@directus/api 27.0.1 → 27.1.0

package/dist/auth/drivers/openid.js

@@ -311,6 +311,7 @@ export function createOpenIDAuthRouter(providerName) {
         res.redirect(303, `./callback?${new URLSearchParams(req.body)}`);
     }, respond);
     router.get('/callback', asyncHandler(async (req, res, next) => {
+        const env = useEnv();
         const logger = useLogger();
         let tokenData;
         try {
@@ -318,7 +319,8 @@ export function createOpenIDAuthRouter(providerName) {
         }
         catch (e) {
             logger.warn(e, `[OpenID] Couldn't verify OpenID cookie`);
-            throw new InvalidCredentialsError();
+            const url = new Url(env['PUBLIC_URL']).addPath('admin', 'login');
+            return res.redirect(`${url.toString()}?reason=${ErrorCode.InvalidCredentials}`);
         }
         const { verifier, redirect, prompt } = tokenData;
         const accountability = createDefaultAccountability({ ip: getIPFromReq(req) });

package/dist/database/get-ast-from-query/lib/convert-wildcards.d.ts

@@ -1,9 +1,9 @@
 import type { Accountability, Query, SchemaOverview } from '@directus/types';
 import type { Knex } from 'knex';
 export interface ConvertWildcardsOptions {
-    parentCollection: string;
+    collection: string;
     fields: string[];
-    query: Query;
+    alias: Query['alias'];
     accountability: Accountability | null;
 }
 export interface ConvertWildCardsContext {

package/dist/database/get-ast-from-query/lib/convert-wildcards.js

@@ -1,13 +1,14 @@
 import { getRelation } from '@directus/utils';
 import { cloneDeep } from 'lodash-es';
 import { fetchAllowedFields } from '../../../permissions/modules/fetch-allowed-fields/fetch-allowed-fields.js';
+import { parseFilterKey } from '../../../utils/parse-filter-key.js';
 export async function convertWildcards(options, context) {
     const fields = cloneDeep(options.fields);
-    const fieldsInCollection = Object.entries(context.schema.collections[options.parentCollection].fields).map(([name]) => name);
+    const fieldsInCollection = Object.entries(context.schema.collections[options.collection].fields).map(([name]) => name);
     let allowedFields = fieldsInCollection;
     if (options.accountability && options.accountability.admin === false) {
         allowedFields = await fetchAllowedFields({
-            collection: options.parentCollection,
+            collection: options.collection,
             action: 'read',
             accountability: options.accountability,
         }, context);
@@ -22,7 +23,7 @@ export async function convertWildcards(options, context) {
         if (fieldKey.includes('*') === false)
             continue;
         if (fieldKey === '*') {
-            const aliases = Object.keys(options.query.alias ?? {});
+            const aliases = Object.keys(options.alias ?? {});
             // Set to all fields in collection
             if (allowedFields.includes('*')) {
                 fields.splice(index, 1, ...fieldsInCollection, ...aliases);
@@ -30,8 +31,8 @@ export async function convertWildcards(options, context) {
             else {
                 // Set to all allowed fields
                 const allowedAliases = aliases.filter((fieldKey) => {
-                    const name = options.query.alias[fieldKey];
-                    return allowedFields.includes(name);
+                    const { fieldName } = parseFilterKey(options.alias[fieldKey]);
+                    return allowedFields.includes(fieldName);
                 });
                 fields.splice(index, 1, ...allowedFields, ...allowedAliases);
             }
@@ -41,16 +42,15 @@ export async function convertWildcards(options, context) {
             const parts = fieldKey.split('.');
             const relationalFields = allowedFields.includes('*')
                 ? context.schema.relations
-                    .filter((relation) => relation.collection === options.parentCollection ||
-                    relation.related_collection === options.parentCollection)
+                    .filter((relation) => relation.collection === options.collection || relation.related_collection === options.collection)
                     .map((relation) => {
-                    const isMany = relation.collection === options.parentCollection;
+                    const isMany = relation.collection === options.collection;
                     return isMany ? relation.field : relation.meta?.one_field;
                 })
-                : allowedFields.filter((fieldKey) => !!getRelation(context.schema.relations, options.parentCollection, fieldKey));
+                : allowedFields.filter((fieldKey) => !!getRelation(context.schema.relations, options.collection, fieldKey));
             const nonRelationalFields = allowedFields.filter((fieldKey) => relationalFields.includes(fieldKey) === false);
-            const aliasFields = Object.keys(options.query.alias ?? {}).map((fieldKey) => {
-                const name = options.query.alias[fieldKey];
+            const aliasFields = Object.keys(options.alias ?? {}).map((fieldKey) => {
+                const name = options.alias[fieldKey];
                 if (relationalFields.includes(name)) {
                     return `${fieldKey}.${parts.slice(1).join('.')}`;
                 }

package/dist/database/get-ast-from-query/lib/parse-fields.js

@@ -14,8 +14,8 @@ export async function parseFields(options, context) {
         return [];
     fields = await convertWildcards({
         fields,
-        parentCollection: options.parentCollection,
-        query: options.query,
+        collection: options.parentCollection,
+        alias: options.query.alias,
         accountability: options.accountability,
     }, context);
     if (!fields || !Array.isArray(fields))

package/dist/extensions/manager.js

@@ -169,13 +169,25 @@ export class ExtensionManager {
      * Installs an external extension from registry
      */
     async install(versionId) {
+        const logger = useLogger();
         await this.installationManager.install(versionId);
         await this.reload({ forceSync: true });
+        emitter.emitAction('extensions.installed', {
+            extensions: this.extensions,
+            versionId,
+        });
+        logger.info(`Installed extension: ${versionId}`);
         await this.broadcastReloadNotification();
     }
     async uninstall(folder) {
+        const logger = useLogger();
         await this.installationManager.uninstall(folder);
         await this.reload({ forceSync: true });
+        emitter.emitAction('extensions.uninstalled', {
+            extensions: this.extensions,
+            folder,
+        });
+        logger.info(`Uninstalled extension: ${folder}`);
         await this.broadcastReloadNotification();
     }
     async broadcastReloadNotification() {
@@ -211,6 +223,10 @@ export class ExtensionManager {
             this.appExtensionsBundle = await this.generateExtensionBundle();
         }
         this.isLoaded = true;
+        emitter.emitAction('extensions.load', {
+            extensions: this.extensions,
+        });
+        logger.info('Extensions loaded');
     }
     /**
      * Unregister all extensions from the current process
@@ -220,6 +236,11 @@ export class ExtensionManager {
         this.localEmitter.offAll();
         this.appExtensionsBundle = null;
         this.isLoaded = false;
+        emitter.emitAction('extensions.unload', {
+            extensions: this.extensions,
+        });
+        const logger = useLogger();
+        logger.info('Extensions unloaded');
     }
     /**
      * Reload all the extensions. Will unload if extensions have already been loaded
@@ -247,6 +268,11 @@ export class ExtensionManager {
                 this.updateWatchedExtensions(added, removed);
                 const addedExtensions = added.map((extension) => extension.name);
                 const removedExtensions = removed.map((extension) => extension.name);
+                emitter.emitAction('extensions.reload', {
+                    extensions: this.extensions,
+                    added: addedExtensions,
+                    removed: removedExtensions,
+                });
                 if (addedExtensions.length > 0) {
                     logger.info(`Added extensions: ${addedExtensions.join(', ')}`);
                 }

package/dist/operations/condition/index.js

@@ -4,7 +4,7 @@ import { FailedValidationError, joiValidationErrorItemToErrorExtensions } from '
 export default defineOperationApi({
     id: 'condition',
     handler: ({ filter }, { data, accountability }) => {
-        const parsedFilter = parseFilter(filter, accountability);
+        const parsedFilter = parseFilter(filter, accountability, undefined, true);
         if (!parsedFilter) {
             return null;
         }

package/dist/services/payload.js

@@ -285,7 +285,7 @@ export class PayloadService {
                         payload[name] = newValue;
                     }
                     if (dateColumn.type === 'dateTime') {
-                        const year = String(value.getFullYear());
+                        const year = String(value.getFullYear()).padStart(4, '0');
                         const month = String(value.getMonth() + 1).padStart(2, '0');
                         const day = String(value.getDate()).padStart(2, '0');
                         const hours = String(value.getHours()).padStart(2, '0');
@@ -295,7 +295,7 @@ export class PayloadService {
                         payload[name] = newValue;
                     }
                     if (dateColumn.type === 'date') {
-                        const year = String(value.getFullYear());
+                        const year = String(value.getFullYear()).padStart(4, '0');
                         const month = String(value.getMonth() + 1).padStart(2, '0');
                         const day = String(value.getDate()).padStart(2, '0');
                         // Strip off the time / timezone information from a date-only value

package/dist/services/relations.d.ts

@@ -16,7 +16,7 @@ export declare class RelationsService {
     helpers: Helpers;
     constructor(options: AbstractServiceOptions);
     foreignKeys(collection?: string): Promise<ForeignKey[]>;
-    readAll(collection?: string, opts?: QueryOptions): Promise<Relation[]>;
+    readAll(collection?: string, opts?: QueryOptions, bypassCache?: boolean): Promise<Relation[]>;
     readOne(collection: string, field: string): Promise<Relation>;
     /**
      * Create a new relationship / foreign key constraint

package/dist/services/relations.js

@@ -58,7 +58,7 @@ export class RelationsService {
         }
         return foreignKeys;
     }
-    async readAll(collection, opts) {
+    async readAll(collection, opts, bypassCache) {
         if (this.accountability) {
             await validateAccess({
                 accountability: this.accountability,
@@ -87,7 +87,10 @@ export class RelationsService {
                 return true;
             return metaRow.many_collection === collection;
         });
-        const schemaRows = await this.foreignKeys(collection);
+        let schemaRows = bypassCache ? await this.schemaInspector.foreignKeys() : await this.foreignKeys(collection);
+        if (collection && bypassCache) {
+            schemaRows = schemaRows.filter((row) => row.table === collection);
+        }
         const results = this.stitchRelations(metaRows, schemaRows);
         return await this.filterForbidden(results);
     }

package/dist/utils/get-ip-from-req.d.ts

@@ -1,2 +1,3 @@
 import type { Request } from 'express';
-export declare function getIPFromReq(req: Request): string | null;
+import type { IncomingMessage } from 'http';
+export declare function getIPFromReq(req: IncomingMessage | Request): string | null;

package/dist/utils/get-ip-from-req.js

@@ -1,12 +1,39 @@
 import { useEnv } from '@directus/env';
 import { isIP } from 'net';
+import proxyAddr from 'proxy-addr';
 import { useLogger } from '../logger/index.js';
+/**
+ * Generate the trusted ip list
+ *
+ * Adapted to have feature parity with the express equivalent https://github.com/expressjs/express/blob/9f4dbe3a1332cd883069ba9b73a9eed99234cfc7/lib/utils.js#L192
+ */
+function getTrustValue(trust) {
+    if (typeof trust === 'boolean') {
+        // Support plain true/false
+        return (_addr, _i) => trust;
+    }
+    else if (typeof trust === 'number') {
+        // Support trusting hop count
+        return (_addr, i) => i < trust;
+    }
+    else if (typeof trust === 'string') {
+        // Support comma-separated values
+        trust = trust.split(',').map((v) => v.trim());
+    }
+    return proxyAddr.compile(trust || []);
+}
 export function getIPFromReq(req) {
     const env = useEnv();
     const logger = useLogger();
-    let ip = req.ip;
+    let ip = 'ip' in req ? req.ip : proxyAddr(req, getTrustValue(env['IP_TRUST_PROXY']));
     if (env['IP_CUSTOM_HEADER']) {
-        const customIPHeaderValue = req.get(env['IP_CUSTOM_HEADER']);
+        const customIPHeaderName = env['IP_CUSTOM_HEADER'].toLowerCase();
+        // All req.headers are auto lower-cased
+        let customIPHeaderValue = req.headers[customIPHeaderName];
+        // // Done to have feature parity with https://github.com/expressjs/express/blob/9f4dbe3a1332cd883069ba9b73a9eed99234cfc7/lib/request.js#L63
+        if (customIPHeaderName === 'referer' || customIPHeaderName === 'referrer') {
+            customIPHeaderValue = req.headers['referrer'] || req.headers['referer'];
+        }
         if (typeof customIPHeaderValue === 'string' && isIP(customIPHeaderValue) !== 0) {
             ip = customIPHeaderValue;
         }

package/dist/utils/get-schema.js

@@ -162,6 +162,6 @@ async function getDatabaseSchema(database, schemaInspector) {
         };
     }
     const relationsService = new RelationsService({ knex: database, schema: result });
-    result.relations = await relationsService.readAll();
+    result.relations = await relationsService.readAll(undefined, undefined, true);
     return result;
 }

package/dist/websocket/controllers/base.d.ts

@@ -22,8 +22,8 @@ export default abstract class SocketController {
     protected getRateLimiter(): RateLimiterAbstract | null;
     private catchInvalidMessages;
     protected handleUpgrade(request: IncomingMessage, socket: internal.Duplex, head: Buffer): Promise<void>;
-    protected handleTokenUpgrade({ request, socket, head }: UpgradeContext, token: string | null): Promise<void>;
-    protected handleHandshakeUpgrade({ request, socket, head }: UpgradeContext): Promise<void>;
+    protected handleTokenUpgrade({ request, socket, head, accountabilityOverrides }: UpgradeContext, token: string | null): Promise<void>;
+    protected handleHandshakeUpgrade({ request, socket, head, accountabilityOverrides }: UpgradeContext): Promise<void>;
     createClient(ws: WebSocket, { accountability, expires_at }: AuthenticationState): WebSocketClient;
     protected parseMessage(data: string): WebSocketMessage;
     protected handleAuthRequest(client: WebSocketClient, message: WebSocketAuthMessage): Promise<void>;

package/dist/websocket/controllers/base.js

@@ -8,15 +8,16 @@ import WebSocket, { WebSocketServer } from 'ws';
 import { fromZodError } from 'zod-validation-error';
 import emitter from '../../emitter.js';
 import { useLogger } from '../../logger/index.js';
+import { createDefaultAccountability } from '../../permissions/utils/create-default-accountability.js';
 import { createRateLimiter } from '../../rate-limiter.js';
 import { getAccountabilityForToken } from '../../utils/get-accountability-for-token.js';
+import { getIPFromReq } from '../../utils/get-ip-from-req.js';
 import { authenticateConnection, authenticationSuccess } from '../authenticate.js';
 import { WebSocketError, handleWebSocketError } from '../errors.js';
 import { AuthMode, WebSocketAuthMessage, WebSocketMessage } from '../messages.js';
 import { getExpiresAtForToken } from '../utils/get-expires-at-for-token.js';
 import { getMessageType } from '../utils/message.js';
 import { waitForAnyMessage, waitForMessageType } from '../utils/wait-for-message.js';
-import { createDefaultAccountability } from '../../permissions/utils/create-default-accountability.js';
 const TOKEN_CHECK_INTERVAL = 15 * 60 * 1000; // 15 minutes
 const logger = useLogger();
 export default class SocketController {
@@ -98,8 +99,17 @@ export default class SocketController {
         }
         const env = useEnv();
         const cookies = request.headers.cookie ? cookie.parse(request.headers.cookie) : {};
-        const context = { request, socket, head };
         const sessionCookieName = env['SESSION_COOKIE_NAME'];
+        const accountabilityOverrides = {
+            ip: getIPFromReq(request) ?? null,
+        };
+        const userAgent = request.headers['user-agent']?.substring(0, 1024);
+        if (userAgent)
+            accountabilityOverrides.userAgent = userAgent;
+        const origin = request.headers['origin'];
+        if (origin)
+            accountabilityOverrides.origin = origin;
+        const context = { request, socket, head, accountabilityOverrides };
         if (this.authentication.mode === 'strict' || query['access_token'] || cookies[sessionCookieName]) {
             let token = null;
             if (typeof query['access_token'] === 'string') {
@@ -117,11 +127,14 @@ export default class SocketController {
         }
         this.server.handleUpgrade(request, socket, head, async (ws) => {
             this.catchInvalidMessages(ws);
-            const state = { accountability: createDefaultAccountability(), expires_at: null };
+            const state = {
+                accountability: createDefaultAccountability(accountabilityOverrides),
+                expires_at: null,
+            };
             this.server.emit('connection', ws, state);
         });
     }
-    async handleTokenUpgrade({ request, socket, head }, token) {
+    async handleTokenUpgrade({ request, socket, head, accountabilityOverrides }, token) {
         let accountability = null;
         let expires_at = null;
         if (token) {
@@ -149,13 +162,14 @@ export default class SocketController {
             socket.destroy();
             return;
         }
+        Object.assign(accountability, accountabilityOverrides);
         this.server.handleUpgrade(request, socket, head, async (ws) => {
             this.catchInvalidMessages(ws);
             const state = { accountability, expires_at };
             this.server.emit('connection', ws, state);
         });
     }
-    async handleHandshakeUpgrade({ request, socket, head }) {
+    async handleHandshakeUpgrade({ request, socket, head, accountabilityOverrides }) {
         this.server.handleUpgrade(request, socket, head, async (ws) => {
             this.catchInvalidMessages(ws);
             try {
@@ -163,6 +177,9 @@ export default class SocketController {
                 if (getMessageType(payload) !== 'auth')
                     throw new Error();
                 const state = await authenticateConnection(WebSocketAuthMessage.parse(payload));
+                if (state.accountability) {
+                    Object.assign(state.accountability, accountabilityOverrides);
+                }
                 this.checkUserRequirements(state.accountability);
                 ws.send(authenticationSuccess(payload['uid'], state.refresh_token));
                 this.server.emit('connection', ws, state);
@@ -253,6 +270,17 @@ export default class SocketController {
         try {
             const { accountability, expires_at, refresh_token } = await authenticateConnection(message);
             this.checkUserRequirements(accountability);
+            /**
+             * Re-use the existing ip, userAgent and origin accountability properties.
+             * They are only sent in the original connection request
+             */
+            if (accountability && client.accountability) {
+                Object.assign(accountability, {
+                    ip: client.accountability.ip,
+                    userAgent: client.accountability.userAgent,
+                    origin: client.accountability.origin,
+                });
+            }
             client.accountability = accountability;
             client.expires_at = expires_at;
             this.setTokenExpireTimer(client);

package/dist/websocket/types.d.ts

@@ -30,6 +30,7 @@ export type UpgradeContext = {
     request: IncomingMessage;
     socket: internal.Duplex;
     head: Buffer;
+    accountabilityOverrides: Pick<Accountability, 'ip' | 'userAgent' | 'origin'>;
 };
 export type GraphQLSocket = {
     client: WebSocketClient;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "27.0.1",
+  "version": "27.1.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "keywords": [
     "directus",
@@ -136,10 +136,11 @@
     "pino-pretty": "13.0.0",
     "pm2": "5.4.3",
     "prom-client": "15.1.3",
+    "proxy-addr": "2.0.7",
     "qs": "6.14.0",
     "rate-limiter-flexible": "5.0.5",
     "rollup": "4.34.9",
-    "samlify": "2.9.1",
+    "samlify": "2.10.0",
     "sanitize-html": "2.14.0",
     "sharp": "0.33.5",
     "snappy": "7.2.2",
@@ -150,30 +151,30 @@
     "ws": "8.18.1",
     "zod": "3.24.2",
     "zod-validation-error": "3.4.0",
-    "@directus/app": "13.9.1",
-    "@directus/constants": "13.0.1",
-    "@directus/env": "5.0.4",
+    "@directus/app": "13.10.0",
+    "@directus/env": "5.0.5",
     "@directus/errors": "2.0.1",
-    "@directus/extensions-registry": "3.0.5",
-    "@directus/extensions-sdk": "13.1.0",
-    "@directus/extensions": "3.0.5",
+    "@directus/extensions": "3.0.6",
+    "@directus/constants": "13.0.1",
+    "@directus/extensions-registry": "3.0.6",
+    "@directus/pressure": "3.0.5",
     "@directus/format-title": "12.0.1",
-    "@directus/memory": "3.0.4",
+    "@directus/memory": "3.0.5",
+    "@directus/extensions-sdk": "13.1.1",
     "@directus/schema": "13.0.1",
-    "@directus/schema-builder": "0.0.0",
-    "@directus/pressure": "3.0.4",
-    "@directus/storage": "12.0.0",
-    "@directus/storage-driver-azure": "12.0.4",
-    "@directus/storage-driver-cloudinary": "12.0.4",
+    "@directus/schema-builder": "0.0.2",
     "@directus/specs": "11.1.0",
-    "@directus/storage-driver-gcs": "12.0.4",
+    "@directus/storage": "12.0.0",
+    "@directus/storage-driver-cloudinary": "12.0.5",
+    "@directus/storage-driver-gcs": "12.0.5",
     "@directus/storage-driver-local": "12.0.0",
-    "@directus/storage-driver-s3": "12.0.4",
-    "@directus/storage-driver-supabase": "3.0.4",
-    "@directus/utils": "13.0.4",
+    "@directus/storage-driver-azure": "12.0.5",
+    "@directus/storage-driver-s3": "12.0.5",
+    "@directus/storage-driver-supabase": "3.0.5",
     "@directus/system-data": "3.1.0",
-    "directus": "11.7.1",
-    "@directus/validation": "2.0.4"
+    "@directus/utils": "13.0.6",
+    "directus": "11.8.0",
+    "@directus/validation": "2.0.5"
   },
   "devDependencies": {
     "@directus/tsconfig": "3.0.0",
@@ -204,6 +205,7 @@
     "@types/nodemailer": "6.4.17",
     "@types/object-hash": "3.0.6",
     "@types/papaparse": "5.3.15",
+    "@types/proxy-addr": "2.0.3",
     "@types/qs": "6.9.18",
     "@types/sanitize-html": "2.13.0",
     "@types/stream-json": "1.7.8",
@@ -217,8 +219,8 @@
     "typescript": "5.8.2",
     "vitest": "2.1.9",
     "@directus/random": "2.0.1",
-    "@directus/types": "13.1.1",
-    "@directus/schema-builder": "0.0.0"
+    "@directus/schema-builder": "0.0.2",
+    "@directus/types": "13.1.2"
   },
   "optionalDependencies": {
     "@keyv/redis": "3.0.1",
@@ -233,7 +235,7 @@
     "node": ">=22"
   },
   "scripts": {
-    "build": "tsc --project tsconfig.prod.json && copyfiles \"src/**/*.{yaml,liquid}\" -u 1 dist",
+    "build": "rimraf ./dist && tsc --project tsconfig.prod.json && copyfiles \"src/**/*.{yaml,liquid}\" -u 1 dist",
     "cli": "NODE_ENV=development SERVE_APP=false tsx src/cli/run.ts",
     "dev": "NODE_ENV=development SERVE_APP=true tsx watch --ignore extensions --clear-screen=false src/start.ts",
     "test": "vitest run",