@directus/api 20.0.0-rc.1 → 20.0.0

package/dist/controllers/policies.js

@@ -1,169 +0,0 @@
-import { ErrorCode, ForbiddenError, isDirectusError } from '@directus/errors';
-import express from 'express';
-import getDatabase from '../database/index.js';
-import { respond } from '../middleware/respond.js';
-import useCollection from '../middleware/use-collection.js';
-import { validateBatch } from '../middleware/validate-batch.js';
-import { fetchAccountabilityPolicyGlobals } from '../permissions/modules/fetch-accountability-policy-globals/fetch-accountability-policy-globals.js';
-import { MetaService } from '../services/meta.js';
-import { PoliciesService } from '../services/policies.js';
-import asyncHandler from '../utils/async-handler.js';
-import { sanitizeQuery } from '../utils/sanitize-query.js';
-const router = express.Router();
-router.use(useCollection('directus_policies'));
-router.post('/', asyncHandler(async (req, res, next) => {
-    const service = new PoliciesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    const savedKeys = [];
-    if (Array.isArray(req.body)) {
-        const keys = await service.createMany(req.body);
-        savedKeys.push(...keys);
-    }
-    else {
-        const key = await service.createOne(req.body);
-        savedKeys.push(key);
-    }
-    try {
-        if (Array.isArray(req.body)) {
-            const items = await service.readMany(savedKeys, req.sanitizedQuery);
-            res.locals['payload'] = { data: items };
-        }
-        else {
-            const item = await service.readOne(savedKeys[0], req.sanitizedQuery);
-            res.locals['payload'] = { data: item };
-        }
-    }
-    catch (error) {
-        if (isDirectusError(error, ErrorCode.Forbidden)) {
-            return next();
-        }
-        throw error;
-    }
-    return next();
-}), respond);
-const readHandler = asyncHandler(async (req, res, next) => {
-    const service = new PoliciesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    const metaService = new MetaService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    let result;
-    if (req.body.keys) {
-        result = await service.readMany(req.body.keys, req.sanitizedQuery);
-    }
-    else {
-        result = await service.readByQuery(req.sanitizedQuery);
-    }
-    const meta = await metaService.getMetaForQuery('directus_policies', req.sanitizedQuery);
-    res.locals['payload'] = { data: result, meta };
-    return next();
-});
-router.get('/', validateBatch('read'), readHandler, respond);
-router.search('/', validateBatch('read'), readHandler, respond);
-router.get('/me/globals', asyncHandler(async (req, res, next) => {
-    try {
-        if (!req.accountability?.user && !req.accountability?.role)
-            throw new ForbiddenError();
-        const result = await fetchAccountabilityPolicyGlobals(req.accountability, {
-            schema: req.schema,
-            knex: getDatabase(),
-        });
-        res.locals['payload'] = { data: result };
-    }
-    catch (error) {
-        if (isDirectusError(error, ErrorCode.Forbidden)) {
-            res.locals['payload'] = { data: { app_access: false } };
-            return next();
-        }
-        throw error;
-    }
-    return next();
-}), respond);
-router.get('/:pk', asyncHandler(async (req, res, next) => {
-    if (req.path.endsWith('me'))
-        return next();
-    const service = new PoliciesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    const record = await service.readOne(req.params['pk'], req.sanitizedQuery);
-    res.locals['payload'] = { data: record };
-    return next();
-}), respond);
-router.patch('/', validateBatch('update'), asyncHandler(async (req, res, next) => {
-    const service = new PoliciesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    let keys = [];
-    if (Array.isArray(req.body)) {
-        keys = await service.updateBatch(req.body);
-    }
-    else if (req.body.keys) {
-        keys = await service.updateMany(req.body.keys, req.body.data);
-    }
-    else {
-        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
-        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
-    }
-    try {
-        const result = await service.readMany(keys, req.sanitizedQuery);
-        res.locals['payload'] = { data: result };
-    }
-    catch (error) {
-        if (isDirectusError(error, ErrorCode.Forbidden)) {
-            return next();
-        }
-        throw error;
-    }
-    return next();
-}), respond);
-router.patch('/:pk', asyncHandler(async (req, res, next) => {
-    const service = new PoliciesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    const primaryKey = await service.updateOne(req.params['pk'], req.body);
-    try {
-        const item = await service.readOne(primaryKey, req.sanitizedQuery);
-        res.locals['payload'] = { data: item || null };
-    }
-    catch (error) {
-        if (isDirectusError(error, ErrorCode.Forbidden)) {
-            return next();
-        }
-        throw error;
-    }
-    return next();
-}), respond);
-router.delete('/', validateBatch('delete'), asyncHandler(async (req, _res, next) => {
-    const service = new PoliciesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    if (Array.isArray(req.body)) {
-        await service.deleteMany(req.body);
-    }
-    else if (req.body.keys) {
-        await service.deleteMany(req.body.keys);
-    }
-    else {
-        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
-        await service.deleteByQuery(sanitizedQuery);
-    }
-    return next();
-}), respond);
-router.delete('/:pk', asyncHandler(async (req, _res, next) => {
-    const service = new PoliciesService({
-        accountability: req.accountability,
-        schema: req.schema,
-    });
-    await service.deleteOne(req.params['pk']);
-    return next();
-}), respond);
-export default router;

package/dist/database/get-ast-from-query/get-ast-from-query.d.ts

@@ -1,16 +0,0 @@
-/**
- * Generate an AST based on a given collection and query
- */
-import type { Accountability, Query, SchemaOverview } from '@directus/types';
-import type { Knex } from 'knex';
-import type { AST } from '../../types/index.js';
-export interface GetAstFromQueryOptions {
-    collection: string;
-    query: Query;
-    accountability: Accountability | null;
-}
-export interface GetAstFromQueryContext {
-    knex: Knex;
-    schema: SchemaOverview;
-}
-export declare function getAstFromQuery(options: GetAstFromQueryOptions, context: GetAstFromQueryContext): Promise<AST>;

package/dist/database/get-ast-from-query/get-ast-from-query.js

@@ -1,82 +0,0 @@
-/**
- * Generate an AST based on a given collection and query
- */
-import { cloneDeep, uniq } from 'lodash-es';
-import { fetchAllowedFields } from '../../permissions/modules/fetch-allowed-fields/fetch-allowed-fields.js';
-import { parseFields } from './lib/parse-fields.js';
-export async function getAstFromQuery(options, context) {
-    options.query = cloneDeep(options.query);
-    const ast = {
-        type: 'root',
-        name: options.collection,
-        query: options.query,
-        children: [],
-        cases: [],
-    };
-    let fields = ['*'];
-    if (options.query.fields) {
-        fields = options.query.fields;
-    }
-    /**
-     * When using aggregate functions, you can't have any other regular fields
-     * selected. This makes sure you never end up in a non-aggregate fields selection error
-     */
-    if (Object.keys(options.query.aggregate || {}).length > 0) {
-        fields = [];
-    }
-    /**
-     * Similarly, when grouping on a specific field, you can't have other non-aggregated fields.
-     * The group query will override the fields query
-     */
-    if (options.query.group) {
-        fields = options.query.group;
-    }
-    fields = uniq(fields);
-    const deep = options.query.deep || {};
-    // Prevent fields/deep from showing up in the query object in further use
-    delete options.query.fields;
-    delete options.query.deep;
-    if (!options.query.sort) {
-        // We'll default to the primary key for the standard sort output
-        let sortField = context.schema.collections[options.collection].primary;
-        // If a custom manual sort field is configured, use that
-        if (context.schema.collections[options.collection]?.sortField) {
-            sortField = context.schema.collections[options.collection].sortField;
-        }
-        if (options.accountability && options.accountability.admin === false) {
-            // Verify that the user has access to the sort field
-            const allowedFields = await fetchAllowedFields({
-                collection: options.collection,
-                action: 'read',
-                accountability: options.accountability,
-            }, context);
-            if (allowedFields.length === 0) {
-                sortField = null;
-            }
-            else if (allowedFields.includes('*') === false && allowedFields.includes(sortField) === false) {
-                // If the sort field is not allowed, default to the first allowed field
-                sortField = allowedFields[0];
-            }
-        }
-        // When group by is used, default to the first column provided in the group by clause
-        if (options.query.group?.[0]) {
-            sortField = options.query.group[0];
-        }
-        if (sortField) {
-            options.query.sort = [sortField];
-        }
-    }
-    // When no group by is supplied, but an aggregate function is used, only a single row will be
-    // returned. In those cases, we'll ignore the sort field altogether
-    if (options.query.aggregate && Object.keys(options.query.aggregate).length && !options.query.group?.[0]) {
-        delete options.query.sort;
-    }
-    ast.children = await parseFields({
-        parentCollection: options.collection,
-        fields,
-        query: options.query,
-        deep,
-        accountability: options.accountability,
-    }, context);
-    return ast;
-}

package/dist/database/get-ast-from-query/lib/convert-wildcards.d.ts

@@ -1,13 +0,0 @@
-import type { Accountability, Query, SchemaOverview } from '@directus/types';
-import type { Knex } from 'knex';
-export interface ConvertWildcardsOptions {
-    parentCollection: string;
-    fields: string[];
-    query: Query;
-    accountability: Accountability | null;
-}
-export interface ConvertWildCardsContext {
-    schema: SchemaOverview;
-    knex: Knex;
-}
-export declare function convertWildcards(options: ConvertWildcardsOptions, context: ConvertWildCardsContext): Promise<string[]>;

package/dist/database/get-ast-from-query/lib/convert-wildcards.js

@@ -1,69 +0,0 @@
-import { cloneDeep } from 'lodash-es';
-import { fetchAllowedFields } from '../../../permissions/modules/fetch-allowed-fields/fetch-allowed-fields.js';
-import { getRelation } from '../utils/get-relation.js';
-export async function convertWildcards(options, context) {
-    const fields = cloneDeep(options.fields);
-    const fieldsInCollection = Object.entries(context.schema.collections[options.parentCollection].fields).map(([name]) => name);
-    let allowedFields = fieldsInCollection;
-    if (options.accountability && options.accountability.admin === false) {
-        allowedFields = await fetchAllowedFields({
-            collection: options.parentCollection,
-            action: 'read',
-            accountability: options.accountability,
-        }, context);
-    }
-    if (!allowedFields || allowedFields.length === 0)
-        return [];
-    // In case of full read permissions
-    if (allowedFields[0] === '*')
-        allowedFields = fieldsInCollection;
-    for (let index = 0; index < fields.length; index++) {
-        const fieldKey = fields[index];
-        if (fieldKey.includes('*') === false)
-            continue;
-        if (fieldKey === '*') {
-            const aliases = Object.keys(options.query.alias ?? {});
-            // Set to all fields in collection
-            if (allowedFields.includes('*')) {
-                fields.splice(index, 1, ...fieldsInCollection, ...aliases);
-            }
-            else {
-                // Set to all allowed fields
-                const allowedAliases = aliases.filter((fieldKey) => {
-                    const name = options.query.alias[fieldKey];
-                    return allowedFields.includes(name);
-                });
-                fields.splice(index, 1, ...allowedFields, ...allowedAliases);
-            }
-        }
-        // Swap *.* case for *,<relational-field>.*,<another-relational>.*
-        if (fieldKey.includes('.') && fieldKey.split('.')[0] === '*') {
-            const parts = fieldKey.split('.');
-            const relationalFields = allowedFields.includes('*')
-                ? context.schema.relations
-                    .filter((relation) => relation.collection === options.parentCollection ||
-                    relation.related_collection === options.parentCollection)
-                    .map((relation) => {
-                    const isMany = relation.collection === options.parentCollection;
-                    return isMany ? relation.field : relation.meta?.one_field;
-                })
-                : allowedFields.filter((fieldKey) => !!getRelation(context.schema, options.parentCollection, fieldKey));
-            const nonRelationalFields = allowedFields.filter((fieldKey) => relationalFields.includes(fieldKey) === false);
-            const aliasFields = Object.keys(options.query.alias ?? {}).map((fieldKey) => {
-                const name = options.query.alias[fieldKey];
-                if (relationalFields.includes(name)) {
-                    return `${fieldKey}.${parts.slice(1).join('.')}`;
-                }
-                return fieldKey;
-            });
-            fields.splice(index, 1, ...[
-                ...relationalFields.map((relationalField) => {
-                    return `${relationalField}.${parts.slice(1).join('.')}`;
-                }),
-                ...nonRelationalFields,
-                ...aliasFields,
-            ]);
-        }
-    }
-    return fields;
-}

package/dist/database/get-ast-from-query/lib/parse-fields.d.ts

@@ -1,15 +0,0 @@
-import type { Accountability, Query, SchemaOverview } from '@directus/types';
-import type { Knex } from 'knex';
-import type { FieldNode, FunctionFieldNode, NestedCollectionNode } from '../../../types/index.js';
-export interface ParseFieldsOptions {
-    accountability: Accountability | null;
-    parentCollection: string;
-    fields: string[] | null;
-    query: Query;
-    deep?: Record<string, any>;
-}
-export interface ParseFieldsContext {
-    schema: SchemaOverview;
-    knex: Knex;
-}
-export declare function parseFields(options: ParseFieldsOptions, context: ParseFieldsContext): Promise<(NestedCollectionNode | FieldNode | FunctionFieldNode)[]>;

package/dist/database/get-ast-from-query/lib/parse-fields.js

@@ -1,190 +0,0 @@
-import { REGEX_BETWEEN_PARENS } from '@directus/constants';
-import { isEmpty } from 'lodash-es';
-import { fetchPermissions } from '../../../permissions/lib/fetch-permissions.js';
-import { fetchPolicies } from '../../../permissions/lib/fetch-policies.js';
-import { getRelationType } from '../../../utils/get-relation-type.js';
-import { getDeepQuery } from '../utils/get-deep-query.js';
-import { getRelatedCollection } from '../utils/get-related-collection.js';
-import { getRelation } from '../utils/get-relation.js';
-import { convertWildcards } from './convert-wildcards.js';
-export async function parseFields(options, context) {
-    let { fields } = options;
-    if (!fields)
-        return [];
-    fields = await convertWildcards({
-        fields,
-        parentCollection: options.parentCollection,
-        query: options.query,
-        accountability: options.accountability,
-    }, context);
-    if (!fields || !Array.isArray(fields))
-        return [];
-    const children = [];
-    const policies = options.accountability && options.accountability.admin === false
-        ? await fetchPolicies(options.accountability, context)
-        : null;
-    const relationalStructure = Object.create(null);
-    for (const fieldKey of fields) {
-        let name = fieldKey;
-        if (options.query.alias) {
-            // check for field alias (is one of the key)
-            if (name in options.query.alias) {
-                name = options.query.alias[fieldKey];
-            }
-        }
-        const isRelational = name.includes('.') ||
-            // We'll always treat top level o2m fields as a related item. This is an alias field, otherwise it won't return
-            // anything
-            !!context.schema.relations.find((relation) => relation.related_collection === options.parentCollection && relation.meta?.one_field === name);
-        if (isRelational) {
-            // field is relational
-            const parts = fieldKey.split('.');
-            let rootField = parts[0];
-            let collectionScope = null;
-            // a2o related collection scoped field selector `fields=sections.section_id:headings.title`
-            if (rootField.includes(':')) {
-                const [key, scope] = rootField.split(':');
-                rootField = key;
-                collectionScope = scope;
-            }
-            if (rootField in relationalStructure === false) {
-                if (collectionScope) {
-                    relationalStructure[rootField] = { [collectionScope]: [] };
-                }
-                else {
-                    relationalStructure[rootField] = [];
-                }
-            }
-            if (parts.length > 1) {
-                const childKey = parts.slice(1).join('.');
-                if (collectionScope) {
-                    if (collectionScope in relationalStructure[rootField] === false) {
-                        relationalStructure[rootField][collectionScope] = [];
-                    }
-                    relationalStructure[rootField][collectionScope].push(childKey);
-                }
-                else {
-                    relationalStructure[rootField].push(childKey);
-                }
-            }
-        }
-        else {
-            if (name.includes('(') && name.includes(')')) {
-                const columnName = name.match(REGEX_BETWEEN_PARENS)[1];
-                const foundField = context.schema.collections[options.parentCollection].fields[columnName];
-                if (foundField && foundField.type === 'alias') {
-                    const foundRelation = context.schema.relations.find((relation) => relation.related_collection === options.parentCollection && relation.meta?.one_field === columnName);
-                    if (foundRelation) {
-                        children.push({
-                            type: 'functionField',
-                            name,
-                            fieldKey,
-                            query: {},
-                            relatedCollection: foundRelation.collection,
-                            whenCase: [],
-                            cases: [],
-                        });
-                        continue;
-                    }
-                }
-            }
-            children.push({ type: 'field', name, fieldKey, whenCase: [] });
-        }
-    }
-    for (const [fieldKey, nestedFields] of Object.entries(relationalStructure)) {
-        let fieldName = fieldKey;
-        if (options.query.alias && fieldKey in options.query.alias) {
-            fieldName = options.query.alias[fieldKey];
-        }
-        const relatedCollection = getRelatedCollection(context.schema, options.parentCollection, fieldName);
-        const relation = getRelation(context.schema, options.parentCollection, fieldName);
-        if (!relation)
-            continue;
-        const relationType = getRelationType({
-            relation,
-            collection: options.parentCollection,
-            field: fieldName,
-        });
-        if (!relationType)
-            continue;
-        let child = null;
-        if (relationType === 'a2o') {
-            const allowedCollections = relation.meta.one_allowed_collections;
-            child = {
-                type: 'a2o',
-                names: allowedCollections,
-                children: {},
-                query: {},
-                relatedKey: {},
-                parentKey: context.schema.collections[options.parentCollection].primary,
-                fieldKey: fieldKey,
-                relation: relation,
-                cases: {},
-                whenCase: [],
-            };
-            for (const relatedCollection of allowedCollections) {
-                child.children[relatedCollection] = await parseFields({
-                    parentCollection: relatedCollection,
-                    fields: Array.isArray(nestedFields)
-                        ? nestedFields
-                        : nestedFields[relatedCollection] || [],
-                    query: options.query,
-                    deep: options.deep?.[`${fieldKey}:${relatedCollection}`],
-                    accountability: options.accountability,
-                }, context);
-                child.query[relatedCollection] = getDeepQuery(options.deep?.[`${fieldKey}:${relatedCollection}`] || {});
-                child.relatedKey[relatedCollection] = context.schema.collections[relatedCollection].primary;
-            }
-        }
-        else if (relatedCollection) {
-            if (options.accountability && options.accountability.admin === false && policies) {
-                const permissions = await fetchPermissions({
-                    action: 'read',
-                    collections: [relatedCollection],
-                    policies: policies,
-                    accountability: options.accountability,
-                }, context);
-                // Skip related collection if no permissions
-                if (permissions.length === 0) {
-                    continue;
-                }
-            }
-            // update query alias for children parseFields
-            const deepAlias = getDeepQuery(options.deep?.[fieldKey] || {})?.['alias'];
-            if (!isEmpty(deepAlias))
-                options.query.alias = deepAlias;
-            child = {
-                type: relationType,
-                name: relatedCollection,
-                fieldKey: fieldKey,
-                parentKey: context.schema.collections[options.parentCollection].primary,
-                relatedKey: context.schema.collections[relatedCollection].primary,
-                relation: relation,
-                query: getDeepQuery(options.deep?.[fieldKey] || {}),
-                children: await parseFields({
-                    parentCollection: relatedCollection,
-                    fields: nestedFields,
-                    query: options.query,
-                    deep: options.deep?.[fieldKey] || {},
-                    accountability: options.accountability,
-                }, context),
-                cases: [],
-                whenCase: [],
-            };
-            if (relationType === 'o2m' && !child.query.sort) {
-                child.query.sort = [relation.meta?.sort_field || context.schema.collections[relation.collection].primary];
-            }
-        }
-        if (child) {
-            children.push(child);
-        }
-    }
-    // Deduplicate any children fields that are included both as a regular field, and as a nested m2o field
-    const nestedCollectionNodes = children.filter((childNode) => childNode.type !== 'field');
-    return children.filter((childNode) => {
-        const existsAsNestedRelational = !!nestedCollectionNodes.find((nestedCollectionNode) => childNode.fieldKey === nestedCollectionNode.fieldKey);
-        if (childNode.type === 'field' && existsAsNestedRelational)
-            return false;
-        return true;
-    });
-}

package/dist/database/get-ast-from-query/utils/get-deep-query.d.ts

@@ -1,14 +0,0 @@
-/**
- * Convert Deep query object to regular query object by ignoring all nested fields and returning the
- * `_` prefixed fields as top level query fields
- *
- * @example
- *
- * ```js
- * getDeepQuery({
- *   _sort: ['a']
- * });
- * // => { sort: ['a'] }
- * ```
- */
-export declare function getDeepQuery(query: Record<string, any>): Record<string, any>;

package/dist/database/get-ast-from-query/utils/get-deep-query.js

@@ -1,17 +0,0 @@
-import { mapKeys, omitBy } from 'lodash-es';
-/**
- * Convert Deep query object to regular query object by ignoring all nested fields and returning the
- * `_` prefixed fields as top level query fields
- *
- * @example
- *
- * ```js
- * getDeepQuery({
- *   _sort: ['a']
- * });
- * // => { sort: ['a'] }
- * ```
- */
-export function getDeepQuery(query) {
-    return mapKeys(omitBy(query, (_value, key) => key.startsWith('_') === false), (_value, key) => key.substring(1));
-}

package/dist/database/get-ast-from-query/utils/get-related-collection.d.ts

@@ -1,2 +0,0 @@
-import type { SchemaOverview } from '@directus/types';
-export declare function getRelatedCollection(schema: SchemaOverview, collection: string, field: string): string | null;

package/dist/database/get-ast-from-query/utils/get-related-collection.js

@@ -1,13 +0,0 @@
-import { getRelation } from './get-relation.js';
-export function getRelatedCollection(schema, collection, field) {
-    const relation = getRelation(schema, collection, field);
-    if (!relation)
-        return null;
-    if (relation.collection === collection && relation.field === field) {
-        return relation.related_collection || null;
-    }
-    if (relation.related_collection === collection && relation.meta?.one_field === field) {
-        return relation.collection || null;
-    }
-    return null;
-}

package/dist/database/get-ast-from-query/utils/get-relation.d.ts

@@ -1,2 +0,0 @@
-import type { SchemaOverview } from '@directus/types';
-export declare function getRelation(schema: SchemaOverview, collection: string, field: string): import("@directus/types").Relation | undefined;

package/dist/database/get-ast-from-query/utils/get-relation.js

@@ -1,7 +0,0 @@
-export function getRelation(schema, collection, field) {
-    const relation = schema.relations.find((relation) => {
-        return ((relation.collection === collection && relation.field === field) ||
-            (relation.related_collection === collection && relation.meta?.one_field === field));
-    });
-    return relation;
-}