@directus/api 25.0.1 → 26.0.0

package/dist/websocket/handlers/items.js

@@ -35,7 +35,7 @@ export class ItemsHandler {
         const metaService = new MetaService({ schema, accountability });
         let result, meta;
         if (message.action === 'create') {
-            const query = sanitizeQuery(message?.query ?? {}, accountability);
+            const query = await sanitizeQuery(message?.query ?? {}, schema, accountability);
             if (Array.isArray(message.data)) {
                 const keys = await service.createMany(message.data);
                 result = await service.readMany(keys, query);
@@ -46,7 +46,7 @@ export class ItemsHandler {
             }
         }
         if (message.action === 'read') {
-            const query = sanitizeQuery(message.query ?? {}, accountability);
+            const query = await sanitizeQuery(message.query ?? {}, schema, accountability);
             if (message.id) {
                 result = await service.readOne(message.id, query);
             }
@@ -62,7 +62,7 @@ export class ItemsHandler {
             meta = await metaService.getMetaForQuery(message.collection, query);
         }
         if (message.action === 'update') {
-            const query = sanitizeQuery(message.query ?? {}, accountability);
+            const query = await sanitizeQuery(message.query ?? {}, schema, accountability);
             if (message.id) {
                 const key = await service.updateOne(message.id, message.data);
                 result = await service.readOne(key);
@@ -92,7 +92,7 @@ export class ItemsHandler {
                 result = message.ids;
             }
             else if (message.query) {
-                const query = sanitizeQuery(message.query, accountability);
+                const query = await sanitizeQuery(message.query, schema, accountability);
                 result = await service.deleteByQuery(query);
             }
             else {

package/dist/websocket/handlers/subscribe.js

@@ -140,8 +140,8 @@ export class SubscribeHandler {
                 if ('event' in message) {
                     subscription.event = message.event;
                 }
-                if ('query' in message) {
-                    subscription.query = sanitizeQuery(message.query, accountability);
+                if (message.query) {
+                    subscription.query = await sanitizeQuery(message.query, schema, accountability);
                 }
                 if ('item' in message)
                     subscription.item = String(message.item);

package/dist/websocket/messages.d.ts

@@ -150,7 +150,7 @@ export declare const WebSocketSubscribeMessage: z.ZodDiscriminatedUnion<"type",
     collection: z.ZodString;
     event: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"create">, z.ZodLiteral<"update">, z.ZodLiteral<"delete">]>>;
     item: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber]>>;
-    query: z.ZodOptional<z.ZodType<Query, z.ZodTypeDef, Query>>;
+    query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
 }>, "passthrough", z.ZodTypeAny, z.objectOutputType<z.objectUtil.extendShape<{
     type: z.ZodString;
     uid: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber]>>;
@@ -159,7 +159,7 @@ export declare const WebSocketSubscribeMessage: z.ZodDiscriminatedUnion<"type",
     collection: z.ZodString;
     event: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"create">, z.ZodLiteral<"update">, z.ZodLiteral<"delete">]>>;
     item: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber]>>;
-    query: z.ZodOptional<z.ZodType<Query, z.ZodTypeDef, Query>>;
+    query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
 }>, z.ZodTypeAny, "passthrough">, z.objectInputType<z.objectUtil.extendShape<{
     type: z.ZodString;
     uid: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber]>>;
@@ -168,7 +168,7 @@ export declare const WebSocketSubscribeMessage: z.ZodDiscriminatedUnion<"type",
     collection: z.ZodString;
     event: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"create">, z.ZodLiteral<"update">, z.ZodLiteral<"delete">]>>;
     item: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber]>>;
-    query: z.ZodOptional<z.ZodType<Query, z.ZodTypeDef, Query>>;
+    query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
 }>, z.ZodTypeAny, "passthrough">>, z.ZodObject<z.objectUtil.extendShape<{
     type: z.ZodString;
     uid: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber]>>;
@@ -336,13 +336,13 @@ export declare const WebSocketEvent: z.ZodDiscriminatedUnion<"action", [z.ZodObj
     keys: z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodNumber]>, "many">;
 }, "strip", z.ZodTypeAny, {
     collection: string;
-    action: "update";
     keys: (string | number)[];
+    action: "update";
     payload?: Record<string, any> | undefined;
 }, {
     collection: string;
-    action: "update";
     keys: (string | number)[];
+    action: "update";
     payload?: Record<string, any> | undefined;
 }>, z.ZodObject<{
     action: z.ZodLiteral<"delete">;
@@ -351,13 +351,13 @@ export declare const WebSocketEvent: z.ZodDiscriminatedUnion<"action", [z.ZodObj
     keys: z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodNumber]>, "many">;
 }, "strip", z.ZodTypeAny, {
     collection: string;
-    action: "delete";
     keys: (string | number)[];
+    action: "delete";
     payload?: Record<string, any> | undefined;
 }, {
     collection: string;
-    action: "delete";
     keys: (string | number)[];
+    action: "delete";
     payload?: Record<string, any> | undefined;
 }>]>;
 export type WebSocketEvent = z.infer<typeof WebSocketEvent>;

package/dist/websocket/messages.js

@@ -35,7 +35,7 @@ export const WebSocketSubscribeMessage = z.discriminatedUnion('type', [
         collection: z.string(),
         event: z.union([z.literal('create'), z.literal('update'), z.literal('delete')]).optional(),
         item: zodStringOrNumber.optional(),
-        query: z.custom().optional(),
+        query: z.record(z.any()).optional(),
     }),
     WebSocketMessage.extend({
         type: z.literal('unsubscribe'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "25.0.1",
+  "version": "26.0.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "keywords": [
     "directus",
@@ -59,17 +59,17 @@
   ],
   "dependencies": {
     "@authenio/samlify-node-xmllint": "2.0.0",
-    "@aws-sdk/client-ses": "3.723.0",
+    "@aws-sdk/client-ses": "3.758.0",
     "@godaddy/terminus": "4.12.1",
     "@rollup/plugin-alias": "5.1.1",
     "@rollup/plugin-node-resolve": "15.3.1",
     "@rollup/plugin-virtual": "3.0.2",
-    "@tus/server": "1.10.0",
-    "@tus/utils": "0.5.0",
+    "@tus/server": "1.10.2",
+    "@tus/utils": "0.5.1",
     "argon2": "0.41.1",
     "async": "3.2.6",
     "async-mutex": "0.5.0",
-    "axios": "1.7.9",
+    "axios": "1.8.1",
     "busboy": "1.6.0",
     "bytes": "3.1.2",
     "camelcase": "8.0.0",
@@ -88,18 +88,18 @@
     "encodeurl": "2.0.0",
     "eventemitter2": "6.4.9",
     "execa": "8.0.1",
-    "exif-reader": "2.0.1",
+    "exif-reader": "2.0.2",
     "express": "4.21.2",
     "flat": "6.0.1",
-    "fs-extra": "11.2.0",
+    "fs-extra": "11.3.0",
     "glob-to-regexp": "0.4.1",
     "graphql": "16.10.0",
-    "graphql-compose": "9.0.11",
-    "graphql-ws": "5.16.1",
+    "graphql-compose": "9.1.0",
+    "graphql-ws": "5.16.2",
     "helmet": "8.0.0",
     "icc": "3.0.0",
-    "inquirer": "12.3.0",
-    "ioredis": "5.4.2",
+    "inquirer": "12.4.2",
+    "ioredis": "5.5.0",
     "ip-matching": "2.1.2",
     "isolated-vm": "5.0.3",
     "joi": "17.13.3",
@@ -107,72 +107,72 @@
     "js2xmlparser": "5.0.0",
     "json2csv": "5.0.7",
     "jsonwebtoken": "9.0.2",
-    "keyv": "5.2.3",
+    "keyv": "5.3.0",
     "knex": "3.1.0",
     "ldapjs": "2.3.3",
-    "liquidjs": "10.20.1",
+    "liquidjs": "10.21.0",
     "lodash-es": "4.17.21",
-    "marked": "15.0.6",
+    "marked": "15.0.7",
     "micromustache": "8.0.3",
     "mime-types": "2.1.35",
     "minimatch": "10.0.1",
-    "mnemonist": "0.39.8",
+    "mnemonist": "0.40.3",
     "ms": "2.1.3",
-    "nanoid": "5.0.9",
+    "nanoid": "5.1.2",
     "node-machine-id": "1.1.12",
     "node-schedule": "2.1.1",
-    "nodemailer": "6.9.16",
+    "nodemailer": "6.10.0",
     "object-hash": "3.0.0",
     "openapi3-ts": "4.4.0",
     "openid-client": "5.7.1",
-    "ora": "8.1.1",
+    "ora": "8.2.0",
     "otplib": "12.0.1",
     "p-limit": "6.2.0",
-    "p-queue": "8.0.1",
-    "papaparse": "5.4.1",
+    "p-queue": "8.1.0",
+    "papaparse": "5.5.2",
     "pino": "9.6.0",
-    "pino-http": "10.3.0",
+    "pino-http": "10.4.0",
     "pino-http-print": "3.1.0",
     "pino-pretty": "13.0.0",
     "pm2": "5.4.3",
     "prom-client": "15.1.3",
-    "qs": "6.13.1",
-    "rate-limiter-flexible": "5.0.4",
-    "rollup": "4.30.1",
+    "qs": "6.14.0",
+    "rate-limiter-flexible": "5.0.5",
+    "rollup": "4.34.9",
     "samlify": "2.8.10",
     "sanitize-html": "2.14.0",
     "sharp": "0.33.5",
     "snappy": "7.2.2",
     "stream-json": "1.9.1",
     "tar": "7.4.3",
-    "tsx": "4.19.2",
+    "tsx": "4.19.3",
     "wellknown": "0.5.0",
-    "ws": "8.18.0",
-    "zod": "3.24.1",
+    "ws": "8.18.1",
+    "zod": "3.24.2",
     "zod-validation-error": "3.4.0",
-    "@directus/env": "5.0.2",
-    "@directus/constants": "13.0.0",
-    "@directus/errors": "2.0.0",
-    "@directus/app": "13.7.1",
-    "@directus/extensions-sdk": "13.0.3",
-    "@directus/extensions": "3.0.3",
-    "@directus/format-title": "12.0.0",
-    "@directus/extensions-registry": "3.0.3",
-    "@directus/pressure": "3.0.2",
-    "@directus/memory": "3.0.2",
-    "@directus/schema": "13.0.0",
-    "@directus/specs": "11.1.0",
+    "@directus/app": "13.8.0",
+    "@directus/constants": "13.0.1",
+    "@directus/errors": "2.0.1",
+    "@directus/env": "5.0.3",
+    "@directus/extensions": "3.0.4",
+    "@directus/extensions-sdk": "13.0.4",
+    "@directus/format-title": "12.0.1",
+    "@directus/memory": "3.0.3",
+    "@directus/pressure": "3.0.3",
+    "@directus/extensions-registry": "3.0.4",
     "@directus/storage": "12.0.0",
-    "@directus/storage-driver-azure": "12.0.2",
-    "@directus/storage-driver-cloudinary": "12.0.2",
-    "@directus/storage-driver-gcs": "12.0.2",
-    "@directus/storage-driver-s3": "12.0.2",
-    "@directus/storage-driver-supabase": "3.0.2",
-    "@directus/system-data": "3.0.1",
-    "@directus/utils": "13.0.2",
-    "@directus/validation": "2.0.2",
-    "directus": "11.5.1",
-    "@directus/storage-driver-local": "12.0.0"
+    "@directus/storage-driver-azure": "12.0.3",
+    "@directus/schema": "13.0.1",
+    "@directus/specs": "11.1.0",
+    "@directus/storage-driver-cloudinary": "12.0.3",
+    "@directus/storage-driver-local": "12.0.0",
+    "@directus/storage-driver-s3": "12.0.3",
+    "@directus/storage-driver-gcs": "12.0.3",
+    "@directus/storage-driver-supabase": "3.0.3",
+    "@directus/utils": "13.0.3",
+    "@directus/system-data": "3.1.0",
+    "@directus/validation": "2.0.3",
+    "directus": "11.6.0"
   },
   "devDependencies": {
     "@directus/tsconfig": "3.0.0",
@@ -193,37 +193,37 @@
     "@types/inquirer": "9.0.7",
     "@types/js-yaml": "4.0.9",
     "@types/json2csv": "5.0.7",
-    "@types/jsonwebtoken": "9.0.7",
+    "@types/jsonwebtoken": "9.0.9",
     "@types/ldapjs": "2.2.5",
     "@types/lodash-es": "4.17.12",
     "@types/mime-types": "2.1.4",
     "@types/ms": "2.1.0",
-    "@types/node": "22.10.5",
+    "@types/node": "22.13.8",
     "@types/node-schedule": "2.1.7",
     "@types/nodemailer": "6.4.17",
     "@types/object-hash": "3.0.6",
     "@types/papaparse": "5.3.15",
-    "@types/qs": "6.9.17",
+    "@types/qs": "6.9.18",
     "@types/sanitize-html": "2.13.0",
     "@types/stream-json": "1.7.8",
     "@types/wellknown": "0.5.8",
-    "@types/ws": "8.5.13",
-    "@vitest/coverage-v8": "2.1.8",
+    "@types/ws": "8.5.14",
+    "@vitest/coverage-v8": "2.1.9",
     "copyfiles": "2.4.1",
-    "form-data": "4.0.1",
+    "form-data": "4.0.2",
     "get-port": "7.1.0",
     "knex-mock-client": "3.0.2",
-    "typescript": "5.7.3",
+    "typescript": "5.8.2",
     "vitest": "2.1.9",
-    "@directus/random": "2.0.0",
-    "@directus/types": "13.0.0"
+    "@directus/random": "2.0.1",
+    "@directus/types": "13.1.0"
   },
   "optionalDependencies": {
     "@keyv/redis": "3.0.1",
     "mysql2": "3.12.0",
     "nodemailer-mailgun-transport": "2.1.5",
-    "oracledb": "6.7.1",
-    "pg": "8.13.1",
+    "oracledb": "6.8.0",
+    "pg": "8.13.3",
     "sqlite3": "5.1.7",
     "tedious": "18.6.1"
   },

package/dist/permissions/utils/fetch-dynamic-variable-context.d.ts

@@ -1,8 +0,0 @@
-import type { Accountability, Permission } from '@directus/types';
-import type { Context } from '../types.js';
-export interface FetchDynamicVariableContext {
-    accountability: Pick<Accountability, 'user' | 'role' | 'roles'>;
-    policies: string[];
-    permissions: Permission[];
-}
-export declare function fetchDynamicVariableContext(options: FetchDynamicVariableContext, context: Context): Promise<Record<string, any>>;