;
-    relationsService;
     oas;
     graphql;
-    constructor(options) {
-        this.accountability = options.accountability || null;
-        this.knex = options.knex || getDatabase();
-        this.schema = options.schema;
-        this.fieldsService = new FieldsService(options);
-        this.collectionsService = new CollectionsService(options);
-        this.relationsService = new RelationsService(options);
-        this.oas = new OASSpecsService(options, {
-            fieldsService: this.fieldsService,
-            collectionsService: this.collectionsService,
-            relationsService: this.relationsService,
-        });
-        this.graphql = new GraphQLSpecsService(options);
+    constructor({ accountability, knex, schema }) {
+        this.accountability = accountability || null;
+        this.knex = knex || getDatabase();
+        this.schema = schema;
+        this.oas = new OASSpecsService({ knex, schema, accountability });
+        this.graphql = new GraphQLSpecsService({ knex, schema });
     }
 }
 class OASSpecsService {
     accountability;
     knex;
     schema;
-    fieldsService;
-    collectionsService;
-    relationsService;
-    constructor(options, { fieldsService, collectionsService, relationsService, }) {
-        this.accountability = options.accountability || null;
-        this.knex = options.knex || getDatabase();
-        this.schema = options.schema;
-        this.fieldsService = fieldsService;
-        this.collectionsService = collectionsService;
-        this.relationsService = relationsService;
+    constructor({ knex, schema, accountability }) {
+        this.accountability = accountability || null;
+        this.knex = knex || getDatabase();
+        this.schema =
+            this.accountability?.admin === true ? schema : reduceSchema(schema, accountability?.permissions || null);
     }
-    async generate() {
-        const collections = await this.collectionsService.readByQuery();
-        const fields = await this.fieldsService.readAll();
-        const relations = (await this.relationsService.readAll());
+    async generate(host) {
         const permissions = this.accountability?.permissions ?? [];
-        const tags = await this.generateTags(collections);
+        const tags = await this.generateTags();
         const paths = await this.generatePaths(permissions, tags);
-        const components = await this.generateComponents(collections, fields, relations, tags);
+        const components = await this.generateComponents(tags);
+        const isDefaultPublicUrl = env['PUBLIC_URL'] === '/';
+        const url = isDefaultPublicUrl && host ? host : env['PUBLIC_URL'];
         const spec = {
             openapi: '3.0.1',
             info: {
@@ -66,7 +48,7 @@ class OASSpecsService {
             },
             servers: [
                 {
-                    url: env['PUBLIC_URL'],
+                    url,
                     description: 'Your current Directus instance.',
                 },
             ],
@@ -78,11 +60,17 @@ class OASSpecsService {
             spec.components = components;
         return spec;
     }
-    async generateTags(collections) {
+    async generateTags() {
         const systemTags = cloneDeep(spec.tags);
+        const collections = Object.values(this.schema.collections);
         const tags = [];
-        // System tags that don't have an associated collection are always readable to the user
         for (const systemTag of systemTags) {
+            // Check if necessary authentication level is given
+            if (systemTag['x-authentication'] === 'admin' && !this.accountability?.admin)
+                continue;
+            if (systemTag['x-authentication'] === 'user' && !this.accountability?.user)
+                continue;
+            // Remaining system tags that don't have an associated collection are publicly available
             if (!systemTag['x-collection']) {
                 tags.push(systemTag);
             }
@@ -103,8 +91,8 @@ class OASSpecsService {
                     name: 'Items' + formatTitle(collection.collection).replace(/ /g, ''),
                     'x-collection': collection.collection,
                 };
-                if (collection.meta?.note) {
-                    tag.description = collection.meta.note;
+                if (collection.note) {
+                    tag.description = collection.note;
                 }
                 tags.push(tag);
             }
@@ -256,33 +244,38 @@ class OASSpecsService {
         }
         return paths;
     }
-    async generateComponents(collections, fields, relations, tags) {
+    async generateComponents(tags) {
+        if (!tags)
+            return;
         let components = cloneDeep(spec.components);
         if (!components)
             components = {};
         components.schemas = {};
-        // Always includes the schemas with these names
-        if (spec.components?.schemas !== null) {
-            for (const schemaName of OAS_REQUIRED_SCHEMAS) {
-                if (spec.components.schemas[schemaName] !== null) {
-                    components.schemas[schemaName] = cloneDeep(spec.components.schemas[schemaName]);
-                }
+        const tagSchemas = tags.reduce((schemas, tag) => [...schemas, ...(tag['x-schemas'] ? tag['x-schemas'] : [])], []);
+        const requiredSchemas = [...OAS_REQUIRED_SCHEMAS, ...tagSchemas];
+        for (const [name, schema] of Object.entries(spec.components?.schemas ?? {})) {
+            if (requiredSchemas.includes(name)) {
+                const collection = spec.tags?.find((tag) => tag.name === name)?.['x-collection'];
+                components.schemas[name] = {
+                    ...cloneDeep(schema),
+                    ...(collection && { 'x-collection': collection }),
+                };
             }
         }
-        if (!tags)
-            return;
+        const collections = Object.values(this.schema.collections);
         for (const collection of collections) {
             const tag = tags.find((tag) => tag['x-collection'] === collection.collection);
             if (!tag)
                 continue;
             const isSystem = collection.collection.startsWith('directus_');
-            const fieldsInCollection = fields.filter((field) => field.collection === collection.collection);
+            const fieldsInCollection = Object.values(collection.fields);
             if (isSystem) {
                 const schemaComponent = cloneDeep(spec.components.schemas[tag.name]);
                 schemaComponent.properties = {};
+                schemaComponent['x-collection'] = collection.collection;
                 for (const field of fieldsInCollection) {
                     schemaComponent.properties[field.field] =
-                        cloneDeep(spec.components.schemas[tag.name].properties[field.field]) || this.generateField(field, relations, tags, fields);
+                        cloneDeep(spec.components.schemas[tag.name].properties[field.field]) || this.generateField(collection.collection, field, tags);
                 }
                 components.schemas[tag.name] = schemaComponent;
             }
@@ -293,7 +286,7 @@ class OASSpecsService {
                     'x-collection': collection.collection,
                 };
                 for (const field of fieldsInCollection) {
-                    schemaComponent.properties[field.field] = this.generateField(field, relations, tags, fields);
+                    schemaComponent.properties[field.field] = this.generateField(collection.collection, field, tags);
                 }
                 components.schemas[tag.name] = schemaComponent;
             }
@@ -316,16 +309,14 @@ class OASSpecsService {
                 return 'read';
         }
     }
-    generateField(field, relations, tags, fields) {
+    generateField(collection, field, tags) {
         let propertyObject = {};
-        if (field.schema && 'is_nullable' in field.schema) {
-            propertyObject.nullable = field.schema.is_nullable;
+        propertyObject.nullable = field.nullable;
+        if (field.note) {
+            propertyObject.description = field.note;
         }
-        if (field.meta?.note) {
-            propertyObject.description = field.meta.note;
-        }
-        const relation = relations.find((relation) => (relation.collection === field.collection && relation.field === field.field) ||
-            (relation.related_collection === field.collection && relation.meta?.one_field === field.field));
+        const relation = this.schema.relations.find((relation) => (relation.collection === collection && relation.field === field.field) ||
+            (relation.related_collection === collection && relation.meta?.one_field === field.field));
         if (!relation) {
             propertyObject = {
                 ...propertyObject,
@@ -336,13 +327,17 @@ class OASSpecsService {
             const relationType = getRelationType({
                 relation,
                 field: field.field,
-                collection: field.collection,
+                collection: collection,
             });
             if (relationType === 'm2o') {
                 const relatedTag = tags.find((tag) => tag['x-collection'] === relation.related_collection);
-                const relatedPrimaryKeyField = fields.find((field) => field.collection === relation.related_collection && field.schema?.is_primary_key);
-                if (!relatedTag || !relatedPrimaryKeyField)
+                if (!relatedTag ||
+                    !relation.related_collection ||
+                    relation.related_collection in this.schema.collections === false) {
                     return propertyObject;
+                }
+                const relatedCollection = this.schema.collections[relation.related_collection];
+                const relatedPrimaryKeyField = relatedCollection.fields[relatedCollection.primary];
                 propertyObject.oneOf = [
                     {
                         ...this.fieldTypes[relatedPrimaryKeyField.type],
@@ -354,7 +349,11 @@ class OASSpecsService {
             }
             else if (relationType === 'o2m') {
                 const relatedTag = tags.find((tag) => tag['x-collection'] === relation.collection);
-                const relatedPrimaryKeyField = fields.find((field) => field.collection === relation.collection && field.schema?.is_primary_key);
+                if (!relatedTag || !relation.related_collection || relation.collection in this.schema.collections === false) {
+                    return propertyObject;
+                }
+                const relatedCollection = this.schema.collections[relation.collection];
+                const relatedPrimaryKeyField = relatedCollection.fields[relatedCollection.primary];
                 if (!relatedTag || !relatedPrimaryKeyField)
                     return propertyObject;
                 propertyObject.type = 'array';

package/dist/types/services.d.ts

@@ -2,7 +2,7 @@ import type { Accountability, Query, SchemaOverview } from '@directus/types';
 import type { Knex } from 'knex';
 import type { Item, PrimaryKey } from './items.js';
 export type AbstractServiceOptions = {
-    knex?: Knex;
+    knex?: Knex | undefined;
     accountability?: Accountability | null | undefined;
     schema: SchemaOverview;
 };

package/dist/utils/get-permissions.js

@@ -86,9 +86,6 @@ function parsePermissions(permissions) {
         if (permission.permissions && typeof permission.permissions === 'string') {
             permission.permissions = parseJSON(permission.permissions);
         }
-        else if (permission.permissions === null) {
-            permission.permissions = {};
-        }
         if (permission.validation && typeof permission.validation === 'string') {
             permission.validation = parseJSON(permission.validation);
         }

package/dist/utils/get-snapshot-diff.js

@@ -55,7 +55,8 @@ export function getSnapshotDiff(current, after) {
             }),
             ...after.relations
                 .filter((afterRelation) => {
-                const currentRelation = current.relations.find((currentRelation) => currentRelation.collection === afterRelation.collection && afterRelation.field === currentRelation.field);
+                const currentRelation = current.relations.find((currentRelation) => currentRelation.collection === afterRelation.collection &&
+                    afterRelation.field === currentRelation.field);
                 return !!currentRelation === false;
             })
                 .map((afterRelation) => ({

package/dist/utils/merge-permissions.js

@@ -1,4 +1,4 @@
-import { flatten, intersection, isEmpty, merge, omit } from 'lodash-es';
+import { flatten, intersection, isEqual, merge, omit } from 'lodash-es';
 export function mergePermissions(strategy, ...permissions) {
     const allPermissions = flatten(permissions);
     const mergedPermissions = allPermissions
@@ -27,11 +27,15 @@ export function mergePermission(strategy, currentPerm, newPerm) {
             };
         }
         else if (currentPerm.permissions) {
-            permissions = {
-                [logicalKey]: strategy === 'or'
-                    ? [currentPerm.permissions, newPerm.permissions].filter((p) => !isEmpty(p))
-                    : [currentPerm.permissions, newPerm.permissions],
-            };
+            // Empty {} supersedes other permissions in _OR merge
+            if (strategy === 'or' && (isEqual(currentPerm.permissions, {}) || isEqual(newPerm.permissions, {}))) {
+                permissions = {};
+            }
+            else {
+                permissions = {
+                    [logicalKey]: [currentPerm.permissions, newPerm.permissions],
+                };
+            }
         }
         else {
             permissions = {
@@ -49,11 +53,15 @@ export function mergePermission(strategy, currentPerm, newPerm) {
             };
         }
         else if (currentPerm.validation) {
-            validation = {
-                [logicalKey]: strategy === 'or'
-                    ? [currentPerm.validation, newPerm.validation].filter((p) => !isEmpty(p))
-                    : [currentPerm.validation, newPerm.validation],
-            };
+            // Empty {} supersedes other validations in _OR merge
+            if (strategy === 'or' && (isEqual(currentPerm.validation, {}) || isEqual(newPerm.validation, {}))) {
+                validation = {};
+            }
+            else {
+                validation = {
+                    [logicalKey]: [currentPerm.validation, newPerm.validation],
+                };
+            }
         }
         else {
             validation = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "14.1.0",
+  "version": "14.1.2",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "keywords": [
     "directus",
@@ -138,30 +138,30 @@
     "stream-json": "1.7.5",
     "strip-bom-stream": "5.0.0",
     "tinypool": "0.8.1",
-    "tsx": "3.12.7",
+    "tsx": "4.1.4",
     "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
     "wellknown": "0.5.0",
     "ws": "8.14.2",
     "zod": "3.22.4",
     "zod-validation-error": "1.0.1",
-    "@directus/app": "10.13.0",
-    "@directus/constants": "11.0.1",
+    "@directus/app": "10.13.2",
     "@directus/errors": "0.2.0",
+    "@directus/constants": "11.0.1",
+    "@directus/extensions": "0.2.0",
     "@directus/extensions-sdk": "10.2.0",
     "@directus/pressure": "1.0.13",
-    "@directus/extensions": "0.2.0",
     "@directus/schema": "11.0.0",
-    "@directus/specs": "10.2.2",
-    "@directus/storage": "10.0.7",
+    "@directus/specs": "10.2.4",
     "@directus/storage-driver-azure": "10.0.14",
-    "@directus/storage-driver-gcs": "10.0.14",
     "@directus/storage-driver-cloudinary": "10.0.14",
+    "@directus/storage-driver-gcs": "10.0.14",
+    "@directus/storage": "10.0.7",
     "@directus/storage-driver-local": "10.0.14",
-    "@directus/storage-driver-s3": "10.0.14",
     "@directus/storage-driver-supabase": "1.0.6",
-    "@directus/validation": "0.0.9",
-    "@directus/utils": "11.0.2"
+    "@directus/storage-driver-s3": "10.0.14",
+    "@directus/utils": "11.0.2",
+    "@directus/validation": "0.0.9"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
@@ -202,13 +202,13 @@
     "@types/uuid-validate": "0.0.1",
     "@types/wellknown": "0.5.4",
     "@types/ws": "8.5.8",
-    "@vitest/coverage-c8": "0.31.1",
+    "@vitest/coverage-v8": "0.34.6",
     "copyfiles": "2.4.1",
     "form-data": "4.0.0",
     "knex-mock-client": "2.0.0",
     "supertest": "6.3.3",
     "typescript": "5.2.2",
-    "vitest": "0.31.1",
+    "vitest": "0.34.6",
     "@directus/random": "0.2.3",
     "@directus/tsconfig": "1.0.1",
     "@directus/types": "11.0.2"