@directus/api 17.0.1 → 17.1.0

package/dist/controllers/fields.js

@@ -126,9 +126,6 @@ router.patch('/:collection/:field', validateCollection, asyncHandler(async (req,
     if (error) {
         throw new InvalidPayloadError({ reason: error.message });
     }
-    if (req.body.schema && !req.body.type) {
-        throw new InvalidPayloadError({ reason: `You need to provide "type" when providing "schema"` });
-    }
     const fieldData = req.body;
     if (!fieldData.field)
         fieldData.field = req.params['field'];

package/dist/operations/item-update/index.js

@@ -32,7 +32,10 @@ export default defineOperationApi({
             return null;
         }
         let result;
-        if (!key || (Array.isArray(key) && key.length === 0)) {
+        if (Array.isArray(payloadObject)) {
+            result = await itemsService.updateBatch(payloadObject, { emitEvents: !!emitEvents });
+        }
+        else if (!key || (Array.isArray(key) && key.length === 0)) {
             result = await itemsService.updateByQuery(sanitizedQueryObject, payloadObject, { emitEvents: !!emitEvents });
         }
         else {

package/dist/services/fields.js

@@ -300,6 +300,12 @@ export class FieldsService {
         }
         const runPostColumnChange = await this.helpers.schema.preColumnChange();
         const nestedActionEvents = [];
+        // 'type' is required for further checks on schema update
+        if (field.schema && !field.type) {
+            const existingType = this.schema.collections[collection]?.fields[field.field]?.type;
+            if (existingType)
+                field.type = existingType;
+        }
         try {
             const hookAdjustedField = await emitter.emitFilter(`fields.update`, field, {
                 keys: [field.field],

package/dist/services/import-export.js

@@ -1,12 +1,14 @@
 import { useEnv } from '@directus/env';
 import { ForbiddenError, InvalidPayloadError, ServiceUnavailableError, UnsupportedMediaTypeError, } from '@directus/errors';
+import { isSystemCollection } from '@directus/system-data';
 import { parseJSON, toArray } from '@directus/utils';
+import { createTmpFile } from '@directus/utils/node';
 import { queue } from 'async';
 import destroyStream from 'destroy';
 import { dump as toYAML } from 'js-yaml';
 import { parse as toXML } from 'js2xmlparser';
 import { Parser as CSVParser, transforms as CSVTransforms } from 'json2csv';
-import { createReadStream } from 'node:fs';
+import { createReadStream, createWriteStream } from 'node:fs';
 import { appendFile } from 'node:fs/promises';
 import Papa from 'papaparse';
 import StreamArray from 'stream-json/streamers/StreamArray.js';
@@ -20,7 +22,6 @@ import { FilesService } from './files.js';
 import { ItemsService } from './items.js';
 import { NotificationsService } from './notifications.js';
 import { UsersService } from './users.js';
-import { isSystemCollection } from '@directus/system-data';
 const env = useEnv();
 const logger = useLogger();
 export class ImportService {
@@ -86,7 +87,10 @@ export class ImportService {
             });
         });
     }
-    importCSV(collection, stream) {
+    async importCSV(collection, stream) {
+        const tmpFile = await createTmpFile().catch(() => null);
+        if (!tmpFile)
+            throw new Error('Failed to create temporary file for import');
         const nestedActionEvents = [];
         return this.knex.transaction((trx) => {
             const service = new ItemsService(collection, {
@@ -116,35 +120,66 @@ export class ImportService {
                 transform,
             };
             return new Promise((resolve, reject) => {
-                stream
-                    .pipe(Papa.parse(Papa.NODE_STREAM_INPUT, PapaOptions))
-                    .on('data', (obj) => {
-                    // Filter out all undefined fields
-                    for (const field in obj) {
-                        if (obj[field] === undefined) {
-                            delete obj[field];
+                const streams = [stream];
+                const cleanup = (destroy = true) => {
+                    if (destroy) {
+                        for (const stream of streams) {
+                            destroyStream(stream);
                         }
                     }
-                    saveQueue.push(obj);
-                })
-                    .on('error', (err) => {
-                    destroyStream(stream);
-                    reject(new InvalidPayloadError({ reason: err.message }));
+                    tmpFile.cleanup().catch(() => {
+                        logger.warn(`Failed to cleanup temporary import file (${tmpFile.path})`);
+                    });
+                };
+                saveQueue.error((error) => {
+                    reject(error);
+                });
+                const fileWriteStream = createWriteStream(tmpFile.path)
+                    .on('error', (error) => {
+                    cleanup();
+                    reject(new Error('Error while writing import data to temporary file', { cause: error }));
                 })
-                    .on('end', () => {
-                    // In case of empty CSV file
-                    if (!saveQueue.started)
-                        return resolve();
-                    saveQueue.drain(() => {
-                        for (const nestedActionEvent of nestedActionEvents) {
-                            emitter.emitAction(nestedActionEvent.event, nestedActionEvent.meta, nestedActionEvent.context);
+                    .on('finish', () => {
+                    const fileReadStream = createReadStream(tmpFile.path).on('error', (error) => {
+                        cleanup();
+                        reject(new Error('Error while reading import data from temporary file', { cause: error }));
+                    });
+                    streams.push(fileReadStream);
+                    fileReadStream
+                        .pipe(Papa.parse(Papa.NODE_STREAM_INPUT, PapaOptions))
+                        .on('data', (obj) => {
+                        // Filter out all undefined fields
+                        for (const field in obj) {
+                            if (obj[field] === undefined) {
+                                delete obj[field];
+                            }
                         }
-                        return resolve();
+                        saveQueue.push(obj);
+                    })
+                        .on('error', (error) => {
+                        cleanup();
+                        reject(new InvalidPayloadError({ reason: error.message }));
+                    })
+                        .on('end', () => {
+                        cleanup(false);
+                        // In case of empty CSV file
+                        if (!saveQueue.started)
+                            return resolve();
+                        saveQueue.drain(() => {
+                            for (const nestedActionEvent of nestedActionEvents) {
+                                emitter.emitAction(nestedActionEvent.event, nestedActionEvent.meta, nestedActionEvent.context);
+                            }
+                            return resolve();
+                        });
                     });
                 });
-                saveQueue.error((err) => {
-                    reject(err);
-                });
+                streams.push(fileWriteStream);
+                stream
+                    .on('error', (error) => {
+                    cleanup();
+                    reject(new Error('Error while retrieving import data', { cause: error }));
+                })
+                    .pipe(fileWriteStream);
             });
         });
     }

package/dist/services/roles.d.ts

@@ -1,13 +1,18 @@
 import type { Query } from '@directus/types';
-import type { AbstractServiceOptions, MutationOptions, PrimaryKey } from '../types/index.js';
+import type { AbstractServiceOptions, Item, MutationOptions, PrimaryKey } from '../types/index.js';
 import { ItemsService } from './items.js';
 export declare class RolesService extends ItemsService {
     constructor(options: AbstractServiceOptions);
     private checkForOtherAdminRoles;
     private checkForOtherAdminUsers;
-    updateOne(key: PrimaryKey, data: Record<string, any>, opts?: MutationOptions): Promise<PrimaryKey>;
-    updateBatch(data: Record<string, any>[], opts?: MutationOptions): Promise<PrimaryKey[]>;
-    updateMany(keys: PrimaryKey[], data: Record<string, any>, opts?: MutationOptions): Promise<PrimaryKey[]>;
+    private isIpAccessValid;
+    private assertValidIpAccess;
+    createOne(data: Partial<Item>, opts?: MutationOptions): Promise<PrimaryKey>;
+    createMany(data: Partial<Item>[], opts?: MutationOptions): Promise<PrimaryKey[]>;
+    updateOne(key: PrimaryKey, data: Partial<Item>, opts?: MutationOptions): Promise<PrimaryKey>;
+    updateBatch(data: Partial<Item>[], opts?: MutationOptions): Promise<PrimaryKey[]>;
+    updateMany(keys: PrimaryKey[], data: Partial<Item>, opts?: MutationOptions): Promise<PrimaryKey[]>;
+    updateByQuery(query: Query, data: Partial<Item>, opts?: MutationOptions | undefined): Promise<PrimaryKey[]>;
     deleteOne(key: PrimaryKey): Promise<PrimaryKey>;
     deleteMany(keys: PrimaryKey[]): Promise<PrimaryKey[]>;
     deleteByQuery(query: Query, opts?: MutationOptions): Promise<PrimaryKey[]>;

package/dist/services/roles.js

@@ -1,4 +1,5 @@
-import { ForbiddenError, UnprocessableContentError } from '@directus/errors';
+import { ForbiddenError, InvalidPayloadError, UnprocessableContentError } from '@directus/errors';
+import { getMatch } from 'ip-matching';
 import { ItemsService } from './items.js';
 import { PermissionsService } from './permissions.js';
 import { PresetsService } from './presets.js';
@@ -74,7 +75,7 @@ export class RolesService extends ItemsService {
                     .count('*', { as: 'count' })
                     .from('directus_users')
                     .leftJoin('directus_roles', 'directus_users.role', 'directus_roles.id')
-                    .whereNotIn('directus_users.id', usersAdded)
+                    .whereNotIn('directus_users.id', usersAdded.map((user) => user.id))
                     .andWhere({ 'directus_roles.admin_access': true, status: 'active' })
                     .first();
                 const otherAdminUsersCount = Number(otherAdminUsers?.count ?? 0);
@@ -121,7 +122,46 @@ export class RolesService extends ItemsService {
         }
         return;
     }
+    isIpAccessValid(value) {
+        if (value === undefined)
+            return false;
+        if (value === null)
+            return true;
+        if (Array.isArray(value) && value.length === 0)
+            return true;
+        for (const ip of value) {
+            if (typeof ip !== 'string' || ip.includes('*'))
+                return false;
+            try {
+                const match = getMatch(ip);
+                if (match.type == 'IPMask')
+                    return false;
+            }
+            catch {
+                return false;
+            }
+        }
+        return true;
+    }
+    assertValidIpAccess(partialItem) {
+        if ('ip_access' in partialItem && !this.isIpAccessValid(partialItem['ip_access'])) {
+            throw new InvalidPayloadError({
+                reason: 'IP Access contains an incorrect value. Valid values are: IP addresses, IP ranges and CIDR blocks',
+            });
+        }
+    }
+    async createOne(data, opts) {
+        this.assertValidIpAccess(data);
+        return super.createOne(data, opts);
+    }
+    async createMany(data, opts) {
+        for (const partialItem of data) {
+            this.assertValidIpAccess(partialItem);
+        }
+        return super.createMany(data, opts);
+    }
     async updateOne(key, data, opts) {
+        this.assertValidIpAccess(data);
         try {
             if ('users' in data) {
                 await this.checkForOtherAdminUsers(key, data['users']);
@@ -133,6 +173,9 @@ export class RolesService extends ItemsService {
         return super.updateOne(key, data, opts);
     }
     async updateBatch(data, opts) {
+        for (const partialItem of data) {
+            this.assertValidIpAccess(partialItem);
+        }
         const primaryKeyField = this.schema.collections[this.collection].primary;
         const keys = data.map((item) => item[primaryKeyField]);
         const setsToNoAdmin = data.some((item) => item['admin_access'] === false);
@@ -147,6 +190,7 @@ export class RolesService extends ItemsService {
         return super.updateBatch(data, opts);
     }
     async updateMany(keys, data, opts) {
+        this.assertValidIpAccess(data);
         try {
             if ('admin_access' in data && data['admin_access'] === false) {
                 await this.checkForOtherAdminRoles(keys);
@@ -157,6 +201,10 @@ export class RolesService extends ItemsService {
         }
         return super.updateMany(keys, data, opts);
     }
+    async updateByQuery(query, data, opts) {
+        this.assertValidIpAccess(data);
+        return super.updateByQuery(query, data, opts);
+    }
     async deleteOne(key) {
         await this.deleteMany([key]);
         return key;

package/dist/websocket/controllers/hooks.js

@@ -130,7 +130,7 @@ function registerSortHooks() {
  */
 function registerAction(event, transform) {
     const messenger = useBus();
-    emitter.onAction(event, async (data) => {
+    emitter.onAction(event, (data) => {
         // push the event through the Redis pub/sub
         messenger.publish('websocket.event', transform(data));
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "17.0.1",
+  "version": "17.1.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "keywords": [
     "directus",
@@ -95,7 +95,7 @@
     "graphql-ws": "5.15.0",
     "helmet": "7.1.0",
     "icc": "3.0.0",
-    "inquirer": "9.2.14",
+    "inquirer": "9.2.15",
     "ioredis": "5.3.2",
     "ip-matching": "2.1.2",
     "isolated-vm": "4.7.2",
@@ -107,14 +107,14 @@
     "keyv": "4.5.4",
     "knex": "3.1.0",
     "ldapjs": "2.3.3",
-    "liquidjs": "10.10.0",
+    "liquidjs": "10.10.1",
     "lodash-es": "4.17.21",
     "marked": "12.0.0",
     "micromustache": "8.0.3",
     "mime-types": "2.1.35",
     "minimatch": "9.0.3",
     "ms": "2.1.3",
-    "nanoid": "5.0.5",
+    "nanoid": "5.0.6",
     "node-machine-id": "1.1.12",
     "node-schedule": "2.1.1",
     "nodemailer": "6.9.9",
@@ -126,7 +126,7 @@
     "p-limit": "5.0.0",
     "p-queue": "8.0.1",
     "papaparse": "5.4.1",
-    "pino": "8.18.0",
+    "pino": "8.19.0",
     "pino-http": "9.0.0",
     "pino-http-print": "3.1.0",
     "pino-pretty": "10.3.1",
@@ -134,7 +134,7 @@
     "rate-limiter-flexible": "4.0.1",
     "rollup": "4.10.0",
     "samlify": "2.8.10",
-    "sanitize-html": "2.11.0",
+    "sanitize-html": "2.12.0",
     "sharp": "0.33.2",
     "snappy": "7.2.2",
     "stream-json": "1.8.0",
@@ -145,30 +145,30 @@
     "ws": "8.16.0",
     "zod": "3.22.4",
     "zod-validation-error": "3.0.2",
-    "@directus/app": "10.15.1",
+    "@directus/app": "10.15.2",
     "@directus/constants": "11.0.3",
-    "@directus/env": "1.0.2",
     "@directus/errors": "0.2.3",
-    "@directus/extensions": "0.3.2",
-    "@directus/extensions-sdk": "10.3.3",
-    "@directus/pressure": "1.0.16",
+    "@directus/env": "1.0.2",
+    "@directus/extensions": "0.3.3",
+    "@directus/extensions-sdk": "10.3.4",
+    "@directus/memory": "1.0.3",
     "@directus/schema": "11.0.1",
-    "@directus/memory": "1.0.2",
     "@directus/specs": "10.2.6",
+    "@directus/pressure": "1.0.16",
     "@directus/storage-driver-azure": "10.0.17",
-    "@directus/storage-driver-cloudinary": "10.0.17",
     "@directus/storage": "10.0.10",
+    "@directus/storage-driver-cloudinary": "10.0.17",
     "@directus/storage-driver-gcs": "10.0.17",
+    "@directus/storage-driver-s3": "10.0.18",
     "@directus/storage-driver-local": "10.0.17",
-    "@directus/storage-driver-s3": "10.0.17",
-    "@directus/system-data": "1.0.0",
     "@directus/storage-driver-supabase": "1.0.9",
+    "@directus/system-data": "1.0.0",
     "@directus/utils": "11.0.5",
-    "@directus/validation": "0.0.12",
-    "directus": "10.9.2"
+    "directus": "10.9.3",
+    "@directus/validation": "0.0.12"
   },
   "devDependencies": {
-    "@ngneat/falso": "7.1.1",
+    "@ngneat/falso": "7.2.0",
     "@types/async": "3.2.24",
     "@types/busboy": "1.5.3",
     "@types/bytes": "3.1.4",
@@ -190,7 +190,7 @@
     "@types/lodash-es": "4.17.12",
     "@types/mime-types": "2.1.4",
     "@types/ms": "0.7.34",
-    "@types/node": "18.19.15",
+    "@types/node": "18.19.17",
     "@types/node-schedule": "2.1.6",
     "@types/nodemailer": "6.4.14",
     "@types/object-hash": "3.0.6",
@@ -202,15 +202,15 @@
     "@types/uuid-validate": "0.0.3",
     "@types/wellknown": "0.5.8",
     "@types/ws": "8.5.10",
-    "@vitest/coverage-v8": "1.2.2",
+    "@vitest/coverage-v8": "1.3.1",
     "copyfiles": "2.4.1",
     "form-data": "4.0.0",
     "knex-mock-client": "2.0.1",
     "typescript": "5.3.3",
-    "vitest": "1.2.2",
-    "@directus/types": "11.0.6",
+    "vitest": "1.3.0",
     "@directus/tsconfig": "1.0.1",
-    "@directus/random": "0.2.6"
+    "@directus/random": "0.2.6",
+    "@directus/types": "11.0.6"
   },
   "optionalDependencies": {
     "@keyv/redis": "2.8.4",