@directus/api 17.0.1 → 18.0.0

package/dist/services/fields.js

@@ -224,13 +224,15 @@ export class FieldsService {
                     accountability: this.accountability,
                     schema: this.schema,
                 });
-                const hookAdjustedField = await emitter.emitFilter(`fields.create`, field, {
-                    collection: collection,
-                }, {
-                    database: trx,
-                    schema: this.schema,
-                    accountability: this.accountability,
-                });
+                const hookAdjustedField = opts?.emitEvents !== false
+                    ? await emitter.emitFilter(`fields.create`, field, {
+                        collection: collection,
+                    }, {
+                        database: trx,
+                        schema: this.schema,
+                        accountability: this.accountability,
+                    })
+                    : field;
                 if (hookAdjustedField.type && ALIAS_TYPES.includes(hookAdjustedField.type) === false) {
                     if (table) {
                         this.addColumnToTable(table, hookAdjustedField);
@@ -300,15 +302,23 @@ export class FieldsService {
         }
         const runPostColumnChange = await this.helpers.schema.preColumnChange();
         const nestedActionEvents = [];
+        // 'type' is required for further checks on schema update
+        if (field.schema && !field.type) {
+            const existingType = this.schema.collections[collection]?.fields[field.field]?.type;
+            if (existingType)
+                field.type = existingType;
+        }
         try {
-            const hookAdjustedField = await emitter.emitFilter(`fields.update`, field, {
-                keys: [field.field],
-                collection: collection,
-            }, {
-                database: this.knex,
-                schema: this.schema,
-                accountability: this.accountability,
-            });
+            const hookAdjustedField = opts?.emitEvents !== false
+                ? await emitter.emitFilter(`fields.update`, field, {
+                    keys: [field.field],
+                    collection: collection,
+                }, {
+                    database: this.knex,
+                    schema: this.schema,
+                    accountability: this.accountability,
+                })
+                : field;
             const record = field.meta
                 ? await this.knex.select('id').from('directus_fields').where({ collection, field: field.field }).first()
                 : null;
@@ -403,13 +413,15 @@ export class FieldsService {
         const runPostColumnChange = await this.helpers.schema.preColumnChange();
         const nestedActionEvents = [];
         try {
-            await emitter.emitFilter('fields.delete', [field], {
-                collection: collection,
-            }, {
-                database: this.knex,
-                schema: this.schema,
-                accountability: this.accountability,
-            });
+            if (opts?.emitEvents !== false) {
+                await emitter.emitFilter('fields.delete', [field], {
+                    collection: collection,
+                }, {
+                    database: this.knex,
+                    schema: this.schema,
+                    accountability: this.accountability,
+                });
+            }
             await this.knex.transaction(async (trx) => {
                 const relations = this.schema.relations.filter((relation) => {
                     return ((relation.collection === collection && relation.field === field) ||

package/dist/services/graphql/index.js

@@ -5,14 +5,14 @@ import { parseFilterFunctionPath, toBoolean } from '@directus/utils';
 import argon2 from 'argon2';
 import { GraphQLBoolean, GraphQLEnumType, GraphQLError, GraphQLFloat, GraphQLID, GraphQLInt, GraphQLList, GraphQLNonNull, GraphQLObjectType, GraphQLScalarType, GraphQLSchema, GraphQLString, GraphQLUnionType, NoSchemaIntrospectionCustomRule, execute, specifiedRules, validate, } from 'graphql';
 import { GraphQLJSON, InputTypeComposer, ObjectTypeComposer, SchemaComposer, toInputObjectType } from 'graphql-compose';
-import { assign, flatten, get, mapKeys, merge, omit, pick, set, transform, uniq } from 'lodash-es';
+import { flatten, get, mapKeys, merge, omit, pick, set, transform, uniq } from 'lodash-es';
 import { clearSystemCache, getCache } from '../../cache.js';
-import { DEFAULT_AUTH_PROVIDER, GENERATE_SPECIAL } from '../../constants.js';
+import { DEFAULT_AUTH_PROVIDER, GENERATE_SPECIAL, REFRESH_COOKIE_OPTIONS, SESSION_COOKIE_OPTIONS, } from '../../constants.js';
 import getDatabase from '../../database/index.js';
 import { generateHash } from '../../utils/generate-hash.js';
 import { getGraphQLType } from '../../utils/get-graphql-type.js';
-import { getMilliseconds } from '../../utils/get-milliseconds.js';
 import { getService } from '../../utils/get-service.js';
+import { mergeVersionsRaw, mergeVersionsRecursive } from '../../utils/merge-version-data.js';
 import { reduceSchema } from '../../utils/reduce-schema.js';
 import { sanitizeQuery } from '../../utils/sanitize-query.js';
 import { validateQuery } from '../../utils/validate-query.js';
@@ -41,6 +41,8 @@ import { GraphQLVoid } from './types/void.js';
 import { addPathToValidationError } from './utils/add-path-to-validation-error.js';
 import processError from './utils/process-error.js';
 import { isSystemCollection } from '@directus/system-data';
+import isDirectusJWT from '../../utils/is-directus-jwt.js';
+import { verifyAccessJWT } from '../../utils/jwt.js';
 const env = useEnv();
 const validationRules = Array.from(specifiedRules);
 if (env['GRAPHQL_INTROSPECTION'] === false) {
@@ -372,6 +374,14 @@ export class GraphQLService {
                             },
                         },
                     });
+                    VersionTypes[relation.collection]?.addFields({
+                        [relation.field]: {
+                            type: GraphQLJSON,
+                            resolve: (obj, _, __, info) => {
+                                return obj[info?.path?.key ?? relation.field];
+                            },
+                        },
+                    });
                     if (relation.meta?.one_field) {
                         CollectionTypes[relation.related_collection]?.addFields({
                             [relation.meta.one_field]: {
@@ -945,6 +955,7 @@ export class GraphQLService {
                         type: ReadCollectionTypes[collection.collection],
                         args: {
                             id: new GraphQLNonNull(GraphQLID),
+                            version: GraphQLString,
                         },
                         resolve: async ({ info, context }) => {
                             const result = await self.resolveQuery(info);
@@ -1201,6 +1212,7 @@ export class GraphQLService {
             return null;
         const args = this.parseArgs(info.fieldNodes[0].arguments || [], info.variableValues);
         let query;
+        let versionRaw = false;
         const isAggregate = collection.endsWith('_aggregated') && collection in this.schema.collections === false;
         if (isAggregate) {
             query = this.getAggregateQuery(args, selections);
@@ -1213,6 +1225,7 @@ export class GraphQLService {
             }
             if (collection.endsWith('_by_version') && collection in this.schema.collections === false) {
                 collection = collection.slice(0, -11);
+                versionRaw = true;
             }
         }
         if (args['id']) {
@@ -1240,12 +1253,16 @@ export class GraphQLService {
             const saves = await versionsService.getVersionSaves(args['version'], collection, args['id']);
             if (saves) {
                 if (this.schema.collections[collection].singleton) {
-                    return assign(result, ...saves);
+                    return versionRaw
+                        ? mergeVersionsRaw(result, saves)
+                        : mergeVersionsRecursive(result, saves, collection, this.schema);
                 }
                 else {
                     if (result?.[0] === undefined)
                         return null;
-                    return assign(result[0], ...saves);
+                    return versionRaw
+                        ? mergeVersionsRaw(result[0], saves)
+                        : mergeVersionsRecursive(result[0], saves, collection, this.schema);
                 }
             }
         }
@@ -1587,6 +1604,7 @@ export class GraphQLService {
             values: {
                 json: { value: 'json' },
                 cookie: { value: 'cookie' },
+                session: { value: 'session' },
             },
         });
         const ServerInfo = schemaComposer.createObjectTC({
@@ -1789,21 +1807,24 @@ export class GraphQLService {
                         accountability: accountability,
                         schema: this.schema,
                     });
-                    const result = await authenticationService.login(DEFAULT_AUTH_PROVIDER, args, args?.otp);
-                    if (args['mode'] === 'cookie') {
-                        res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], result['refreshToken'], {
-                            httpOnly: true,
-                            domain: env['REFRESH_TOKEN_COOKIE_DOMAIN'],
-                            maxAge: getMilliseconds(env['REFRESH_TOKEN_TTL']),
-                            secure: env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false,
-                            sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
-                        });
+                    const mode = args['mode'] ?? 'json';
+                    const { accessToken, refreshToken, expires } = await authenticationService.login(DEFAULT_AUTH_PROVIDER, args, {
+                        session: mode === 'session',
+                        otp: args?.otp,
+                    });
+                    const payload = { expires };
+                    if (mode === 'json') {
+                        payload.refresh_token = refreshToken;
+                        payload.access_token = accessToken;
                     }
-                    return {
-                        access_token: result['accessToken'],
-                        expires: result['expires'],
-                        refresh_token: result['refreshToken'],
-                    };
+                    if (mode === 'cookie') {
+                        res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, REFRESH_COOKIE_OPTIONS);
+                        payload.access_token = accessToken;
+                    }
+                    if (mode === 'session') {
+                        res?.cookie(env['SESSION_COOKIE_NAME'], accessToken, SESSION_COOKIE_OPTIONS);
+                    }
+                    return payload;
                 },
             },
             auth_refresh: {
@@ -1826,35 +1847,51 @@ export class GraphQLService {
                         accountability: accountability,
                         schema: this.schema,
                     });
-                    const currentRefreshToken = args['refresh_token'] || req?.cookies[env['REFRESH_TOKEN_COOKIE_NAME']];
+                    const mode = args['mode'] ?? 'json';
+                    let currentRefreshToken;
+                    if (mode === 'json') {
+                        currentRefreshToken = args['refresh_token'];
+                    }
+                    else if (mode === 'cookie') {
+                        currentRefreshToken = req?.cookies[env['REFRESH_TOKEN_COOKIE_NAME']];
+                    }
+                    else if (mode === 'session') {
+                        const token = req?.cookies[env['SESSION_COOKIE_NAME']];
+                        if (isDirectusJWT(token)) {
+                            const payload = verifyAccessJWT(token, env['SECRET']);
+                            currentRefreshToken = payload.session;
+                        }
+                    }
                     if (!currentRefreshToken) {
                         throw new InvalidPayloadError({
-                            reason: `"refresh_token" is required in either the JSON payload or Cookie`,
+                            reason: `The refresh token is required in either the payload or cookie`,
                         });
                     }
-                    const result = await authenticationService.refresh(currentRefreshToken);
-                    if (args['mode'] === 'cookie') {
-                        res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], result['refreshToken'], {
-                            httpOnly: true,
-                            domain: env['REFRESH_TOKEN_COOKIE_DOMAIN'],
-                            maxAge: getMilliseconds(env['REFRESH_TOKEN_TTL']),
-                            secure: env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false,
-                            sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
-                        });
+                    const { accessToken, refreshToken, expires } = await authenticationService.refresh(currentRefreshToken, {
+                        session: mode === 'session',
+                    });
+                    const payload = { expires };
+                    if (mode === 'json') {
+                        payload.refresh_token = refreshToken;
+                        payload.access_token = accessToken;
                     }
-                    return {
-                        access_token: result['accessToken'],
-                        expires: result['expires'],
-                        refresh_token: result['refreshToken'],
-                    };
+                    if (mode === 'cookie') {
+                        res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, REFRESH_COOKIE_OPTIONS);
+                        payload.access_token = accessToken;
+                    }
+                    if (mode === 'session') {
+                        res?.cookie(env['SESSION_COOKIE_NAME'], accessToken, SESSION_COOKIE_OPTIONS);
+                    }
+                    return payload;
                 },
             },
             auth_logout: {
                 type: GraphQLBoolean,
                 args: {
                     refresh_token: GraphQLString,
+                    mode: AuthMode,
                 },
-                resolve: async (_, args, { req }) => {
+                resolve: async (_, args, { req, res }) => {
                     const accountability = { role: null };
                     if (req?.ip)
                         accountability.ip = req.ip;
@@ -1868,13 +1905,33 @@ export class GraphQLService {
                         accountability: accountability,
                         schema: this.schema,
                     });
-                    const currentRefreshToken = args['refresh_token'] || req?.cookies[env['REFRESH_TOKEN_COOKIE_NAME']];
+                    const mode = args['mode'] ?? 'json';
+                    let currentRefreshToken;
+                    if (mode === 'json') {
+                        currentRefreshToken = args['refresh_token'];
+                    }
+                    else if (mode === 'cookie') {
+                        currentRefreshToken = req?.cookies[env['REFRESH_TOKEN_COOKIE_NAME']];
+                    }
+                    else if (mode === 'session') {
+                        const token = req?.cookies[env['SESSION_COOKIE_NAME']];
+                        if (isDirectusJWT(token)) {
+                            const payload = verifyAccessJWT(token, env['SECRET']);
+                            currentRefreshToken = payload.session;
+                        }
+                    }
                     if (!currentRefreshToken) {
                         throw new InvalidPayloadError({
-                            reason: `"refresh_token" is required in either the JSON payload or Cookie`,
+                            reason: `The refresh token is required in either the payload or cookie`,
                         });
                     }
                     await authenticationService.logout(currentRefreshToken);
+                    if (req?.cookies[env['REFRESH_TOKEN_COOKIE_NAME']]) {
+                        res?.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_OPTIONS);
+                    }
+                    if (req?.cookies[env['SESSION_COOKIE_NAME']]) {
+                        res?.clearCookie(env['SESSION_COOKIE_NAME'], SESSION_COOKIE_OPTIONS);
+                    }
                     return true;
                 },
             },
@@ -2479,8 +2536,7 @@ export class GraphQLService {
                 update_extensions_item: {
                     type: Extension,
                     args: {
-                        bundle: GraphQLString,
-                        name: new GraphQLNonNull(GraphQLString),
+                        id: GraphQLID,
                         data: toInputObjectType(schemaComposer.createObjectTC({
                             name: 'update_directus_extensions_input',
                             fields: {
@@ -2498,8 +2554,8 @@ export class GraphQLService {
                             accountability: this.accountability,
                             schema: this.schema,
                         });
-                        await extensionsService.updateOne(args['bundle'], args['name'], args['data']);
-                        return await extensionsService.readOne(args['bundle'], args['name']);
+                        await extensionsService.updateOne(args['id'], args['data']);
+                        return await extensionsService.readOne(args['id']);
                     },
                 },
             });

package/dist/services/import-export.js

@@ -1,12 +1,14 @@
 import { useEnv } from '@directus/env';
 import { ForbiddenError, InvalidPayloadError, ServiceUnavailableError, UnsupportedMediaTypeError, } from '@directus/errors';
+import { isSystemCollection } from '@directus/system-data';
 import { parseJSON, toArray } from '@directus/utils';
+import { createTmpFile } from '@directus/utils/node';
 import { queue } from 'async';
 import destroyStream from 'destroy';
 import { dump as toYAML } from 'js-yaml';
 import { parse as toXML } from 'js2xmlparser';
 import { Parser as CSVParser, transforms as CSVTransforms } from 'json2csv';
-import { createReadStream } from 'node:fs';
+import { createReadStream, createWriteStream } from 'node:fs';
 import { appendFile } from 'node:fs/promises';
 import Papa from 'papaparse';
 import StreamArray from 'stream-json/streamers/StreamArray.js';
@@ -20,7 +22,6 @@ import { FilesService } from './files.js';
 import { ItemsService } from './items.js';
 import { NotificationsService } from './notifications.js';
 import { UsersService } from './users.js';
-import { isSystemCollection } from '@directus/system-data';
 const env = useEnv();
 const logger = useLogger();
 export class ImportService {
@@ -86,7 +87,10 @@ export class ImportService {
             });
         });
     }
-    importCSV(collection, stream) {
+    async importCSV(collection, stream) {
+        const tmpFile = await createTmpFile().catch(() => null);
+        if (!tmpFile)
+            throw new Error('Failed to create temporary file for import');
         const nestedActionEvents = [];
         return this.knex.transaction((trx) => {
             const service = new ItemsService(collection, {
@@ -116,35 +120,66 @@ export class ImportService {
                 transform,
             };
             return new Promise((resolve, reject) => {
-                stream
-                    .pipe(Papa.parse(Papa.NODE_STREAM_INPUT, PapaOptions))
-                    .on('data', (obj) => {
-                    // Filter out all undefined fields
-                    for (const field in obj) {
-                        if (obj[field] === undefined) {
-                            delete obj[field];
+                const streams = [stream];
+                const cleanup = (destroy = true) => {
+                    if (destroy) {
+                        for (const stream of streams) {
+                            destroyStream(stream);
                         }
                     }
-                    saveQueue.push(obj);
-                })
-                    .on('error', (err) => {
-                    destroyStream(stream);
-                    reject(new InvalidPayloadError({ reason: err.message }));
+                    tmpFile.cleanup().catch(() => {
+                        logger.warn(`Failed to cleanup temporary import file (${tmpFile.path})`);
+                    });
+                };
+                saveQueue.error((error) => {
+                    reject(error);
+                });
+                const fileWriteStream = createWriteStream(tmpFile.path)
+                    .on('error', (error) => {
+                    cleanup();
+                    reject(new Error('Error while writing import data to temporary file', { cause: error }));
                 })
-                    .on('end', () => {
-                    // In case of empty CSV file
-                    if (!saveQueue.started)
-                        return resolve();
-                    saveQueue.drain(() => {
-                        for (const nestedActionEvent of nestedActionEvents) {
-                            emitter.emitAction(nestedActionEvent.event, nestedActionEvent.meta, nestedActionEvent.context);
+                    .on('finish', () => {
+                    const fileReadStream = createReadStream(tmpFile.path).on('error', (error) => {
+                        cleanup();
+                        reject(new Error('Error while reading import data from temporary file', { cause: error }));
+                    });
+                    streams.push(fileReadStream);
+                    fileReadStream
+                        .pipe(Papa.parse(Papa.NODE_STREAM_INPUT, PapaOptions))
+                        .on('data', (obj) => {
+                        // Filter out all undefined fields
+                        for (const field in obj) {
+                            if (obj[field] === undefined) {
+                                delete obj[field];
+                            }
                         }
-                        return resolve();
+                        saveQueue.push(obj);
+                    })
+                        .on('error', (error) => {
+                        cleanup();
+                        reject(new InvalidPayloadError({ reason: error.message }));
+                    })
+                        .on('end', () => {
+                        cleanup(false);
+                        // In case of empty CSV file
+                        if (!saveQueue.started)
+                            return resolve();
+                        saveQueue.drain(() => {
+                            for (const nestedActionEvent of nestedActionEvents) {
+                                emitter.emitAction(nestedActionEvent.event, nestedActionEvent.meta, nestedActionEvent.context);
+                            }
+                            return resolve();
+                        });
                     });
                 });
-                saveQueue.error((err) => {
-                    reject(err);
-                });
+                streams.push(fileWriteStream);
+                stream
+                    .on('error', (error) => {
+                    cleanup();
+                    reject(new Error('Error while retrieving import data', { cause: error }));
+                })
+                    .pipe(fileWriteStream);
             });
         });
     }

package/dist/services/index.d.ts

@@ -18,7 +18,7 @@ export * from './notifications.js';
 export * from './operations.js';
 export * from './panels.js';
 export * from './payload.js';
-export * from './permissions.js';
+export * from './permissions/index.js';
 export * from './presets.js';
 export * from './relations.js';
 export * from './revisions.js';

package/dist/services/index.js

@@ -18,7 +18,7 @@ export * from './notifications.js';
 export * from './operations.js';
 export * from './panels.js';
 export * from './payload.js';
-export * from './permissions.js';
+export * from './permissions/index.js';
 export * from './presets.js';
 export * from './relations.js';
 export * from './revisions.js';

package/dist/services/mail/index.d.ts

@@ -14,7 +14,7 @@ export declare class MailService {
     knex: Knex;
     mailer: Transporter;
     constructor(opts: AbstractServiceOptions);
-    send<T>(options: EmailOptions): Promise<T>;
+    send(options: EmailOptions): Promise<void>;
     private renderTemplate;
     private getDefaultTemplateData;
 }

package/dist/services/mail/index.js

@@ -55,8 +55,10 @@ export class MailService {
                 .map((line) => line.trim())
                 .join('\n');
         }
-        const info = await this.mailer.sendMail({ ...emailOptions, from, html });
-        return info;
+        this.mailer.sendMail({ ...emailOptions, from, html }).catch((error) => {
+            logger.warn(`Email send failed:`);
+            logger.warn(error);
+        });
     }
     async renderTemplate(template, variables) {
         const customTemplatePath = path.resolve(getExtensionsPath(), 'templates', template + '.liquid');

package/dist/services/payload.js

@@ -4,7 +4,7 @@ import { format, isValid, parseISO } from 'date-fns';
 import { unflatten } from 'flat';
 import Joi from 'joi';
 import { clone, cloneDeep, isNil, isObject, isPlainObject, omit, pick } from 'lodash-es';
-import { v4 as uuid } from 'uuid';
+import { randomUUID } from 'node:crypto';
 import { parse as wktToGeoJSON } from 'wellknown';
 import { getHelpers } from '../database/helpers/index.js';
 import getDatabase from '../database/index.js';
@@ -39,7 +39,7 @@ export class PayloadService {
         },
         async uuid({ action, value }) {
             if (action === 'create' && !value) {
-                return uuid();
+                return randomUUID();
             }
             return value;
         },

package/dist/services/{permissions.d.ts → permissions/index.d.ts}

@@ -1,14 +1,13 @@
 import type { ItemPermissions, PermissionsAction, Query } from '@directus/types';
 import type Keyv from 'keyv';
-import type { AbstractServiceOptions, Item, MutationOptions, PrimaryKey } from '../types/index.js';
-import type { QueryOptions } from './items.js';
-import { ItemsService } from './items.js';
+import type { AbstractServiceOptions, Item, MutationOptions, PrimaryKey } from '../../types/index.js';
+import type { QueryOptions } from '../items.js';
+import { ItemsService } from '../items.js';
 export declare class PermissionsService extends ItemsService {
     systemCache: Keyv<any>;
     constructor(options: AbstractServiceOptions);
     getAllowedFields(action: PermissionsAction, collection?: string): Record<string, string[]>;
     readByQuery(query: Query, opts?: QueryOptions): Promise<Partial<Item>[]>;
-    readMany(keys: PrimaryKey[], query?: Query, opts?: QueryOptions): Promise<Partial<Item>[]>;
     createOne(data: Partial<Item>, opts?: MutationOptions): Promise<PrimaryKey>;
     createMany(data: Partial<Item>[], opts?: MutationOptions): Promise<PrimaryKey[]>;
     updateBatch(data: Partial<Item>[], opts?: MutationOptions): Promise<PrimaryKey[]>;

package/dist/services/{permissions.js → permissions/index.js}

@@ -1,9 +1,8 @@
 import { ForbiddenError } from '@directus/errors';
-import { clearSystemCache, getCache } from '../cache.js';
-import { appAccessMinimalPermissions } from '@directus/system-data';
-import { filterItems } from '../utils/filter-items.js';
-import { AuthorizationService } from './authorization.js';
-import { ItemsService } from './items.js';
+import { clearSystemCache, getCache } from '../../cache.js';
+import { AuthorizationService } from '../authorization.js';
+import { ItemsService } from '../items.js';
+import { withAppMinimalPermissions } from './lib/with-app-minimal-permissions.js';
 export class PermissionsService extends ItemsService {
     systemCache;
     constructor(options) {
@@ -30,24 +29,8 @@ export class PermissionsService extends ItemsService {
         return fieldsPerCollection;
     }
     async readByQuery(query, opts) {
-        const result = await super.readByQuery(query, opts);
-        if (Array.isArray(result) && this.accountability && this.accountability.app === true) {
-            result.push(...filterItems(appAccessMinimalPermissions.map((permission) => ({
-                ...permission,
-                role: this.accountability.role,
-            })), query.filter));
-        }
-        return result;
-    }
-    async readMany(keys, query = {}, opts) {
-        const result = await super.readMany(keys, query, opts);
-        if (this.accountability && this.accountability.app === true) {
-            result.push(...filterItems(appAccessMinimalPermissions.map((permission) => ({
-                ...permission,
-                role: this.accountability.role,
-            })), query.filter));
-        }
-        return result;
+        const result = (await super.readByQuery(query, opts));
+        return withAppMinimalPermissions(this.accountability, result, query.filter);
     }
     async createOne(data, opts) {
         const res = await super.createOne(data, opts);

package/dist/services/permissions/lib/with-app-minimal-permissions.d.ts

@@ -0,0 +1,2 @@
+import type { Accountability, Permission, Query } from '@directus/types';
+export declare function withAppMinimalPermissions(accountability: Accountability | null, permissions: Permission[], filter: Query['filter']): Permission[];

package/dist/services/permissions/lib/with-app-minimal-permissions.js

@@ -0,0 +1,13 @@
+import { appAccessMinimalPermissions } from '@directus/system-data';
+import { filterItems } from '../../../utils/filter-items.js';
+import { mergePermissions } from '../../../utils/merge-permissions.js';
+export function withAppMinimalPermissions(accountability, permissions, filter) {
+    if (accountability?.app === true) {
+        const filteredAppMinimalPermissions = filterItems(appAccessMinimalPermissions.map((permission) => ({
+            ...permission,
+            role: accountability.role,
+        })), filter);
+        return mergePermissions('or', permissions, filteredAppMinimalPermissions);
+    }
+    return permissions;
+}

package/dist/services/relations.d.ts

@@ -4,9 +4,8 @@ import type Keyv from 'keyv';
 import type { Knex } from 'knex';
 import type { Helpers } from '../database/helpers/index.js';
 import type { AbstractServiceOptions, MutationOptions } from '../types/index.js';
-import type { QueryOptions } from './items.js';
-import { ItemsService } from './items.js';
-import { PermissionsService } from './permissions.js';
+import { ItemsService, type QueryOptions } from './items.js';
+import { PermissionsService } from './permissions/index.js';
 export declare class RelationsService {
     knex: Knex;
     permissionsService: PermissionsService;

package/dist/services/relations.js

@@ -1,5 +1,6 @@
 import { ForbiddenError, InvalidPayloadError } from '@directus/errors';
 import { createInspector } from '@directus/schema';
+import { systemRelationRows } from '@directus/system-data';
 import { toArray } from '@directus/utils';
 import { clearSystemCache, getCache } from '../cache.js';
 import { getHelpers } from '../database/helpers/index.js';
@@ -8,8 +9,7 @@ import emitter from '../emitter.js';
 import { getDefaultIndexName } from '../utils/get-default-index-name.js';
 import { getSchema } from '../utils/get-schema.js';
 import { ItemsService } from './items.js';
-import { PermissionsService } from './permissions.js';
-import { systemRelationRows } from '@directus/system-data';
+import { PermissionsService } from './permissions/index.js';
 export class RelationsService {
     knex;
     permissionsService;