@directus/api 19.3.1 → 20.0.0-rc.0

package/dist/controllers/policies.js

@@ -0,0 +1,169 @@
+import { ErrorCode, ForbiddenError, isDirectusError } from '@directus/errors';
+import express from 'express';
+import getDatabase from '../database/index.js';
+import { respond } from '../middleware/respond.js';
+import useCollection from '../middleware/use-collection.js';
+import { validateBatch } from '../middleware/validate-batch.js';
+import { fetchAccountabilityPolicyGlobals } from '../permissions/modules/fetch-accountability-policy-globals/fetch-accountability-policy-globals.js';
+import { MetaService } from '../services/meta.js';
+import { PoliciesService } from '../services/policies.js';
+import asyncHandler from '../utils/async-handler.js';
+import { sanitizeQuery } from '../utils/sanitize-query.js';
+const router = express.Router();
+router.use(useCollection('directus_policies'));
+router.post('/', asyncHandler(async (req, res, next) => {
+    const service = new PoliciesService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const savedKeys = [];
+    if (Array.isArray(req.body)) {
+        const keys = await service.createMany(req.body);
+        savedKeys.push(...keys);
+    }
+    else {
+        const key = await service.createOne(req.body);
+        savedKeys.push(key);
+    }
+    try {
+        if (Array.isArray(req.body)) {
+            const items = await service.readMany(savedKeys, req.sanitizedQuery);
+            res.locals['payload'] = { data: items };
+        }
+        else {
+            const item = await service.readOne(savedKeys[0], req.sanitizedQuery);
+            res.locals['payload'] = { data: item };
+        }
+    }
+    catch (error) {
+        if (isDirectusError(error, ErrorCode.Forbidden)) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+const readHandler = asyncHandler(async (req, res, next) => {
+    const service = new PoliciesService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const metaService = new MetaService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    let result;
+    if (req.body.keys) {
+        result = await service.readMany(req.body.keys, req.sanitizedQuery);
+    }
+    else {
+        result = await service.readByQuery(req.sanitizedQuery);
+    }
+    const meta = await metaService.getMetaForQuery('directus_policies', req.sanitizedQuery);
+    res.locals['payload'] = { data: result, meta };
+    return next();
+});
+router.get('/', validateBatch('read'), readHandler, respond);
+router.search('/', validateBatch('read'), readHandler, respond);
+router.get('/me/globals', asyncHandler(async (req, res, next) => {
+    try {
+        if (!req.accountability?.user && !req.accountability?.role)
+            throw new ForbiddenError();
+        const result = await fetchAccountabilityPolicyGlobals(req.accountability, {
+            schema: req.schema,
+            knex: getDatabase(),
+        });
+        res.locals['payload'] = { data: result };
+    }
+    catch (error) {
+        if (isDirectusError(error, ErrorCode.Forbidden)) {
+            res.locals['payload'] = { data: { app_access: false } };
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+router.get('/:pk', asyncHandler(async (req, res, next) => {
+    if (req.path.endsWith('me'))
+        return next();
+    const service = new PoliciesService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const record = await service.readOne(req.params['pk'], req.sanitizedQuery);
+    res.locals['payload'] = { data: record };
+    return next();
+}), respond);
+router.patch('/', validateBatch('update'), asyncHandler(async (req, res, next) => {
+    const service = new PoliciesService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    let keys = [];
+    if (Array.isArray(req.body)) {
+        keys = await service.updateBatch(req.body);
+    }
+    else if (req.body.keys) {
+        keys = await service.updateMany(req.body.keys, req.body.data);
+    }
+    else {
+        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
+        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
+    }
+    try {
+        const result = await service.readMany(keys, req.sanitizedQuery);
+        res.locals['payload'] = { data: result };
+    }
+    catch (error) {
+        if (isDirectusError(error, ErrorCode.Forbidden)) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+router.patch('/:pk', asyncHandler(async (req, res, next) => {
+    const service = new PoliciesService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const primaryKey = await service.updateOne(req.params['pk'], req.body);
+    try {
+        const item = await service.readOne(primaryKey, req.sanitizedQuery);
+        res.locals['payload'] = { data: item || null };
+    }
+    catch (error) {
+        if (isDirectusError(error, ErrorCode.Forbidden)) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+router.delete('/', validateBatch('delete'), asyncHandler(async (req, _res, next) => {
+    const service = new PoliciesService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    if (Array.isArray(req.body)) {
+        await service.deleteMany(req.body);
+    }
+    else if (req.body.keys) {
+        await service.deleteMany(req.body.keys);
+    }
+    else {
+        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
+        await service.deleteByQuery(sanitizedQuery);
+    }
+    return next();
+}), respond);
+router.delete('/:pk', asyncHandler(async (req, _res, next) => {
+    const service = new PoliciesService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    await service.deleteOne(req.params['pk']);
+    return next();
+}), respond);
+export default router;

package/dist/controllers/roles.js

@@ -1,4 +1,4 @@
-import { ErrorCode, isDirectusError } from '@directus/errors';
+import { ErrorCode, ForbiddenError, isDirectusError } from '@directus/errors';
 import express from 'express';
 import { respond } from '../middleware/respond.js';
 import useCollection from '../middleware/use-collection.js';
@@ -57,6 +57,27 @@ const readHandler = asyncHandler(async (req, res, next) => {
 });
 router.get('/', validateBatch('read'), readHandler, respond);
 router.search('/', validateBatch('read'), readHandler, respond);
+router.get('/me', asyncHandler(async (req, res, next) => {
+    if (!req.accountability?.user && !req.accountability?.role)
+        throw new ForbiddenError();
+    const service = new RolesService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    const query = { ...req.sanitizedQuery, limit: -1 };
+    try {
+        const roles = await service.readMany(req.accountability.roles, query);
+        res.locals['payload'] = { data: roles || null };
+    }
+    catch (error) {
+        if (isDirectusError(error, ErrorCode.Forbidden)) {
+            res.locals['payload'] = { data: req.accountability.roles.map((id) => ({ id })) };
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
 router.get('/:pk', asyncHandler(async (req, res, next) => {
     const service = new RolesService({
         accountability: req.accountability,

package/dist/controllers/users.js

@@ -7,7 +7,6 @@ import useCollection from '../middleware/use-collection.js';
 import { validateBatch } from '../middleware/validate-batch.js';
 import { AuthenticationService } from '../services/authentication.js';
 import { MetaService } from '../services/meta.js';
-import { RolesService } from '../services/roles.js';
 import { TFAService } from '../services/tfa.js';
 import { UsersService } from '../services/users.js';
 import asyncHandler from '../utils/async-handler.js';
@@ -262,33 +261,6 @@ router.post('/me/tfa/enable/', asyncHandler(async (req, _res, next) => {
     if (!req.body.otp) {
         throw new InvalidPayloadError({ reason: `"otp" is required` });
     }
-    // Override permissions only when enforce TFA is enabled in role
-    if (req.accountability.role) {
-        const rolesService = new RolesService({
-            schema: req.schema,
-        });
-        const role = (await rolesService.readOne(req.accountability.role));
-        if (role && role.enforce_tfa) {
-            const existingPermission = await req.accountability.permissions?.find((p) => p.collection === 'directus_users' && p.action === 'update');
-            if (existingPermission) {
-                existingPermission.fields = ['tfa_secret'];
-                existingPermission.permissions = { id: { _eq: req.accountability.user } };
-                existingPermission.presets = null;
-                existingPermission.validation = null;
-            }
-            else {
-                (req.accountability.permissions || (req.accountability.permissions = [])).push({
-                    action: 'update',
-                    collection: 'directus_users',
-                    fields: ['tfa_secret'],
-                    permissions: { id: { _eq: req.accountability.user } },
-                    presets: null,
-                    role: req.accountability.role,
-                    validation: null,
-                });
-            }
-        }
-    }
     const service = new TFAService({
         accountability: req.accountability,
         schema: req.schema,
@@ -303,33 +275,6 @@ router.post('/me/tfa/disable', asyncHandler(async (req, _res, next) => {
     if (!req.body.otp) {
         throw new InvalidPayloadError({ reason: `"otp" is required` });
     }
-    // Override permissions only when enforce TFA is enabled in role
-    if (req.accountability.role) {
-        const rolesService = new RolesService({
-            schema: req.schema,
-        });
-        const role = (await rolesService.readOne(req.accountability.role));
-        if (role && role.enforce_tfa) {
-            const existingPermission = await req.accountability.permissions?.find((p) => p.collection === 'directus_users' && p.action === 'update');
-            if (existingPermission) {
-                existingPermission.fields = ['tfa_secret'];
-                existingPermission.permissions = { id: { _eq: req.accountability.user } };
-                existingPermission.presets = null;
-                existingPermission.validation = null;
-            }
-            else {
-                (req.accountability.permissions || (req.accountability.permissions = [])).push({
-                    action: 'update',
-                    collection: 'directus_users',
-                    fields: ['tfa_secret'],
-                    permissions: { id: { _eq: req.accountability.user } },
-                    presets: null,
-                    role: req.accountability.role,
-                    validation: null,
-                });
-            }
-        }
-    }
     const service = new TFAService({
         accountability: req.accountability,
         schema: req.schema,

package/dist/database/errors/dialects/mysql.js

@@ -36,34 +36,34 @@ function uniqueViolation(error) {
     /**
      * MySQL's error doesn't return the field name in the error. In case the field is created through
      * Directus (/ Knex), the key name will be `<collection>_<field>_unique` in which case we can pull
-     * the field name from the key name
+     * the field name from the key name.
+     * If the field is the primary key it instead will be `<collection>_PRIMARY` for MySQL 8+
+     * and `PRIMARY` for MySQL 5.7 and MariaDB.
      */
-    /** MySQL 8+ style error message */
+    let collection;
+    let indexName;
+    let field = null;
     if (matches[1].includes('.')) {
-        const collection = matches[1].slice(1, -1).split('.')[0];
-        let field = null;
-        const indexName = matches[1]?.slice(1, -1).split('.')[1];
-        if (indexName?.startsWith(`${collection}_`) && indexName.endsWith('_unique')) {
-            field = indexName?.slice(collection.length + 1, -7);
-        }
-        return new RecordNotUniqueError({
-            collection,
-            field,
-        });
+        // MySQL 8+ style error message
+        // In case of primary key matches[1] is `'<collection>.PRIMARY'`
+        // In case of other field matches[1] is `'<collection>.<collection>_<field>_unique'`
+        [collection, indexName] = matches[1].slice(1, -1).split('.');
     }
     else {
-        /** MySQL 5.7 style error message */
-        const indexName = matches[1].slice(1, -1);
-        const collection = indexName.split('_')[0];
-        let field = null;
-        if (indexName?.startsWith(`${collection}_`) && indexName.endsWith('_unique')) {
-            field = indexName?.slice(collection.length + 1, -7);
-        }
-        return new RecordNotUniqueError({
-            collection,
-            field,
-        });
+        // MySQL 5.7 and MariaDB style error message
+        // In case of primary key matches[1] is `'PRIMARY'`
+        // In case of other field matches[1] is `'<collection>_<field>_unique'`
+        indexName = matches[1].slice(1, -1);
+        collection = indexName.includes('_') ? indexName.split('_')[0] : null;
     }
+    if (collection !== null && indexName.startsWith(`${collection}_`) && indexName.endsWith('_unique')) {
+        field = indexName?.slice(collection.length + 1, -7);
+    }
+    return new RecordNotUniqueError({
+        collection,
+        field,
+        primaryKey: indexName === 'PRIMARY', // propagate information about primary key violation
+    });
 }
 function numericValueOutOfRange(error) {
     const betweenTicks = /`([^`]+)`/g;

package/dist/database/get-ast-from-query/get-ast-from-query.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generate an AST based on a given collection and query
+ */
+import type { Accountability, Query, SchemaOverview } from '@directus/types';
+import type { Knex } from 'knex';
+import type { AST } from '../../types/index.js';
+export interface GetAstFromQueryOptions {
+    collection: string;
+    query: Query;
+    accountability: Accountability | null;
+}
+export interface GetAstFromQueryContext {
+    knex: Knex;
+    schema: SchemaOverview;
+}
+export declare function getAstFromQuery(options: GetAstFromQueryOptions, context: GetAstFromQueryContext): Promise<AST>;

package/dist/database/get-ast-from-query/get-ast-from-query.js

@@ -0,0 +1,82 @@
+/**
+ * Generate an AST based on a given collection and query
+ */
+import { cloneDeep, uniq } from 'lodash-es';
+import { fetchAllowedFields } from '../../permissions/modules/fetch-allowed-fields/fetch-allowed-fields.js';
+import { parseFields } from './lib/parse-fields.js';
+export async function getAstFromQuery(options, context) {
+    options.query = cloneDeep(options.query);
+    const ast = {
+        type: 'root',
+        name: options.collection,
+        query: options.query,
+        children: [],
+        cases: [],
+    };
+    let fields = ['*'];
+    if (options.query.fields) {
+        fields = options.query.fields;
+    }
+    /**
+     * When using aggregate functions, you can't have any other regular fields
+     * selected. This makes sure you never end up in a non-aggregate fields selection error
+     */
+    if (Object.keys(options.query.aggregate || {}).length > 0) {
+        fields = [];
+    }
+    /**
+     * Similarly, when grouping on a specific field, you can't have other non-aggregated fields.
+     * The group query will override the fields query
+     */
+    if (options.query.group) {
+        fields = options.query.group;
+    }
+    fields = uniq(fields);
+    const deep = options.query.deep || {};
+    // Prevent fields/deep from showing up in the query object in further use
+    delete options.query.fields;
+    delete options.query.deep;
+    if (!options.query.sort) {
+        // We'll default to the primary key for the standard sort output
+        let sortField = context.schema.collections[options.collection].primary;
+        // If a custom manual sort field is configured, use that
+        if (context.schema.collections[options.collection]?.sortField) {
+            sortField = context.schema.collections[options.collection].sortField;
+        }
+        if (options.accountability && options.accountability.admin === false) {
+            // Verify that the user has access to the sort field
+            const allowedFields = await fetchAllowedFields({
+                collection: options.collection,
+                action: 'read',
+                accountability: options.accountability,
+            }, context);
+            if (allowedFields.length === 0) {
+                sortField = null;
+            }
+            else if (allowedFields.includes('*') === false && allowedFields.includes(sortField) === false) {
+                // If the sort field is not allowed, default to the first allowed field
+                sortField = allowedFields[0];
+            }
+        }
+        // When group by is used, default to the first column provided in the group by clause
+        if (options.query.group?.[0]) {
+            sortField = options.query.group[0];
+        }
+        if (sortField) {
+            options.query.sort = [sortField];
+        }
+    }
+    // When no group by is supplied, but an aggregate function is used, only a single row will be
+    // returned. In those cases, we'll ignore the sort field altogether
+    if (options.query.aggregate && Object.keys(options.query.aggregate).length && !options.query.group?.[0]) {
+        delete options.query.sort;
+    }
+    ast.children = await parseFields({
+        parentCollection: options.collection,
+        fields,
+        query: options.query,
+        deep,
+        accountability: options.accountability,
+    }, context);
+    return ast;
+}

package/dist/database/get-ast-from-query/lib/convert-wildcards.d.ts

@@ -0,0 +1,13 @@
+import type { Accountability, Query, SchemaOverview } from '@directus/types';
+import type { Knex } from 'knex';
+export interface ConvertWildcardsOptions {
+    parentCollection: string;
+    fields: string[];
+    query: Query;
+    accountability: Accountability | null;
+}
+export interface ConvertWildCardsContext {
+    schema: SchemaOverview;
+    knex: Knex;
+}
+export declare function convertWildcards(options: ConvertWildcardsOptions, context: ConvertWildCardsContext): Promise<string[]>;

package/dist/database/get-ast-from-query/lib/convert-wildcards.js

@@ -0,0 +1,69 @@
+import { cloneDeep } from 'lodash-es';
+import { fetchAllowedFields } from '../../../permissions/modules/fetch-allowed-fields/fetch-allowed-fields.js';
+import { getRelation } from '../utils/get-relation.js';
+export async function convertWildcards(options, context) {
+    const fields = cloneDeep(options.fields);
+    const fieldsInCollection = Object.entries(context.schema.collections[options.parentCollection].fields).map(([name]) => name);
+    let allowedFields = fieldsInCollection;
+    if (options.accountability && options.accountability.admin === false) {
+        allowedFields = await fetchAllowedFields({
+            collection: options.parentCollection,
+            action: 'read',
+            accountability: options.accountability,
+        }, context);
+    }
+    if (!allowedFields || allowedFields.length === 0)
+        return [];
+    // In case of full read permissions
+    if (allowedFields[0] === '*')
+        allowedFields = fieldsInCollection;
+    for (let index = 0; index < fields.length; index++) {
+        const fieldKey = fields[index];
+        if (fieldKey.includes('*') === false)
+            continue;
+        if (fieldKey === '*') {
+            const aliases = Object.keys(options.query.alias ?? {});
+            // Set to all fields in collection
+            if (allowedFields.includes('*')) {
+                fields.splice(index, 1, ...fieldsInCollection, ...aliases);
+            }
+            else {
+                // Set to all allowed fields
+                const allowedAliases = aliases.filter((fieldKey) => {
+                    const name = options.query.alias[fieldKey];
+                    return allowedFields.includes(name);
+                });
+                fields.splice(index, 1, ...allowedFields, ...allowedAliases);
+            }
+        }
+        // Swap *.* case for *,<relational-field>.*,<another-relational>.*
+        if (fieldKey.includes('.') && fieldKey.split('.')[0] === '*') {
+            const parts = fieldKey.split('.');
+            const relationalFields = allowedFields.includes('*')
+                ? context.schema.relations
+                    .filter((relation) => relation.collection === options.parentCollection ||
+                    relation.related_collection === options.parentCollection)
+                    .map((relation) => {
+                    const isMany = relation.collection === options.parentCollection;
+                    return isMany ? relation.field : relation.meta?.one_field;
+                })
+                : allowedFields.filter((fieldKey) => !!getRelation(context.schema, options.parentCollection, fieldKey));
+            const nonRelationalFields = allowedFields.filter((fieldKey) => relationalFields.includes(fieldKey) === false);
+            const aliasFields = Object.keys(options.query.alias ?? {}).map((fieldKey) => {
+                const name = options.query.alias[fieldKey];
+                if (relationalFields.includes(name)) {
+                    return `${fieldKey}.${parts.slice(1).join('.')}`;
+                }
+                return fieldKey;
+            });
+            fields.splice(index, 1, ...[
+                ...relationalFields.map((relationalField) => {
+                    return `${relationalField}.${parts.slice(1).join('.')}`;
+                }),
+                ...nonRelationalFields,
+                ...aliasFields,
+            ]);
+        }
+    }
+    return fields;
+}

package/dist/database/get-ast-from-query/lib/parse-fields.d.ts

@@ -0,0 +1,15 @@
+import type { Accountability, Query, SchemaOverview } from '@directus/types';
+import type { Knex } from 'knex';
+import type { FieldNode, FunctionFieldNode, NestedCollectionNode } from '../../../types/index.js';
+export interface ParseFieldsOptions {
+    accountability: Accountability | null;
+    parentCollection: string;
+    fields: string[] | null;
+    query: Query;
+    deep?: Record<string, any>;
+}
+export interface ParseFieldsContext {
+    schema: SchemaOverview;
+    knex: Knex;
+}
+export declare function parseFields(options: ParseFieldsOptions, context: ParseFieldsContext): Promise<(NestedCollectionNode | FieldNode | FunctionFieldNode)[]>;