@directus/api 23.0.0 → 23.1.0

package/dist/app.js

@@ -14,6 +14,7 @@ import accessRouter from './controllers/access.js';
 import assetsRouter from './controllers/assets.js';
 import authRouter from './controllers/auth.js';
 import collectionsRouter from './controllers/collections.js';
+import commentsRouter from './controllers/comments.js';
 import dashboardsRouter from './controllers/dashboards.js';
 import extensionsRouter from './controllers/extensions.js';
 import fieldsRouter from './controllers/fields.js';
@@ -209,6 +210,7 @@ export default async function createApp() {
     app.use('/access', accessRouter);
     app.use('/assets', assetsRouter);
     app.use('/collections', collectionsRouter);
+    app.use('/comments', commentsRouter);
     app.use('/dashboards', dashboardsRouter);
     app.use('/extensions', extensionsRouter);
     app.use('/fields', fieldsRouter);

package/dist/controllers/activity.js

@@ -1,15 +1,13 @@
-import { Action } from '@directus/constants';
-import { isDirectusError } from '@directus/errors';
+import { ErrorCode, InvalidPayloadError, isDirectusError } from '@directus/errors';
 import express from 'express';
 import Joi from 'joi';
-import { ErrorCode, ForbiddenError, InvalidPayloadError } from '@directus/errors';
 import { respond } from '../middleware/respond.js';
 import useCollection from '../middleware/use-collection.js';
 import { validateBatch } from '../middleware/validate-batch.js';
 import { ActivityService } from '../services/activity.js';
+import { CommentsService } from '../services/comments.js';
 import { MetaService } from '../services/meta.js';
 import asyncHandler from '../utils/async-handler.js';
-import { getIPFromReq } from '../utils/get-ip-from-req.js';
 const router = express.Router();
 router.use(useCollection('directus_activity'));
 const readHandler = asyncHandler(async (req, res, next) => {
@@ -22,6 +20,7 @@ const readHandler = asyncHandler(async (req, res, next) => {
         schema: req.schema,
     });
     let result;
+    let isComment;
     if (req.singleton) {
         result = await service.readSingleton(req.sanitizedQuery);
     }
@@ -29,9 +28,24 @@ const readHandler = asyncHandler(async (req, res, next) => {
         result = await service.readMany(req.body.keys, req.sanitizedQuery);
     }
     else {
-        result = await service.readByQuery(req.sanitizedQuery);
+        const sanitizedFilter = req.sanitizedQuery.filter;
+        if (sanitizedFilter &&
+            '_and' in sanitizedFilter &&
+            Array.isArray(sanitizedFilter['_and']) &&
+            sanitizedFilter['_and'].find((andItem) => 'action' in andItem && '_eq' in andItem['action'] && andItem['action']['_eq'] === 'comment')) {
+            const commentsService = new CommentsService({
+                accountability: req.accountability,
+                schema: req.schema,
+                serviceOrigin: 'activity',
+            });
+            result = await commentsService.readByQuery(req.sanitizedQuery);
+            isComment = true;
+        }
+        else {
+            result = await service.readByQuery(req.sanitizedQuery);
+        }
     }
-    const meta = await metaService.getMetaForQuery('directus_activity', req.sanitizedQuery);
+    const meta = await metaService.getMetaForQuery(isComment ? 'directus_comments' : 'directus_activity', req.sanitizedQuery);
     res.locals['payload'] = {
         data: result,
         meta,
@@ -57,22 +71,16 @@ const createCommentSchema = Joi.object({
     item: [Joi.number().required(), Joi.string().required()],
 });
 router.post('/comment', asyncHandler(async (req, res, next) => {
-    const service = new ActivityService({
+    const service = new CommentsService({
         accountability: req.accountability,
         schema: req.schema,
+        serviceOrigin: 'activity',
     });
     const { error } = createCommentSchema.validate(req.body);
     if (error) {
         throw new InvalidPayloadError({ reason: error.message });
     }
-    const primaryKey = await service.createOne({
-        ...req.body,
-        action: Action.COMMENT,
-        user: req.accountability?.user,
-        ip: getIPFromReq(req),
-        user_agent: req.accountability?.userAgent,
-        origin: req.get('origin'),
-    });
+    const primaryKey = await service.createOne(req.body);
     try {
         const record = await service.readOne(primaryKey, req.sanitizedQuery);
         res.locals['payload'] = {
@@ -91,17 +99,18 @@ const updateCommentSchema = Joi.object({
     comment: Joi.string().required(),
 });
 router.patch('/comment/:pk', asyncHandler(async (req, res, next) => {
-    const service = new ActivityService({
+    const commentsService = new CommentsService({
         accountability: req.accountability,
         schema: req.schema,
+        serviceOrigin: 'activity',
     });
     const { error } = updateCommentSchema.validate(req.body);
     if (error) {
         throw new InvalidPayloadError({ reason: error.message });
     }
-    const primaryKey = await service.updateOne(req.params['pk'], req.body);
+    const primaryKey = await commentsService.updateOne(req.params['pk'], req.body);
     try {
-        const record = await service.readOne(primaryKey, req.sanitizedQuery);
+        const record = await commentsService.readOne(primaryKey, req.sanitizedQuery);
         res.locals['payload'] = {
             data: record || null,
         };
@@ -115,18 +124,12 @@ router.patch('/comment/:pk', asyncHandler(async (req, res, next) => {
     return next();
 }), respond);
 router.delete('/comment/:pk', asyncHandler(async (req, _res, next) => {
-    const service = new ActivityService({
+    const commentsService = new CommentsService({
         accountability: req.accountability,
         schema: req.schema,
+        serviceOrigin: 'activity',
     });
-    const adminService = new ActivityService({
-        schema: req.schema,
-    });
-    const item = await adminService.readOne(req.params['pk'], { fields: ['action'] });
-    if (!item || item['action'] !== Action.COMMENT) {
-        throw new ForbiddenError();
-    }
-    await service.deleteOne(req.params['pk']);
+    await commentsService.deleteOne(req.params['pk']);
     return next();
 }), respond);
 export default router;

package/dist/controllers/assets.js

@@ -104,7 +104,7 @@ asyncHandler(async (req, res, next) => {
     return helmet.contentSecurityPolicy(merge({
         useDefaults: false,
         directives: {
-            defaultSrc: ['none'],
+            defaultSrc: [`'none'`],
         },
     }, getConfigFromEnv('ASSETS_CONTENT_SECURITY_POLICY')))(req, res, next);
 }), 

package/dist/controllers/comments.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/dist/controllers/comments.js

@@ -0,0 +1,153 @@
+import { ErrorCode, isDirectusError } from '@directus/errors';
+import express from 'express';
+import { respond } from '../middleware/respond.js';
+import useCollection from '../middleware/use-collection.js';
+import { validateBatch } from '../middleware/validate-batch.js';
+import { CommentsService } from '../services/comments.js';
+import { MetaService } from '../services/meta.js';
+import asyncHandler from '../utils/async-handler.js';
+import { sanitizeQuery } from '../utils/sanitize-query.js';
+const router = express.Router();
+router.use(useCollection('directus_comments'));
+router.post('/', asyncHandler(async (req, res, next) => {
+    const service = new CommentsService({
+        accountability: req.accountability,
+        schema: req.schema,
+        serviceOrigin: 'comments',
+    });
+    const savedKeys = [];
+    if (Array.isArray(req.body)) {
+        const keys = await service.createMany(req.body);
+        savedKeys.push(...keys);
+    }
+    else {
+        const key = await service.createOne(req.body);
+        savedKeys.push(key);
+    }
+    try {
+        if (Array.isArray(req.body)) {
+            const records = await service.readMany(savedKeys, req.sanitizedQuery);
+            res.locals['payload'] = { data: records };
+        }
+        else {
+            const record = await service.readOne(savedKeys[0], req.sanitizedQuery);
+            res.locals['payload'] = { data: record };
+        }
+    }
+    catch (error) {
+        if (isDirectusError(error, ErrorCode.Forbidden)) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+const readHandler = asyncHandler(async (req, res, next) => {
+    const service = new CommentsService({
+        accountability: req.accountability,
+        schema: req.schema,
+        serviceOrigin: 'comments',
+    });
+    const metaService = new MetaService({
+        accountability: req.accountability,
+        schema: req.schema,
+    });
+    let result;
+    if (req.body.keys) {
+        result = await service.readMany(req.body.keys, req.sanitizedQuery);
+    }
+    else {
+        result = await service.readByQuery(req.sanitizedQuery);
+    }
+    const meta = await metaService.getMetaForQuery('directus_comments', req.sanitizedQuery);
+    res.locals['payload'] = { data: result, meta };
+    return next();
+});
+router.get('/', validateBatch('read'), readHandler, respond);
+router.search('/', validateBatch('read'), readHandler, respond);
+router.get('/:pk', asyncHandler(async (req, res, next) => {
+    const service = new CommentsService({
+        accountability: req.accountability,
+        schema: req.schema,
+        serviceOrigin: 'comments',
+    });
+    const record = await service.readOne(req.params['pk'], req.sanitizedQuery);
+    res.locals['payload'] = { data: record || null };
+    return next();
+}), respond);
+router.patch('/', validateBatch('update'), asyncHandler(async (req, res, next) => {
+    const service = new CommentsService({
+        accountability: req.accountability,
+        schema: req.schema,
+        serviceOrigin: 'comments',
+    });
+    let keys = [];
+    if (Array.isArray(req.body)) {
+        keys = await service.updateBatch(req.body);
+    }
+    else if (req.body.keys) {
+        keys = await service.updateMany(req.body.keys, req.body.data);
+    }
+    else {
+        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
+        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
+    }
+    try {
+        const result = await service.readMany(keys, req.sanitizedQuery);
+        res.locals['payload'] = { data: result };
+    }
+    catch (error) {
+        if (isDirectusError(error, ErrorCode.Forbidden)) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+router.patch('/:pk', asyncHandler(async (req, res, next) => {
+    const service = new CommentsService({
+        accountability: req.accountability,
+        schema: req.schema,
+        serviceOrigin: 'comments',
+    });
+    const primaryKey = await service.updateOne(req.params['pk'], req.body);
+    try {
+        const record = await service.readOne(primaryKey, req.sanitizedQuery);
+        res.locals['payload'] = { data: record };
+    }
+    catch (error) {
+        if (isDirectusError(error, ErrorCode.Forbidden)) {
+            return next();
+        }
+        throw error;
+    }
+    return next();
+}), respond);
+router.delete('/', validateBatch('delete'), asyncHandler(async (req, _res, next) => {
+    const service = new CommentsService({
+        accountability: req.accountability,
+        schema: req.schema,
+        serviceOrigin: 'comments',
+    });
+    if (Array.isArray(req.body)) {
+        await service.deleteMany(req.body);
+    }
+    else if (req.body.keys) {
+        await service.deleteMany(req.body.keys);
+    }
+    else {
+        const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
+        await service.deleteByQuery(sanitizedQuery);
+    }
+    return next();
+}), respond);
+router.delete('/:pk', asyncHandler(async (req, _res, next) => {
+    const service = new CommentsService({
+        accountability: req.accountability,
+        schema: req.schema,
+        serviceOrigin: 'comments',
+    });
+    await service.deleteOne(req.params['pk']);
+    return next();
+}), respond);
+export default router;

package/dist/controllers/versions.js

@@ -154,8 +154,14 @@ router.get('/:pk/compare', asyncHandler(async (req, res, next) => {
     });
     const version = await service.readOne(req.params['pk']);
     const { outdated, mainHash } = await service.verifyHash(version['collection'], version['item'], version['hash']);
-    const saves = await service.getVersionSavesById(version['id']);
-    const current = assign({}, ...saves);
+    let current;
+    if (version['delta']) {
+        current = version['delta'];
+    }
+    else {
+        const saves = await service.getVersionSavesById(version['id']);
+        current = assign({}, ...saves);
+    }
     const main = await service.getMainItem(version['collection'], version['item']);
     res.locals['payload'] = { data: { outdated, mainHash, current, main } };
     return next();
@@ -167,9 +173,8 @@ router.post('/:pk/save', asyncHandler(async (req, res, next) => {
     });
     const version = await service.readOne(req.params['pk']);
     const mainItem = await service.getMainItem(version['collection'], version['item']);
-    await service.save(req.params['pk'], req.body);
-    const saves = await service.getVersionSavesById(req.params['pk']);
-    const result = assign(mainItem, ...saves);
+    const updatedVersion = await service.save(req.params['pk'], req.body);
+    const result = assign(mainItem, updatedVersion);
     res.locals['payload'] = { data: result || null };
     return next();
 }), respond);

package/dist/database/index.js

@@ -140,6 +140,9 @@ export function getDatabase() {
             times.delete(queryInfo.__knexUid);
         }
         logger.trace(`[${delta ? delta.toFixed(3) : '?'}ms] ${queryInfo.sql} [${(queryInfo.bindings ?? []).join(', ')}]`);
+    })
+        .on('query-error', (_, queryInfo) => {
+        times.delete(queryInfo.__knexUid);
     });
     return database;
 }

package/dist/database/migrations/20240909A-separate-comments.d.ts

@@ -0,0 +1,3 @@
+import type { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20240909A-separate-comments.js

@@ -0,0 +1,65 @@
+import { Action } from '@directus/constants';
+export async function up(knex) {
+    await knex.schema.createTable('directus_comments', (table) => {
+        table.uuid('id').primary().notNullable();
+        table
+            .string('collection', 64)
+            .notNullable()
+            .references('collection')
+            .inTable('directus_collections')
+            .onDelete('CASCADE');
+        table.string('item').notNullable();
+        table.text('comment').notNullable();
+        table.timestamp('date_created').defaultTo(knex.fn.now());
+        table.timestamp('date_updated').defaultTo(knex.fn.now());
+        table.uuid('user_created').references('id').inTable('directus_users').onDelete('SET NULL');
+        // Cannot have two constraints from/to the same table, handled on API side
+        table.uuid('user_updated').references('id').inTable('directus_users');
+    });
+}
+export async function down(knex) {
+    const rowsLimit = 50;
+    let hasMore = true;
+    while (hasMore) {
+        const comments = await knex
+            .select('id', 'collection', 'item', 'comment', 'date_created', 'user_created')
+            .from('directus_comments')
+            .limit(rowsLimit);
+        if (comments.length === 0) {
+            hasMore = false;
+            break;
+        }
+        await knex.transaction(async (trx) => {
+            for (const comment of comments) {
+                const migratedRecords = await trx('directus_activity')
+                    .select('id')
+                    .where('collection', '=', 'directus_comments')
+                    .andWhere('item', '=', comment.id)
+                    .andWhere('action', '=', Action.CREATE)
+                    .limit(1);
+                if (migratedRecords[0]) {
+                    await trx('directus_activity')
+                        .update({
+                        action: Action.COMMENT,
+                        collection: comment.collection,
+                        item: comment.item,
+                        comment: comment.comment,
+                    })
+                        .where('id', '=', migratedRecords[0].id);
+                }
+                else {
+                    await trx('directus_activity').insert({
+                        action: Action.COMMENT,
+                        collection: comment.collection,
+                        item: comment.item,
+                        comment: comment.comment,
+                        user: comment.user_created,
+                        timestamp: comment.date_created,
+                    });
+                }
+                await trx('directus_comments').where('id', '=', comment.id).delete();
+            }
+        });
+    }
+    await knex.schema.dropTable('directus_comments');
+}

package/dist/database/migrations/20240909B-consolidate-content-versioning.d.ts

@@ -0,0 +1,3 @@
+import type { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20240909B-consolidate-content-versioning.js

@@ -0,0 +1,10 @@
+export async function up(knex) {
+    await knex.schema.alterTable('directus_versions', (table) => {
+        table.json('delta');
+    });
+}
+export async function down(knex) {
+    await knex.schema.alterTable('directus_versions', (table) => {
+        table.dropColumn('delta');
+    });
+}

package/dist/database/run-ast/lib/get-db-query.d.ts

@@ -1,4 +1,14 @@
-import type { Filter, Permission, Query, SchemaOverview } from '@directus/types';
+import type { Filter, Permission, Query } from '@directus/types';
 import type { Knex } from 'knex';
+import type { Context } from '../../../permissions/types.js';
 import type { FieldNode, FunctionFieldNode, O2MNode } from '../../../types/ast.js';
-export declare function getDBQuery(schema: SchemaOverview, knex: Knex, table: string, fieldNodes: (FieldNode | FunctionFieldNode)[], o2mNodes: O2MNode[], query: Query, cases: Filter[], permissions: Permission[]): Knex.QueryBuilder;
+export type DBQueryOptions = {
+    table: string;
+    fieldNodes: (FieldNode | FunctionFieldNode)[];
+    o2mNodes: O2MNode[];
+    query: Query;
+    cases: Filter[];
+    permissions: Permission[];
+    permissionsOnly?: boolean;
+};
+export declare function getDBQuery({ table, fieldNodes, o2mNodes, query, cases, permissions, permissionsOnly }: DBQueryOptions, { knex, schema }: Context): Knex.QueryBuilder;

package/dist/database/run-ast/lib/get-db-query.js

@@ -9,10 +9,10 @@ import { getColumnPreprocessor } from '../utils/get-column-pre-processor.js';
 import { getNodeAlias } from '../utils/get-field-alias.js';
 import { getInnerQueryColumnPreProcessor } from '../utils/get-inner-query-column-pre-processor.js';
 import { withPreprocessBindings } from '../utils/with-preprocess-bindings.js';
-export function getDBQuery(schema, knex, table, fieldNodes, o2mNodes, query, cases, permissions) {
+export function getDBQuery({ table, fieldNodes, o2mNodes, query, cases, permissions, permissionsOnly }, { knex, schema }) {
     const aliasMap = Object.create(null);
     const env = useEnv();
-    const preProcess = getColumnPreprocessor(knex, schema, table, cases, permissions, aliasMap);
+    const preProcess = getColumnPreprocessor(knex, schema, table, cases, permissions, aliasMap, permissionsOnly);
     const queryCopy = cloneDeep(query);
     const helpers = getHelpers(knex);
     const hasCaseWhen = o2mNodes.some((node) => node.whenCase && node.whenCase.length > 0) ||

package/dist/database/run-ast/modules/fetch-permitted-ast-root-fields.d.ts

@@ -0,0 +1,15 @@
+import type { Accountability, PermissionsAction, SchemaOverview } from '@directus/types';
+import type { Knex } from 'knex';
+import type { AST } from '../../../types/ast.js';
+type FetchPermittedAstRootFieldsOptions = {
+    schema: SchemaOverview;
+    accountability: Accountability;
+    knex: Knex;
+    action: PermissionsAction;
+};
+/**
+ * Fetch the permitted top level fields of a given root type AST using a case/when query that is constructed the
+ * same way as `runAst` but only returns flags (1/null) instead of actual field values.
+ */
+export declare function fetchPermittedAstRootFields(originalAST: AST, { schema, accountability, knex, action }: FetchPermittedAstRootFieldsOptions): Promise<any>;
+export {};

package/dist/database/run-ast/modules/fetch-permitted-ast-root-fields.js

@@ -0,0 +1,29 @@
+import { cloneDeep } from 'lodash-es';
+import { fetchPermissions } from '../../../permissions/lib/fetch-permissions.js';
+import { fetchPolicies } from '../../../permissions/lib/fetch-policies.js';
+import { getDBQuery } from '../lib/get-db-query.js';
+import { parseCurrentLevel } from '../lib/parse-current-level.js';
+/**
+ * Fetch the permitted top level fields of a given root type AST using a case/when query that is constructed the
+ * same way as `runAst` but only returns flags (1/null) instead of actual field values.
+ */
+export async function fetchPermittedAstRootFields(originalAST, { schema, accountability, knex, action }) {
+    const ast = cloneDeep(originalAST);
+    const { name: collection, children, cases, query } = ast;
+    // Retrieve the database columns to select in the current AST
+    const { fieldNodes } = await parseCurrentLevel(schema, collection, children, query);
+    let permissions = [];
+    if (accountability && !accountability.admin) {
+        const policies = await fetchPolicies(accountability, { schema, knex });
+        permissions = await fetchPermissions({ action, accountability, policies }, { schema, knex });
+    }
+    return getDBQuery({
+        table: collection,
+        fieldNodes,
+        o2mNodes: [],
+        query,
+        cases,
+        permissions,
+        permissionsOnly: true,
+    }, { schema, knex });
+}

package/dist/database/run-ast/run-ast.js

@@ -36,7 +36,14 @@ export async function runAst(originalAST, schema, accountability, options) {
             permissions = await fetchPermissions({ action: 'read', accountability, policies }, { schema, knex });
         }
         // The actual knex query builder instance. This is a promise that resolves with the raw items from the db
-        const dbQuery = getDBQuery(schema, knex, collection, fieldNodes, o2mNodes, query, cases, permissions);
+        const dbQuery = getDBQuery({
+            table: collection,
+            fieldNodes,
+            o2mNodes,
+            query,
+            cases,
+            permissions,
+        }, { schema, knex });
         const rawItems = await dbQuery;
         if (!rawItems)
             return null;

package/dist/database/run-ast/utils/get-column-pre-processor.d.ts

@@ -6,5 +6,5 @@ interface NodePreProcessOptions {
     /** Don't assign an alias to the column but instead return the column as is */
     noAlias?: boolean;
 }
-export declare function getColumnPreprocessor(knex: Knex, schema: SchemaOverview, table: string, cases: Filter[], permissions: Permission[], aliasMap: AliasMap): (fieldNode: FieldNode | FunctionFieldNode | M2ONode, options?: NodePreProcessOptions) => Knex.Raw<string>;
+export declare function getColumnPreprocessor(knex: Knex, schema: SchemaOverview, table: string, cases: Filter[], permissions: Permission[], aliasMap: AliasMap, permissionsOnly?: boolean): (fieldNode: FieldNode | FunctionFieldNode | M2ONode, options?: NodePreProcessOptions) => Knex.Raw<string>;
 export {};

package/dist/database/run-ast/utils/get-column-pre-processor.js

@@ -4,7 +4,7 @@ import { parseFilterKey } from '../../../utils/parse-filter-key.js';
 import { getHelpers } from '../../helpers/index.js';
 import { applyCaseWhen } from './apply-case-when.js';
 import { getNodeAlias } from './get-field-alias.js';
-export function getColumnPreprocessor(knex, schema, table, cases, permissions, aliasMap) {
+export function getColumnPreprocessor(knex, schema, table, cases, permissions, aliasMap, permissionsOnly) {
     const helpers = getHelpers(knex);
     return function (fieldNode, options) {
         // Don't assign an alias to the column expression if the field has a whenCase
@@ -22,7 +22,15 @@ export function getColumnPreprocessor(knex, schema, table, cases, permissions, a
             field = schema.collections[fieldNode.relation.collection].fields[fieldNode.relation.field];
         }
         let column;
-        if (field?.type?.startsWith('geometry')) {
+        if (permissionsOnly) {
+            if (noAlias) {
+                column = knex.raw(1);
+            }
+            else {
+                column = knex.raw('1 as ??', [alias]);
+            }
+        }
+        else if (field?.type?.startsWith('geometry')) {
             column = helpers.st.asText(table, field.field, rawColumnAlias);
         }
         else if (fieldNode.type === 'functionField') {

package/dist/permissions/modules/validate-access/lib/validate-item-access.d.ts

@@ -5,5 +5,6 @@ export interface ValidateItemAccessOptions {
     action: PermissionsAction;
     collection: string;
     primaryKeys: PrimaryKey[];
+    fields?: string[];
 }
-export declare function validateItemAccess(options: ValidateItemAccessOptions, context: Context): Promise<boolean>;
+export declare function validateItemAccess(options: ValidateItemAccessOptions, context: Context): Promise<any>;

package/dist/permissions/modules/validate-access/lib/validate-item-access.js

@@ -1,5 +1,4 @@
-import { getAstFromQuery } from '../../../../database/get-ast-from-query/get-ast-from-query.js';
-import { runAst } from '../../../../database/run-ast/run-ast.js';
+import { fetchPermittedAstRootFields } from '../../../../database/run-ast/modules/fetch-permitted-ast-root-fields.js';
 import { processAst } from '../../process-ast/process-ast.js';
 export async function validateItemAccess(options, context) {
     const primaryKeyField = context.schema.collections[options.collection]?.primary;
@@ -8,17 +7,14 @@ export async function validateItemAccess(options, context) {
     }
     // When we're looking up access to specific items, we have to read them from the database to
     // make sure you are allowed to access them.
-    const query = {
-        // We don't actually need any of the field data, just want to know if we can read the item as
-        // whole or not
-        fields: [],
-        limit: options.primaryKeys.length,
+    const ast = {
+        type: 'root',
+        name: options.collection,
+        query: { limit: options.primaryKeys.length },
+        // Act as if every field was a "normal" field
+        children: options.fields?.map((field) => ({ type: 'field', name: field, fieldKey: field, whenCase: [] })) ?? [],
+        cases: [],
     };
-    const ast = await getAstFromQuery({
-        accountability: options.accountability,
-        query,
-        collection: options.collection,
-    }, context);
     await processAst({ ast, ...options }, context);
     // Inject the filter after the permissions have been processed, as to not require access to the primary key
     ast.query.filter = {
@@ -26,8 +22,17 @@ export async function validateItemAccess(options, context) {
             _in: options.primaryKeys,
         },
     };
-    const items = await runAst(ast, context.schema, options.accountability, { knex: context.knex });
+    const items = await fetchPermittedAstRootFields(ast, {
+        schema: context.schema,
+        accountability: options.accountability,
+        knex: context.knex,
+        action: options.action,
+    });
     if (items && items.length === options.primaryKeys.length) {
+        const { fields } = options;
+        if (fields) {
+            return items.every((item) => fields.every((field) => item[field] === 1));
+        }
         return true;
     }
     return false;

package/dist/permissions/modules/validate-access/validate-access.d.ts

@@ -5,6 +5,7 @@ export interface ValidateAccessOptions {
     action: PermissionsAction;
     collection: string;
     primaryKeys?: PrimaryKey[];
+    fields?: string[];
 }
 /**
  * Validate if the current user has access to perform action against the given collection and