@directus/api 24.0.1 → 25.0.0

package/dist/utils/apply-query.js

@@ -33,9 +33,6 @@ export default function applyQuery(knex, collection, dbQuery, query, schema, cas
             hasJoins = sortResult.hasJoins;
         }
     }
-    if (query.search) {
-        applySearch(knex, schema, dbQuery, query.search, collection);
-    }
     // `cases` are the permissions cases that are required for the current data set. We're
     // dynamically adding those into the filters that the user provided to enforce the permission
     // rules. You should be able to read an item if one or more of the cases matches. The actual case
@@ -81,6 +78,9 @@ export default function applyQuery(knex, collection, dbQuery, query, schema, cas
         }
         dbQuery.groupBy(columns);
     }
+    if (query.search) {
+        applySearch(knex, schema, dbQuery, query.search, collection, aliasMap, permissions);
+    }
     if (query.aggregate) {
         applyAggregate(schema, dbQuery, query.aggregate, collection, hasJoins);
     }
@@ -608,35 +608,72 @@ export function applyFilter(knex, schema, rootQuery, rootFilter, collection, ali
         }
     }
 }
-export function applySearch(knex, schema, dbQuery, searchQuery, collection) {
+export function applySearch(knex, schema, dbQuery, searchQuery, collection, aliasMap, permissions) {
     const { number: numberHelper } = getHelpers(knex);
-    const fields = Object.entries(schema.collections[collection].fields);
-    dbQuery.andWhere(function () {
+    const allowedFields = new Set(permissions.filter((p) => p.collection === collection).flatMap((p) => p.fields ?? []));
+    let fields = Object.entries(schema.collections[collection].fields);
+    const { cases, caseMap } = getCases(collection, permissions, []);
+    // Add field restrictions if non-admin and "everything" is not allowed
+    if (cases.length !== 0 && !allowedFields.has('*')) {
+        fields = fields.filter((field) => allowedFields.has(field[0]));
+    }
+    dbQuery.andWhere(function (queryBuilder) {
         let needsFallbackCondition = true;
         fields.forEach(([name, field]) => {
-            if (['text', 'string'].includes(field.type)) {
-                this.orWhereRaw(`LOWER(??) LIKE ?`, [`${collection}.${name}`, `%${searchQuery.toLowerCase()}%`]);
+            const whenCases = (caseMap[name] ?? []).map((caseIndex) => cases[caseIndex]);
+            const fieldType = getFieldType(field);
+            if (fieldType !== null) {
                 needsFallbackCondition = false;
             }
-            else if (isNumericField(field)) {
-                const number = parseNumericString(searchQuery);
-                if (number === null) {
-                    return; // unable to parse
-                }
-                if (numberHelper.isNumberValid(number, field)) {
-                    numberHelper.addSearchCondition(this, collection, name, number);
-                    needsFallbackCondition = false;
-                }
+            else {
+                return;
             }
-            else if (field.type === 'uuid' && isValidUuid(searchQuery)) {
-                this.orWhere({ [`${collection}.${name}`]: searchQuery });
-                needsFallbackCondition = false;
+            if (cases.length !== 0 && whenCases?.length !== 0) {
+                queryBuilder.orWhere((subQuery) => {
+                    addSearchCondition(subQuery, name, fieldType, 'and');
+                    applyFilter(knex, schema, subQuery, { _or: whenCases }, collection, aliasMap, cases, permissions);
+                });
+            }
+            else {
+                addSearchCondition(queryBuilder, name, fieldType, 'or');
             }
         });
         if (needsFallbackCondition) {
-            this.orWhereRaw('1 = 0');
+            queryBuilder.orWhereRaw('1 = 0');
         }
     });
+    function addSearchCondition(queryBuilder, name, fieldType, logical) {
+        if (fieldType === null) {
+            return;
+        }
+        if (fieldType === 'string') {
+            queryBuilder[logical].whereRaw(`LOWER(??) LIKE ?`, [`${collection}.${name}`, `%${searchQuery.toLowerCase()}%`]);
+        }
+        else if (fieldType === 'numeric') {
+            numberHelper.addSearchCondition(queryBuilder, collection, name, parseNumericString(searchQuery), logical);
+        }
+        else if (fieldType === 'uuid') {
+            queryBuilder[logical].where({ [`${collection}.${name}`]: searchQuery });
+        }
+    }
+    function getFieldType(field) {
+        if (['text', 'string'].includes(field.type)) {
+            return 'string';
+        }
+        if (isNumericField(field)) {
+            const number = parseNumericString(searchQuery);
+            if (number === null) {
+                return null;
+            }
+            if (numberHelper.isNumberValid(number, field)) {
+                return 'numeric';
+            }
+        }
+        if (field.type === 'uuid' && isValidUuid(searchQuery)) {
+            return 'uuid';
+        }
+        return null;
+    }
 }
 export function applyAggregate(schema, dbQuery, aggregate, collection, hasJoins) {
     for (const [operation, fields] of Object.entries(aggregate)) {

package/dist/utils/freeze-schema.d.ts

@@ -0,0 +1,3 @@
+import type { SchemaOverview } from '@directus/types';
+export declare function freezeSchema(schema: SchemaOverview): Readonly<SchemaOverview>;
+export declare function unfreezeSchema(schema: Readonly<SchemaOverview>): SchemaOverview;

package/dist/utils/freeze-schema.js

@@ -0,0 +1,31 @@
+import { cloneDeep } from 'lodash-es';
+export function freezeSchema(schema) {
+    // freeze collections
+    for (const collectionName of Object.keys(schema.collections)) {
+        if (!schema.collections[collectionName])
+            continue;
+        for (const fieldName of Object.keys(schema.collections[collectionName].fields)) {
+            Object.freeze(schema.collections[collectionName].fields[fieldName]);
+        }
+        Object.freeze(schema.collections[collectionName]);
+    }
+    Object.freeze(schema.collections);
+    // freeze relations
+    for (const relation of schema.relations) {
+        if (relation.schema)
+            Object.freeze(relation.schema);
+        if (relation.meta)
+            Object.freeze(relation.meta);
+        Object.freeze(relation);
+    }
+    Object.freeze(schema.relations);
+    return Object.freeze(schema);
+}
+export function unfreezeSchema(schema) {
+    if (Object.isFrozen(schema)) {
+        return cloneDeep(schema);
+    }
+    else {
+        return schema;
+    }
+}

package/dist/utils/get-accountability-for-token.js

@@ -18,6 +18,7 @@ export async function getAccountabilityForToken(token, accountability) {
             const payload = verifyAccessJWT(token, getSecret());
             if ('session' in payload) {
                 await verifySessionJWT(payload);
+                accountability.session = payload.session;
             }
             if (payload.share)
                 accountability.share = payload.share;

package/dist/utils/get-milliseconds.js

@@ -1,4 +1,4 @@
-import ms from 'ms';
+import ms, {} from 'ms';
 /**
  * Safely parse human readable time format into milliseconds
  */

package/dist/utils/get-schema.js

@@ -4,7 +4,7 @@ import { systemCollectionRows } from '@directus/system-data';
 import { parseJSON, toArray } from '@directus/utils';
 import { mapValues } from 'lodash-es';
 import { useBus } from '../bus/index.js';
-import { getLocalSchemaCache, setLocalSchemaCache } from '../cache.js';
+import { getMemorySchemaCache, setMemorySchemaCache } from '../cache.js';
 import { ALIAS_TYPES } from '../constants.js';
 import getDatabase from '../database/index.js';
 import { useLock } from '../lock/index.js';
@@ -22,7 +22,7 @@ export async function getSchema(options, attempt = 0) {
         const schemaInspector = createInspector(database);
         return await getDatabaseSchema(database, schemaInspector);
     }
-    const cached = await getLocalSchemaCache();
+    const cached = getMemorySchemaCache();
     if (cached) {
         return cached;
     }
@@ -48,8 +48,13 @@ export async function getSchema(options, attempt = 0) {
                 if (options.schema === null) {
                     return reject();
                 }
-                setLocalSchemaCache(options.schema).catch(reject);
-                resolve(options.schema);
+                try {
+                    setMemorySchemaCache(options.schema);
+                    resolve(options.schema);
+                }
+                catch (e) {
+                    reject(e);
+                }
             }
             function cleanup() {
                 bus.unsubscribe(messageKey, busListener).catch(reject);
@@ -62,7 +67,7 @@ export async function getSchema(options, attempt = 0) {
         const database = options?.database || getDatabase();
         const schemaInspector = createInspector(database);
         schema = await getDatabaseSchema(database, schemaInspector);
-        await setLocalSchemaCache(schema);
+        setMemorySchemaCache(schema);
         return schema;
     }
     finally {

package/dist/utils/permissions-cachable.d.ts

@@ -0,0 +1,8 @@
+import type { Accountability, Filter } from '@directus/types';
+import type { Context } from '../permissions/types.js';
+/**
+ * Check if the read permissions for a collection contain the dynamic variable $NOW.
+ * If they do, the permissions are not cachable.
+ */
+export declare function permissionsCachable(collection: string | undefined, context: Context, accountability?: Accountability): Promise<boolean>;
+export declare function filter_has_now(filter: Filter): boolean;

package/dist/utils/permissions-cachable.js

@@ -0,0 +1,38 @@
+import { fetchPermissions } from '../permissions/lib/fetch-permissions.js';
+import { fetchPolicies } from '../permissions/lib/fetch-policies.js';
+import { createDefaultAccountability } from '../permissions/utils/create-default-accountability.js';
+/**
+ * Check if the read permissions for a collection contain the dynamic variable $NOW.
+ * If they do, the permissions are not cachable.
+ */
+export async function permissionsCachable(collection, context, accountability) {
+    if (!collection) {
+        return true;
+    }
+    if (!accountability) {
+        accountability = createDefaultAccountability();
+    }
+    const policies = await fetchPolicies(accountability, context);
+    const permissions = await fetchPermissions({ action: 'read', policies, collections: [collection], accountability, bypassDynamicVariableProcessing: true }, context);
+    const has_now = permissions.some((permission) => {
+        if (!permission.permissions) {
+            return false;
+        }
+        return filter_has_now(permission.permissions);
+    });
+    return !has_now;
+}
+export function filter_has_now(filter) {
+    return Object.entries(filter).some(([key, value]) => {
+        if (key === '_and' || key === '_or') {
+            return value.some((sub_filter) => filter_has_now(sub_filter));
+        }
+        else if (typeof value === 'object') {
+            return filter_has_now(value);
+        }
+        else if (typeof value === 'string') {
+            return value.startsWith('$NOW');
+        }
+        return false;
+    });
+}

package/dist/utils/sanitize-schema.d.ts

@@ -16,7 +16,7 @@ export declare function sanitizeCollection(collection: Collection | undefined):
  * @returns sanitized field
  */
 export declare function sanitizeField(field: Field | undefined, sanitizeAllSchema?: boolean): Partial<Field> | undefined;
-export declare function sanitizeColumn(column: Column): Pick<Column, "table" | "name" | "data_type" | "default_value" | "max_length" | "numeric_precision" | "numeric_scale" | "is_nullable" | "is_unique" | "is_indexed" | "is_primary_key" | "is_generated" | "generation_expression" | "has_auto_increment" | "foreign_key_table" | "foreign_key_column">;
+export declare function sanitizeColumn(column: Column): Pick<Column, "table" | "foreign_key_table" | "foreign_key_column" | "name" | "data_type" | "default_value" | "max_length" | "numeric_precision" | "numeric_scale" | "is_nullable" | "is_unique" | "is_indexed" | "is_primary_key" | "is_generated" | "generation_expression" | "has_auto_increment">;
 /**
  * Pick certain database vendor specific relation properties that should be compared when performing diff
  *

package/dist/websocket/messages.d.ts

@@ -247,16 +247,16 @@ export declare const WebSocketItemsMessage: z.ZodUnion<[z.ZodObject<z.objectUtil
     collection: string;
     type: "items";
     action: "read";
-    query?: Query | undefined;
     id?: string | number | undefined;
+    query?: Query | undefined;
     uid?: string | number | undefined;
     ids?: (string | number)[] | undefined;
 }, {
     collection: string;
     type: "items";
     action: "read";
-    query?: Query | undefined;
     id?: string | number | undefined;
+    query?: Query | undefined;
     uid?: string | number | undefined;
     ids?: (string | number)[] | undefined;
 }>, z.ZodObject<z.objectUtil.extendShape<{
@@ -274,8 +274,8 @@ export declare const WebSocketItemsMessage: z.ZodUnion<[z.ZodObject<z.objectUtil
     type: "items";
     action: "update";
     data: Partial<Item>;
-    query?: Query | undefined;
     id?: string | number | undefined;
+    query?: Query | undefined;
     uid?: string | number | undefined;
     ids?: (string | number)[] | undefined;
 }, {
@@ -283,8 +283,8 @@ export declare const WebSocketItemsMessage: z.ZodUnion<[z.ZodObject<z.objectUtil
     type: "items";
     action: "update";
     data: Partial<Item>;
-    query?: Query | undefined;
     id?: string | number | undefined;
+    query?: Query | undefined;
     uid?: string | number | undefined;
     ids?: (string | number)[] | undefined;
 }>, z.ZodObject<z.objectUtil.extendShape<{
@@ -300,16 +300,16 @@ export declare const WebSocketItemsMessage: z.ZodUnion<[z.ZodObject<z.objectUtil
     collection: string;
     type: "items";
     action: "delete";
-    query?: Query | undefined;
     id?: string | number | undefined;
+    query?: Query | undefined;
     uid?: string | number | undefined;
     ids?: (string | number)[] | undefined;
 }, {
     collection: string;
     type: "items";
     action: "delete";
-    query?: Query | undefined;
     id?: string | number | undefined;
+    query?: Query | undefined;
     uid?: string | number | undefined;
     ids?: (string | number)[] | undefined;
 }>]>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "24.0.1",
+  "version": "25.0.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "keywords": [
     "directus",
@@ -68,6 +68,7 @@
     "@tus/utils": "0.5.0",
     "argon2": "0.41.1",
     "async": "3.2.6",
+    "async-mutex": "0.5.0",
     "axios": "1.7.9",
     "busboy": "1.6.0",
     "bytes": "3.1.2",
@@ -133,6 +134,8 @@
     "pino-http": "10.3.0",
     "pino-http-print": "3.1.0",
     "pino-pretty": "13.0.0",
+    "pm2": "5.4.3",
+    "prom-client": "15.1.3",
     "qs": "6.13.1",
     "rate-limiter-flexible": "5.0.4",
     "rollup": "4.30.1",
@@ -147,29 +150,29 @@
     "ws": "8.18.0",
     "zod": "3.24.1",
     "zod-validation-error": "3.4.0",
-    "@directus/app": "13.6.0",
     "@directus/constants": "13.0.0",
-    "@directus/env": "5.0.0",
+    "@directus/app": "13.7.0",
+    "@directus/env": "5.0.1",
     "@directus/errors": "2.0.0",
-    "@directus/extensions": "3.0.1",
-    "@directus/extensions-registry": "3.0.1",
-    "@directus/extensions-sdk": "13.0.1",
+    "@directus/extensions": "3.0.2",
+    "@directus/extensions-sdk": "13.0.2",
     "@directus/format-title": "12.0.0",
-    "@directus/memory": "3.0.0",
+    "@directus/memory": "3.0.1",
+    "@directus/pressure": "3.0.1",
+    "@directus/extensions-registry": "3.0.2",
+    "@directus/storage": "12.0.0",
     "@directus/schema": "13.0.0",
     "@directus/specs": "11.1.0",
-    "@directus/storage-driver-azure": "12.0.0",
-    "@directus/pressure": "3.0.0",
-    "@directus/storage": "12.0.0",
-    "@directus/storage-driver-cloudinary": "12.0.0",
+    "@directus/storage-driver-azure": "12.0.1",
+    "@directus/storage-driver-gcs": "12.0.1",
+    "@directus/storage-driver-cloudinary": "12.0.1",
     "@directus/storage-driver-local": "12.0.0",
-    "@directus/storage-driver-gcs": "12.0.0",
-    "@directus/storage-driver-s3": "12.0.0",
-    "@directus/storage-driver-supabase": "3.0.0",
-    "@directus/utils": "13.0.0",
+    "@directus/storage-driver-supabase": "3.0.1",
+    "@directus/storage-driver-s3": "12.0.1",
     "@directus/system-data": "3.0.0",
-    "@directus/validation": "2.0.0",
-    "directus": "11.4.1"
+    "@directus/utils": "13.0.1",
+    "@directus/validation": "2.0.1",
+    "directus": "11.5.0"
   },
   "devDependencies": {
     "@directus/tsconfig": "3.0.0",
@@ -194,7 +197,7 @@
     "@types/ldapjs": "2.2.5",
     "@types/lodash-es": "4.17.12",
     "@types/mime-types": "2.1.4",
-    "@types/ms": "0.7.34",
+    "@types/ms": "2.1.0",
     "@types/node": "22.10.5",
     "@types/node-schedule": "2.1.7",
     "@types/nodemailer": "6.4.17",
@@ -211,7 +214,7 @@
     "get-port": "7.1.0",
     "knex-mock-client": "3.0.2",
     "typescript": "5.7.3",
-    "vitest": "2.1.8",
+    "vitest": "2.1.9",
     "@directus/random": "2.0.0",
     "@directus/types": "13.0.0"
   },