@directus/api 21.0.0 → 22.1.0

package/dist/permissions/modules/process-ast/utils/validate-path/validate-path-permissions.js

@@ -0,0 +1,28 @@
+import { createCollectionForbiddenError, createFieldsForbiddenError } from './create-error.js';
+export function validatePathPermissions(path, permissions, collection, fields) {
+    const permissionsForCollection = permissions.filter((permission) => permission.collection === collection);
+    if (permissionsForCollection.length === 0) {
+        throw createCollectionForbiddenError(path, collection);
+    }
+    // Set of all fields that are allowed to be queried combined
+    const allowedFields = new Set();
+    for (const { fields } of permissionsForCollection) {
+        if (!fields) {
+            continue;
+        }
+        for (const field of fields) {
+            if (field === '*') {
+                // Early exit in case all fields are allowed
+                return;
+            }
+            allowedFields.add(field);
+        }
+    }
+    const requestedFields = Array.from(fields);
+    const forbiddenFields = allowedFields.has('*')
+        ? []
+        : requestedFields.filter((field) => allowedFields.has(field) === false);
+    if (forbiddenFields.length > 0) {
+        throw createFieldsForbiddenError(path, collection, forbiddenFields);
+    }
+}

package/dist/permissions/modules/process-payload/lib/is-field-nullable.d.ts

@@ -0,0 +1,5 @@
+import type { FieldOverview } from '@directus/types';
+/**
+ * Checks if a given field is allowed to be set to `null`.
+ */
+export declare function isFieldNullable(field: FieldOverview): boolean;

package/dist/permissions/modules/process-payload/lib/is-field-nullable.js

@@ -0,0 +1,12 @@
+import { GENERATE_SPECIAL } from '../../../../constants.js';
+/**
+ * Checks if a given field is allowed to be set to `null`.
+ */
+export function isFieldNullable(field) {
+    if (field.nullable)
+        return true;
+    if (field.generated)
+        return true;
+    const hasGenerateSpecial = GENERATE_SPECIAL.some((name) => field.special.includes(name));
+    return hasGenerateSpecial;
+}

package/dist/permissions/modules/process-payload/process-payload.d.ts

@@ -0,0 +1,13 @@
+import type { Accountability, Item, PermissionsAction } from '@directus/types';
+import type { Context } from '../../types.js';
+export interface ProcessPayloadOptions {
+    accountability: Accountability;
+    action: PermissionsAction;
+    collection: string;
+    payload: Item;
+}
+/**
+ * @note this only validates the top-level fields. The expectation is that this function is called
+ * for each level of nested insert separately
+ */
+export declare function processPayload(options: ProcessPayloadOptions, context: Context): Promise<any>;

package/dist/permissions/modules/process-payload/process-payload.js

@@ -0,0 +1,77 @@
+import { ForbiddenError } from '@directus/errors';
+import { validatePayload } from '@directus/utils';
+import { FailedValidationError, joiValidationErrorItemToErrorExtensions } from '@directus/validation';
+import { assign, difference, uniq } from 'lodash-es';
+import { fetchPermissions } from '../../lib/fetch-permissions.js';
+import { fetchPolicies } from '../../lib/fetch-policies.js';
+import { isFieldNullable } from './lib/is-field-nullable.js';
+/**
+ * @note this only validates the top-level fields. The expectation is that this function is called
+ * for each level of nested insert separately
+ */
+export async function processPayload(options, context) {
+    let permissions;
+    let permissionValidationRules = [];
+    if (!options.accountability.admin) {
+        const policies = await fetchPolicies(options.accountability, context);
+        permissions = await fetchPermissions({ action: options.action, policies, collections: [options.collection], accountability: options.accountability }, context);
+        if (permissions.length === 0) {
+            throw new ForbiddenError({
+                reason: `You don't have permission to "${options.action}" from collection "${options.collection}" or it does not exist.`,
+            });
+        }
+        const fieldsAllowed = uniq(permissions.map(({ fields }) => fields ?? []).flat());
+        if (fieldsAllowed.includes('*') === false) {
+            const fieldsUsed = Object.keys(options.payload);
+            const notAllowed = difference(fieldsUsed, fieldsAllowed);
+            if (notAllowed.length > 0) {
+                const fieldStr = notAllowed.map((field) => `"${field}"`).join(', ');
+                throw new ForbiddenError({
+                    reason: notAllowed.length === 1
+                        ? `You don't have permission to access field ${fieldStr} in collection "${options.collection}" or it does not exist.`
+                        : `You don't have permission to access fields ${fieldStr} in collection "${options.collection}" or they do not exist.`,
+                });
+            }
+        }
+        permissionValidationRules = permissions.map(({ validation }) => validation);
+    }
+    const fields = Object.values(context.schema.collections[options.collection]?.fields ?? {});
+    const fieldValidationRules = [];
+    for (const field of fields) {
+        if (!isFieldNullable(field)) {
+            const isSubmissionRequired = options.action === 'create' && field.defaultValue === null;
+            if (isSubmissionRequired) {
+                fieldValidationRules.push({
+                    [field.field]: {
+                        _submitted: true,
+                    },
+                });
+            }
+            fieldValidationRules.push({
+                [field.field]: {
+                    _nnull: true,
+                },
+            });
+        }
+        fieldValidationRules.push(field.validation);
+    }
+    const validationRules = [...fieldValidationRules, ...permissionValidationRules].filter((rule) => {
+        if (rule === null)
+            return false;
+        if (Object.keys(rule).length === 0)
+            return false;
+        return true;
+    });
+    if (validationRules.length > 0) {
+        const validationErrors = [];
+        validationErrors.push(...validatePayload({ _and: validationRules }, options.payload)
+            .map((error) => error.details.map((details) => new FailedValidationError(joiValidationErrorItemToErrorExtensions(details))))
+            .flat());
+        if (validationErrors.length > 0)
+            throw validationErrors;
+    }
+    if (!permissions)
+        return options.payload;
+    const presets = permissions.map((permission) => permission.presets);
+    return assign({}, ...presets, options.payload);
+}

package/dist/permissions/modules/validate-access/lib/validate-collection-access.d.ts

@@ -0,0 +1,12 @@
+import type { Accountability, PermissionsAction } from '@directus/types';
+import type { Context } from '../../../types.js';
+export interface ValidateCollectionAccessOptions {
+    accountability: Accountability;
+    action: PermissionsAction;
+    collection: string;
+}
+/**
+ * Check if you have (limited) access to a given collection by making sure there's at least 1
+ * permission rule available for the collection and action combo
+ */
+export declare function validateCollectionAccess(options: ValidateCollectionAccessOptions, context: Context): Promise<boolean>;

package/dist/permissions/modules/validate-access/lib/validate-collection-access.js

@@ -0,0 +1,11 @@
+import { fetchPermissions } from '../../../lib/fetch-permissions.js';
+import { fetchPolicies } from '../../../lib/fetch-policies.js';
+/**
+ * Check if you have (limited) access to a given collection by making sure there's at least 1
+ * permission rule available for the collection and action combo
+ */
+export async function validateCollectionAccess(options, context) {
+    const policies = await fetchPolicies(options.accountability, context);
+    const permissions = await fetchPermissions({ action: options.action, policies, collections: [options.collection], accountability: options.accountability }, context);
+    return permissions.length > 0;
+}

package/dist/permissions/modules/validate-access/lib/validate-item-access.d.ts

@@ -0,0 +1,9 @@
+import type { Accountability, PermissionsAction, PrimaryKey } from '@directus/types';
+import type { Context } from '../../../types.js';
+export interface ValidateItemAccessOptions {
+    accountability: Accountability;
+    action: PermissionsAction;
+    collection: string;
+    primaryKeys: PrimaryKey[];
+}
+export declare function validateItemAccess(options: ValidateItemAccessOptions, context: Context): Promise<boolean>;

package/dist/permissions/modules/validate-access/lib/validate-item-access.js

@@ -0,0 +1,33 @@
+import { getAstFromQuery } from '../../../../database/get-ast-from-query/get-ast-from-query.js';
+import { runAst } from '../../../../database/run-ast/run-ast.js';
+import { processAst } from '../../process-ast/process-ast.js';
+export async function validateItemAccess(options, context) {
+    const primaryKeyField = context.schema.collections[options.collection]?.primary;
+    if (!primaryKeyField) {
+        throw new Error(`Cannot find primary key for collection "${options.collection}"`);
+    }
+    // When we're looking up access to specific items, we have to read them from the database to
+    // make sure you are allowed to access them.
+    const query = {
+        // We don't actually need any of the field data, just want to know if we can read the item as
+        // whole or not
+        fields: [],
+        limit: options.primaryKeys.length,
+        filter: {
+            [primaryKeyField]: {
+                _in: options.primaryKeys,
+            },
+        },
+    };
+    const ast = await getAstFromQuery({
+        accountability: options.accountability,
+        query,
+        collection: options.collection,
+    }, context);
+    await processAst({ ast, ...options }, context);
+    const items = await runAst(ast, context.schema, { knex: context.knex });
+    if (items && items.length === options.primaryKeys.length) {
+        return true;
+    }
+    return false;
+}

package/dist/permissions/modules/validate-access/validate-access.d.ts

@@ -0,0 +1,14 @@
+import type { Accountability, PermissionsAction, PrimaryKey } from '@directus/types';
+import type { Context } from '../../types.js';
+export interface ValidateAccessOptions {
+    accountability: Accountability;
+    action: PermissionsAction;
+    collection: string;
+    primaryKeys?: PrimaryKey[];
+}
+/**
+ * Validate if the current user has access to perform action against the given collection and
+ * optional primary keys. This is done by reading the item from the database using the access
+ * control rules and checking if we got the expected result back
+ */
+export declare function validateAccess(options: ValidateAccessOptions, context: Context): Promise<void>;

package/dist/permissions/modules/validate-access/validate-access.js

@@ -0,0 +1,28 @@
+import { ForbiddenError } from '@directus/errors';
+import { validateCollectionAccess } from './lib/validate-collection-access.js';
+import { validateItemAccess } from './lib/validate-item-access.js';
+/**
+ * Validate if the current user has access to perform action against the given collection and
+ * optional primary keys. This is done by reading the item from the database using the access
+ * control rules and checking if we got the expected result back
+ */
+export async function validateAccess(options, context) {
+    if (options.accountability.admin === true) {
+        return;
+    }
+    let access;
+    // If primary keys are passed, we have to confirm the access by actually trying to read the items
+    // from the database. If no keys are passed, we can simply check if the collection+action combo
+    // exists within permissions
+    if (options.primaryKeys) {
+        access = await validateItemAccess(options, context);
+    }
+    else {
+        access = await validateCollectionAccess(options, context);
+    }
+    if (!access) {
+        throw new ForbiddenError({
+            reason: `You don't have permission to "${options.action}" from collection "${options.collection}" or it does not exist.`,
+        });
+    }
+}

package/dist/permissions/modules/validate-remaining-admin/validate-remaining-admin-count.d.ts

@@ -0,0 +1 @@
+export declare function validateRemainingAdminCount(count: number): void;

package/dist/permissions/modules/validate-remaining-admin/validate-remaining-admin-count.js

@@ -0,0 +1,8 @@
+import { UnprocessableContentError } from '@directus/errors';
+export function validateRemainingAdminCount(count) {
+    if (count <= 0) {
+        throw new UnprocessableContentError({
+            reason: `Cannot remove the last admin user from the system`,
+        });
+    }
+}

package/dist/permissions/modules/validate-remaining-admin/validate-remaining-admin-users.d.ts

@@ -0,0 +1,5 @@
+import { type FetchUserCountOptions } from '../../../utils/fetch-user-count/fetch-user-count.js';
+import type { Context } from '../../types.js';
+export interface ValidateRemainingAdminUsersOptions extends Pick<FetchUserCountOptions, 'excludeAccessRows' | 'excludePolicies' | 'excludeUsers' | 'excludeRoles'> {
+}
+export declare function validateRemainingAdminUsers(options: ValidateRemainingAdminUsersOptions, context: Context): Promise<void>;

package/dist/permissions/modules/validate-remaining-admin/validate-remaining-admin-users.js

@@ -0,0 +1,10 @@
+import { fetchUserCount } from '../../../utils/fetch-user-count/fetch-user-count.js';
+import { validateRemainingAdminCount } from './validate-remaining-admin-count.js';
+export async function validateRemainingAdminUsers(options, context) {
+    const { admin } = await fetchUserCount({
+        ...options,
+        adminOnly: true,
+        knex: context.knex,
+    });
+    validateRemainingAdminCount(admin);
+}

package/dist/permissions/types.d.ts

@@ -0,0 +1,6 @@
+import type { SchemaOverview } from '@directus/types';
+import type { Knex } from 'knex';
+export interface Context {
+    schema: SchemaOverview;
+    knex: Knex;
+}

package/dist/permissions/types.js

@@ -0,0 +1 @@
+export {};

package/dist/permissions/utils/create-default-accountability.d.ts

@@ -0,0 +1,2 @@
+import type { Accountability } from '@directus/types';
+export declare function createDefaultAccountability(overrides?: Partial<Accountability>): Accountability;

package/dist/permissions/utils/create-default-accountability.js

@@ -0,0 +1,11 @@
+export function createDefaultAccountability(overrides) {
+    return {
+        role: null,
+        user: null,
+        roles: [],
+        admin: false,
+        app: false,
+        ip: null,
+        ...overrides,
+    };
+}

package/dist/permissions/utils/extract-required-dynamic-variable-context.d.ts

@@ -0,0 +1,8 @@
+import type { Permission } from '@directus/types';
+export interface RequiredPermissionContext {
+    $CURRENT_USER: Set<string>;
+    $CURRENT_ROLE: Set<string>;
+    $CURRENT_ROLES: Set<string>;
+    $CURRENT_POLICIES: Set<string>;
+}
+export declare function extractRequiredDynamicVariableContext(permissions: Permission[]): RequiredPermissionContext;

package/dist/permissions/utils/extract-required-dynamic-variable-context.js

@@ -0,0 +1,27 @@
+import { deepMap } from '@directus/utils';
+export function extractRequiredDynamicVariableContext(permissions) {
+    const permissionContext = {
+        $CURRENT_USER: new Set(),
+        $CURRENT_ROLE: new Set(),
+        $CURRENT_ROLES: new Set(),
+        $CURRENT_POLICIES: new Set(),
+    };
+    for (const permission of permissions) {
+        deepMap(permission.permissions, extractPermissionData);
+        deepMap(permission.validation, extractPermissionData);
+        deepMap(permission.presets, extractPermissionData);
+    }
+    return permissionContext;
+    function extractPermissionData(val) {
+        for (const placeholder of [
+            '$CURRENT_USER',
+            '$CURRENT_ROLE',
+            '$CURRENT_ROLES',
+            '$CURRENT_POLICIES',
+        ]) {
+            if (typeof val === 'string' && val.startsWith(`${placeholder}.`)) {
+                permissionContext[placeholder].add(val.replace(`${placeholder}.`, ''));
+            }
+        }
+    }
+}

package/dist/permissions/utils/fetch-dynamic-variable-context.d.ts

@@ -0,0 +1,9 @@
+import type { Accountability, Permission } from '@directus/types';
+import type { Context } from '../types.js';
+export declare const fetchDynamicVariableContext: typeof _fetchDynamicVariableContext;
+export interface FetchDynamicVariableContext {
+    accountability: Pick<Accountability, 'user' | 'role' | 'roles'>;
+    policies: string[];
+    permissions: Permission[];
+}
+export declare function _fetchDynamicVariableContext(options: FetchDynamicVariableContext, context: Context): Promise<Record<string, any>>;

package/dist/permissions/utils/fetch-dynamic-variable-context.js

@@ -0,0 +1,43 @@
+import { extractRequiredDynamicVariableContext } from './extract-required-dynamic-variable-context.js';
+import { withCache } from './with-cache.js';
+export const fetchDynamicVariableContext = withCache('permission-dynamic-variables', _fetchDynamicVariableContext, ({ policies, permissions, accountability: { user, role, roles } }) => ({
+    policies,
+    permissions,
+    accountability: {
+        user,
+        role,
+        roles,
+    },
+}));
+export async function _fetchDynamicVariableContext(options, context) {
+    const { UsersService } = await import('../../services/users.js');
+    const { RolesService } = await import('../../services/roles.js');
+    const { PoliciesService } = await import('../../services/policies.js');
+    const contextData = {};
+    const permissionContext = extractRequiredDynamicVariableContext(options.permissions);
+    if (options.accountability.user && (permissionContext.$CURRENT_USER?.size ?? 0) > 0) {
+        const usersService = new UsersService(context);
+        contextData['$CURRENT_USER'] = await usersService.readOne(options.accountability.user, {
+            fields: Array.from(permissionContext.$CURRENT_USER),
+        });
+    }
+    if (options.accountability.role && (permissionContext.$CURRENT_ROLE?.size ?? 0) > 0) {
+        const rolesService = new RolesService(context);
+        contextData['$CURRENT_ROLE'] = await rolesService.readOne(options.accountability.role, {
+            fields: Array.from(permissionContext.$CURRENT_ROLE),
+        });
+    }
+    if (options.accountability.roles.length > 0 && (permissionContext.$CURRENT_ROLES?.size ?? 0) > 0) {
+        const rolesService = new RolesService(context);
+        contextData['$CURRENT_ROLES'] = await rolesService.readMany(options.accountability.roles, {
+            fields: Array.from(permissionContext.$CURRENT_ROLES),
+        });
+    }
+    if (options.policies.length > 0 && (permissionContext.$CURRENT_POLICIES?.size ?? 0) > 0) {
+        const policiesService = new PoliciesService(context);
+        contextData['$CURRENT_POLICIES'] = await policiesService.readMany(options.policies, {
+            fields: Array.from(permissionContext.$CURRENT_POLICIES),
+        });
+    }
+    return contextData;
+}

package/dist/permissions/utils/filter-policies-by-ip.d.ts

@@ -0,0 +1,2 @@
+import type { AccessRow } from '../lib/fetch-policies.js';
+export declare function filterPoliciesByIp(policies: AccessRow[], ip: string | null | undefined): AccessRow[];

package/dist/permissions/utils/filter-policies-by-ip.js

@@ -0,0 +1,15 @@
+import { ipInNetworks } from '../../utils/ip-in-networks.js';
+export function filterPoliciesByIp(policies, ip) {
+    return policies.filter(({ policy }) => {
+        // Keep policies that don't have an ip address allow list configured
+        if (!policy.ip_access || policy.ip_access.length === 0) {
+            return true;
+        }
+        // If the client's IP address is unknown, we can't validate it against the allow list and will
+        // have to default to the more secure option of preventing access
+        if (!ip) {
+            return false;
+        }
+        return ipInNetworks(ip, policy.ip_access);
+    });
+}

package/dist/permissions/utils/get-unaliased-field-key.d.ts

@@ -0,0 +1,5 @@
+import type { FieldNode, FunctionFieldNode, NestedCollectionNode } from '../../types/index.js';
+/**
+ * Derive the unaliased field key from the given AST node.
+ */
+export declare function getUnaliasedFieldKey(node: NestedCollectionNode | FieldNode | FunctionFieldNode): string;

package/dist/permissions/utils/get-unaliased-field-key.js

@@ -0,0 +1,17 @@
+import { parseFilterKey } from '../../utils/parse-filter-key.js';
+/**
+ * Derive the unaliased field key from the given AST node.
+ */
+export function getUnaliasedFieldKey(node) {
+    switch (node.type) {
+        case 'o2m':
+            return node.relation.meta.one_field;
+        case 'a2o':
+        case 'm2o':
+            return node.relation.field;
+        case 'field':
+        case 'functionField':
+            // The field name might still include a function, so process that here as well
+            return parseFilterKey(node.name).fieldName;
+    }
+}

package/dist/permissions/utils/process-permissions.d.ts

@@ -0,0 +1,7 @@
+import type { Accountability, Permission } from '@directus/types';
+export interface ProcessPermissionsOptions {
+    permissions: Permission[];
+    accountability: Pick<Accountability, 'user' | 'role' | 'roles'>;
+    permissionsContext: Record<string, any>;
+}
+export declare function processPermissions({ permissions, accountability, permissionsContext }: ProcessPermissionsOptions): Permission[];

package/dist/permissions/utils/process-permissions.js

@@ -0,0 +1,9 @@
+import { parseFilter, parsePreset } from '@directus/utils';
+export function processPermissions({ permissions, accountability, permissionsContext }) {
+    return permissions.map((permission) => {
+        permission.permissions = parseFilter(permission.permissions, accountability, permissionsContext);
+        permission.validation = parseFilter(permission.validation, accountability, permissionsContext);
+        permission.presets = parsePreset(permission.presets, accountability, permissionsContext);
+        return permission;
+    });
+}

package/dist/permissions/utils/with-cache.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The `pick` parameter can be used to stabilize cache keys, by only using a subset of the available parameters and
+ * ensuring key order.
+ *
+ * If the `pick` function is provided, we pass the picked result to the handler, in order for TypeScript to ensure that
+ * the function only relies on the parameters that are used for generating the cache key.
+ *
+ * @NOTE only uses the first parameter for memoization
+ */
+export declare function withCache<F extends (arg0: Arg0, ...args: any[]) => R, R, Arg0 = Parameters<F>[0]>(namespace: string, handler: F, prepareArg?: (arg0: Arg0) => Arg0): F;

package/dist/permissions/utils/with-cache.js

@@ -0,0 +1,25 @@
+import { getSimpleHash } from '@directus/utils';
+import { useCache } from '../cache.js';
+/**
+ * The `pick` parameter can be used to stabilize cache keys, by only using a subset of the available parameters and
+ * ensuring key order.
+ *
+ * If the `pick` function is provided, we pass the picked result to the handler, in order for TypeScript to ensure that
+ * the function only relies on the parameters that are used for generating the cache key.
+ *
+ * @NOTE only uses the first parameter for memoization
+ */
+export function withCache(namespace, handler, prepareArg) {
+    const cache = useCache();
+    return (async (arg0, ...args) => {
+        arg0 = prepareArg ? prepareArg(arg0) : arg0;
+        const key = namespace + '-' + getSimpleHash(JSON.stringify(arg0));
+        const cached = await cache.get(key);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const res = await handler(arg0, ...args);
+        cache.set(key, res);
+        return res;
+    });
+}

package/dist/server.js

@@ -13,6 +13,7 @@ import emitter from './emitter.js';
 import { useLogger } from './logger/index.js';
 import { getConfigFromEnv } from './utils/get-config-from-env.js';
 import { getIPFromReq } from './utils/get-ip-from-req.js';
+import { getAddress } from './utils/get-address.js';
 import { createSubscriptionController, createWebSocketController, getSubscriptionController, getWebSocketController, } from './websocket/controllers/index.js';
 import { startWebSocketHandlers } from './websocket/handlers/index.js';
 export let SERVER_ONLINE = true;
@@ -116,10 +117,22 @@ export async function createServer() {
 export async function startServer() {
     const server = await createServer();
     const host = env['HOST'];
-    const port = parseInt(env['PORT']);
+    const path = env['UNIX_SOCKET_PATH'];
+    const port = env['PORT'];
+    let listenOptions;
+    if (path) {
+        listenOptions = { path };
+    }
+    else {
+        listenOptions = {
+            host,
+            port: parseInt(port || '8055'),
+        };
+    }
     server
-        .listen(port, host, () => {
-        logger.info(`Server started at http://${host}:${port}`);
+        .listen(listenOptions, () => {
+        const protocol = server instanceof https.Server ? 'https' : 'http';
+        logger.info(`Server started at ${listenOptions.port ? `${protocol}://${getAddress(server)}` : getAddress(server)}`);
         process.send?.('ready');
         emitter.emitAction('server.start', { server }, {
             database: getDatabase(),
@@ -129,7 +142,7 @@ export async function startServer() {
     })
         .once('error', (err) => {
         if (err?.code === 'EADDRINUSE') {
-            logger.error(`Port ${port} is already in use`);
+            logger.error(`${listenOptions.port ? `Port ${listenOptions.port}` : getAddress(server)} is already in use`);
             process.exit(1);
         }
         else {

package/dist/services/access.d.ts

@@ -0,0 +1,10 @@
+import type { Item, PrimaryKey } from '@directus/types';
+import type { AbstractServiceOptions, MutationOptions } from '../types/index.js';
+import { ItemsService } from './items.js';
+export declare class AccessService extends ItemsService {
+    constructor(options: AbstractServiceOptions);
+    private clearCaches;
+    createOne(data: Partial<Item>, opts?: MutationOptions): Promise<PrimaryKey>;
+    updateMany(keys: PrimaryKey[], data: Partial<Item>, opts?: MutationOptions): Promise<PrimaryKey[]>;
+    deleteMany(keys: PrimaryKey[], opts?: MutationOptions): Promise<PrimaryKey[]>;
+}

package/dist/services/access.js

@@ -0,0 +1,43 @@
+import { clearSystemCache } from '../cache.js';
+import { UserIntegrityCheckFlag } from '../utils/validate-user-count-integrity.js';
+import { ItemsService } from './items.js';
+export class AccessService extends ItemsService {
+    constructor(options) {
+        super('directus_access', options);
+    }
+    async clearCaches(opts) {
+        await clearSystemCache({ autoPurgeCache: opts?.autoPurgeCache });
+        if (this.cache && opts?.autoPurgeCache !== false) {
+            await this.cache.clear();
+        }
+    }
+    async createOne(data, opts = {}) {
+        // Creating a new policy attachments affects the number of admin/app/api users.
+        // But it can only add app or admin users, so no need to check the remaining admin users.
+        opts.userIntegrityCheckFlags =
+            (opts.userIntegrityCheckFlags ?? UserIntegrityCheckFlag.None) | UserIntegrityCheckFlag.UserLimits;
+        opts.onRequireUserIntegrityCheck?.(opts.userIntegrityCheckFlags);
+        const result = await super.createOne(data, opts);
+        // A new policy has been attached to a user or a role, clear the caches
+        await this.clearCaches();
+        return result;
+    }
+    async updateMany(keys, data, opts = {}) {
+        // Updating policy attachments might affect the number of admin/app/api users
+        opts.userIntegrityCheckFlags = UserIntegrityCheckFlag.All;
+        opts.onRequireUserIntegrityCheck?.(opts.userIntegrityCheckFlags);
+        const result = await super.updateMany(keys, data, { ...opts, userIntegrityCheckFlags: UserIntegrityCheckFlag.All });
+        // Some policy attachments have been updated, clear the caches
+        await this.clearCaches();
+        return result;
+    }
+    async deleteMany(keys, opts = {}) {
+        // Changes here can affect the number of admin/app/api users
+        opts.userIntegrityCheckFlags = UserIntegrityCheckFlag.All;
+        opts.onRequireUserIntegrityCheck?.(opts.userIntegrityCheckFlags);
+        const result = await super.deleteMany(keys, opts);
+        // Some policy attachments have been deleted, clear the caches
+        await this.clearCaches();
+        return result;
+    }
+}