@directus/api 27.0.2 → 28.0.0

package/dist/services/relations.js

@@ -58,7 +58,7 @@ export class RelationsService {
         }
         return foreignKeys;
     }
-    async readAll(collection, opts) {
+    async readAll(collection, opts, bypassCache) {
         if (this.accountability) {
             await validateAccess({
                 accountability: this.accountability,
@@ -87,7 +87,10 @@ export class RelationsService {
                 return true;
             return metaRow.many_collection === collection;
         });
-        const schemaRows = await this.foreignKeys(collection);
+        let schemaRows = bypassCache ? await this.schemaInspector.foreignKeys() : await this.foreignKeys(collection);
+        if (collection && bypassCache) {
+            schemaRows = schemaRows.filter((row) => row.table === collection);
+        }
         const results = this.stitchRelations(metaRows, schemaRows);
         return await this.filterForbidden(results);
     }

package/dist/services/specifications.js

@@ -3,8 +3,8 @@ import formatTitle from '@directus/format-title';
 import { spec } from '@directus/specs';
 import { isSystemCollection } from '@directus/system-data';
 import { getRelation } from '@directus/utils';
-import { version } from 'directus/version';
 import { cloneDeep, mergeWith } from 'lodash-es';
+import hash from 'object-hash';
 import { OAS_REQUIRED_SCHEMAS } from '../constants.js';
 import getDatabase from '../database/index.js';
 import { fetchPermissions } from '../permissions/lib/fetch-permissions.js';
@@ -54,12 +54,16 @@ class OASSpecsService {
         const components = await this.generateComponents(schemaForSpec, tags);
         const isDefaultPublicUrl = env['PUBLIC_URL'] === '/';
         const url = isDefaultPublicUrl && host ? host : env['PUBLIC_URL'];
+        const hashedVersion = hash({
+            now: new Date().toISOString(),
+            user: this.accountability?.user,
+        });
         const spec = {
             openapi: '3.0.1',
             info: {
                 title: 'Dynamic API Specification',
                 description: 'This is a dynamically generated API specification for all endpoints existing on the current project.',
-                version: version,
+                version: hashedVersion,
             },
             servers: [
                 {

package/dist/services/users.js

@@ -40,6 +40,7 @@ export class UsersService extends ItemsService {
             throw new RecordNotUniqueError({
                 collection: 'directus_users',
                 field: 'email',
+                value: '[' + String(duplicates) + ']',
             });
         }
         const query = this.knex
@@ -54,6 +55,7 @@ export class UsersService extends ItemsService {
             throw new RecordNotUniqueError({
                 collection: 'directus_users',
                 field: 'email',
+                value: '[' + String(emails) + ']',
             });
         }
     }
@@ -210,6 +212,7 @@ export class UsersService extends ItemsService {
                     throw new RecordNotUniqueError({
                         collection: 'directus_users',
                         field: 'email',
+                        value: data['email'],
                     });
                 }
                 this.validateEmail(data['email']);

package/dist/telemetry/lib/get-report.js

@@ -8,6 +8,7 @@ import { getFieldCount } from '../utils/get-field-count.js';
 import { getFilesizeSum } from '../utils/get-filesize-sum.js';
 import { getItemCount } from '../utils/get-item-count.js';
 import { getUserItemCount } from '../utils/get-user-item-count.js';
+import { getProjectId } from '../utils/get-project-id.js';
 const basicCountTasks = [
     { collection: 'directus_dashboards' },
     { collection: 'directus_files' },
@@ -25,7 +26,7 @@ export const getReport = async () => {
     const db = getDatabase();
     const env = useEnv();
     const helpers = getHelpers(db);
-    const [basicCounts, userCounts, userItemCount, fieldsCounts, extensionsCounts, databaseSize, filesizes] = await Promise.all([
+    const [basicCounts, userCounts, userItemCount, fieldsCounts, extensionsCounts, databaseSize, filesizes, projectId] = await Promise.all([
         getItemCount(db, basicCountTasks),
         fetchUserCount({ knex: db }),
         getUserItemCount(db),
@@ -33,6 +34,7 @@ export const getReport = async () => {
         getExtensionCount(db),
         helpers.schema.getDatabaseSize(),
         getFilesizeSum(db),
+        getProjectId(db),
     ]);
     return {
         url: env['PUBLIC_URL'],
@@ -53,5 +55,6 @@ export const getReport = async () => {
         extensions: extensionsCounts.totalEnabled,
         database_size: databaseSize ?? 0,
         files_size_total: filesizes.total,
+        project_id: projectId,
     };
 };

package/dist/telemetry/types/report.d.ts

@@ -71,4 +71,8 @@ export interface TelemetryReport {
      * Total size of the files in bytes
      */
     files_size_total: number;
+    /**
+     * Unique project identifier
+     */
+    project_id?: string | null;
 }

package/dist/telemetry/utils/get-project-id.d.ts

@@ -0,0 +1,2 @@
+import type { Knex } from 'knex';
+export declare const getProjectId: (db: Knex) => Promise<string>;

package/dist/telemetry/utils/get-project-id.js

@@ -0,0 +1,4 @@
+export const getProjectId = async (db) => {
+    const projectId = await db.select('project_id').from('directus_settings').first();
+    return projectId?.project_id || null;
+};

package/dist/utils/get-ip-from-req.d.ts

@@ -1,2 +1,3 @@
 import type { Request } from 'express';
-export declare function getIPFromReq(req: Request): string | null;
+import type { IncomingMessage } from 'http';
+export declare function getIPFromReq(req: IncomingMessage | Request): string | null;

package/dist/utils/get-ip-from-req.js

@@ -1,12 +1,39 @@
 import { useEnv } from '@directus/env';
 import { isIP } from 'net';
+import proxyAddr from 'proxy-addr';
 import { useLogger } from '../logger/index.js';
+/**
+ * Generate the trusted ip list
+ *
+ * Adapted to have feature parity with the express equivalent https://github.com/expressjs/express/blob/9f4dbe3a1332cd883069ba9b73a9eed99234cfc7/lib/utils.js#L192
+ */
+function getTrustValue(trust) {
+    if (typeof trust === 'boolean') {
+        // Support plain true/false
+        return (_addr, _i) => trust;
+    }
+    else if (typeof trust === 'number') {
+        // Support trusting hop count
+        return (_addr, i) => i < trust;
+    }
+    else if (typeof trust === 'string') {
+        // Support comma-separated values
+        trust = trust.split(',').map((v) => v.trim());
+    }
+    return proxyAddr.compile(trust || []);
+}
 export function getIPFromReq(req) {
     const env = useEnv();
     const logger = useLogger();
-    let ip = req.ip;
+    let ip = 'ip' in req ? req.ip : proxyAddr(req, getTrustValue(env['IP_TRUST_PROXY']));
     if (env['IP_CUSTOM_HEADER']) {
-        const customIPHeaderValue = req.get(env['IP_CUSTOM_HEADER']);
+        const customIPHeaderName = env['IP_CUSTOM_HEADER'].toLowerCase();
+        // All req.headers are auto lower-cased
+        let customIPHeaderValue = req.headers[customIPHeaderName];
+        // // Done to have feature parity with https://github.com/expressjs/express/blob/9f4dbe3a1332cd883069ba9b73a9eed99234cfc7/lib/request.js#L63
+        if (customIPHeaderName === 'referer' || customIPHeaderName === 'referrer') {
+            customIPHeaderValue = req.headers['referrer'] || req.headers['referer'];
+        }
         if (typeof customIPHeaderValue === 'string' && isIP(customIPHeaderValue) !== 0) {
             ip = customIPHeaderValue;
         }

package/dist/utils/get-schema.js

@@ -162,6 +162,6 @@ async function getDatabaseSchema(database, schemaInspector) {
         };
     }
     const relationsService = new RelationsService({ knex: database, schema: result });
-    result.relations = await relationsService.readAll();
+    result.relations = await relationsService.readAll(undefined, undefined, true);
     return result;
 }

package/dist/utils/is-url-allowed.js

@@ -16,7 +16,7 @@ export default function isUrlAllowed(url, allowList) {
             return origin + pathname;
         }
         catch {
-            logger.warn(`Invalid URL used "${url}"`);
+            logger.warn(`Invalid URL used "${allowedURL}"`);
         }
         return null;
     })

package/dist/utils/sanitize-query.js

@@ -71,6 +71,9 @@ export async function sanitizeQuery(rawQuery, schema, accountability) {
     if (rawQuery['alias']) {
         query.alias = sanitizeAlias(rawQuery['alias']);
     }
+    if ('backlink' in rawQuery) {
+        query.backlink = sanitizeBacklink(rawQuery['backlink']);
+    }
     return query;
 }
 function sanitizeFields(rawFields) {
@@ -171,6 +174,9 @@ function sanitizeMeta(rawMeta) {
     }
     return [rawMeta];
 }
+function sanitizeBacklink(rawBacklink) {
+    return rawBacklink !== false && rawBacklink !== 'false';
+}
 async function sanitizeDeep(deep, schema, accountability) {
     const logger = useLogger();
     const result = {};

package/dist/utils/validate-query.js

@@ -26,6 +26,7 @@ const querySchema = Joi.object({
     aggregate: Joi.object(),
     deep: Joi.object(),
     alias: Joi.object(),
+    backlink: Joi.boolean(),
 }).id('query');
 export function validateQuery(query) {
     const { error } = querySchema.validate(query);

package/dist/websocket/controllers/base.d.ts

@@ -22,8 +22,8 @@ export default abstract class SocketController {
     protected getRateLimiter(): RateLimiterAbstract | null;
     private catchInvalidMessages;
     protected handleUpgrade(request: IncomingMessage, socket: internal.Duplex, head: Buffer): Promise<void>;
-    protected handleTokenUpgrade({ request, socket, head }: UpgradeContext, token: string | null): Promise<void>;
-    protected handleHandshakeUpgrade({ request, socket, head }: UpgradeContext): Promise<void>;
+    protected handleTokenUpgrade({ request, socket, head, accountabilityOverrides }: UpgradeContext, token: string | null): Promise<void>;
+    protected handleHandshakeUpgrade({ request, socket, head, accountabilityOverrides }: UpgradeContext): Promise<void>;
     createClient(ws: WebSocket, { accountability, expires_at }: AuthenticationState): WebSocketClient;
     protected parseMessage(data: string): WebSocketMessage;
     protected handleAuthRequest(client: WebSocketClient, message: WebSocketAuthMessage): Promise<void>;

package/dist/websocket/controllers/base.js

@@ -8,15 +8,16 @@ import WebSocket, { WebSocketServer } from 'ws';
 import { fromZodError } from 'zod-validation-error';
 import emitter from '../../emitter.js';
 import { useLogger } from '../../logger/index.js';
+import { createDefaultAccountability } from '../../permissions/utils/create-default-accountability.js';
 import { createRateLimiter } from '../../rate-limiter.js';
 import { getAccountabilityForToken } from '../../utils/get-accountability-for-token.js';
+import { getIPFromReq } from '../../utils/get-ip-from-req.js';
 import { authenticateConnection, authenticationSuccess } from '../authenticate.js';
 import { WebSocketError, handleWebSocketError } from '../errors.js';
 import { AuthMode, WebSocketAuthMessage, WebSocketMessage } from '../messages.js';
 import { getExpiresAtForToken } from '../utils/get-expires-at-for-token.js';
 import { getMessageType } from '../utils/message.js';
 import { waitForAnyMessage, waitForMessageType } from '../utils/wait-for-message.js';
-import { createDefaultAccountability } from '../../permissions/utils/create-default-accountability.js';
 const TOKEN_CHECK_INTERVAL = 15 * 60 * 1000; // 15 minutes
 const logger = useLogger();
 export default class SocketController {
@@ -98,8 +99,17 @@ export default class SocketController {
         }
         const env = useEnv();
         const cookies = request.headers.cookie ? cookie.parse(request.headers.cookie) : {};
-        const context = { request, socket, head };
         const sessionCookieName = env['SESSION_COOKIE_NAME'];
+        const accountabilityOverrides = {
+            ip: getIPFromReq(request) ?? null,
+        };
+        const userAgent = request.headers['user-agent']?.substring(0, 1024);
+        if (userAgent)
+            accountabilityOverrides.userAgent = userAgent;
+        const origin = request.headers['origin'];
+        if (origin)
+            accountabilityOverrides.origin = origin;
+        const context = { request, socket, head, accountabilityOverrides };
         if (this.authentication.mode === 'strict' || query['access_token'] || cookies[sessionCookieName]) {
             let token = null;
             if (typeof query['access_token'] === 'string') {
@@ -117,11 +127,14 @@ export default class SocketController {
         }
         this.server.handleUpgrade(request, socket, head, async (ws) => {
             this.catchInvalidMessages(ws);
-            const state = { accountability: createDefaultAccountability(), expires_at: null };
+            const state = {
+                accountability: createDefaultAccountability(accountabilityOverrides),
+                expires_at: null,
+            };
             this.server.emit('connection', ws, state);
         });
     }
-    async handleTokenUpgrade({ request, socket, head }, token) {
+    async handleTokenUpgrade({ request, socket, head, accountabilityOverrides }, token) {
         let accountability = null;
         let expires_at = null;
         if (token) {
@@ -149,13 +162,14 @@ export default class SocketController {
             socket.destroy();
             return;
         }
+        Object.assign(accountability, accountabilityOverrides);
         this.server.handleUpgrade(request, socket, head, async (ws) => {
             this.catchInvalidMessages(ws);
             const state = { accountability, expires_at };
             this.server.emit('connection', ws, state);
         });
     }
-    async handleHandshakeUpgrade({ request, socket, head }) {
+    async handleHandshakeUpgrade({ request, socket, head, accountabilityOverrides }) {
         this.server.handleUpgrade(request, socket, head, async (ws) => {
             this.catchInvalidMessages(ws);
             try {
@@ -163,6 +177,9 @@ export default class SocketController {
                 if (getMessageType(payload) !== 'auth')
                     throw new Error();
                 const state = await authenticateConnection(WebSocketAuthMessage.parse(payload));
+                if (state.accountability) {
+                    Object.assign(state.accountability, accountabilityOverrides);
+                }
                 this.checkUserRequirements(state.accountability);
                 ws.send(authenticationSuccess(payload['uid'], state.refresh_token));
                 this.server.emit('connection', ws, state);
@@ -253,6 +270,17 @@ export default class SocketController {
         try {
             const { accountability, expires_at, refresh_token } = await authenticateConnection(message);
             this.checkUserRequirements(accountability);
+            /**
+             * Re-use the existing ip, userAgent and origin accountability properties.
+             * They are only sent in the original connection request
+             */
+            if (accountability && client.accountability) {
+                Object.assign(accountability, {
+                    ip: client.accountability.ip,
+                    userAgent: client.accountability.userAgent,
+                    origin: client.accountability.origin,
+                });
+            }
             client.accountability = accountability;
             client.expires_at = expires_at;
             this.setTokenExpireTimer(client);

package/dist/websocket/types.d.ts

@@ -30,6 +30,7 @@ export type UpgradeContext = {
     request: IncomingMessage;
     socket: internal.Duplex;
     head: Buffer;
+    accountabilityOverrides: Pick<Accountability, 'ip' | 'userAgent' | 'origin'>;
 };
 export type GraphQLSocket = {
     client: WebSocketClient;

package/dist/websocket/utils/items.d.ts

@@ -39,5 +39,5 @@ export declare function getFieldsPayload(subscription: PSubscription, accountabi
  * @param event Event data
  * @returns the fetched data
  */
-export declare function getItemsPayload(subscription: PSubscription, accountability: Accountability | null, schema: SchemaOverview, event?: WebSocketEvent): Promise<string | number | (string | number)[] | import("@directus/types").Item | import("@directus/types").Item[]>;
+export declare function getItemsPayload(subscription: PSubscription, accountability: Accountability | null, schema: SchemaOverview, event?: WebSocketEvent): Promise<string | number | import("@directus/types").Item | (string | number)[] | import("@directus/types").Item[]>;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "27.0.2",
+  "version": "28.0.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "keywords": [
     "directus",
@@ -136,44 +136,46 @@
     "pino-pretty": "13.0.0",
     "pm2": "5.4.3",
     "prom-client": "15.1.3",
+    "proxy-addr": "2.0.7",
     "qs": "6.14.0",
     "rate-limiter-flexible": "5.0.5",
     "rollup": "4.34.9",
-    "samlify": "2.9.1",
+    "samlify": "2.10.0",
     "sanitize-html": "2.14.0",
     "sharp": "0.33.5",
     "snappy": "7.2.2",
     "stream-json": "1.9.1",
     "tar": "7.4.3",
     "tsx": "4.19.3",
+    "uuid": "11.1.0",
     "wellknown": "0.5.0",
     "ws": "8.18.1",
     "zod": "3.24.2",
     "zod-validation-error": "3.4.0",
-    "@directus/app": "13.9.2",
+    "@directus/app": "13.11.0",
     "@directus/constants": "13.0.1",
-    "@directus/errors": "2.0.1",
-    "@directus/env": "5.0.4",
-    "@directus/extensions": "3.0.5",
-    "@directus/extensions-registry": "3.0.5",
-    "@directus/extensions-sdk": "13.1.0",
+    "@directus/env": "5.1.0",
+    "@directus/errors": "2.0.2",
+    "@directus/extensions": "3.0.7",
+    "@directus/extensions-registry": "3.0.7",
+    "@directus/extensions-sdk": "14.0.0",
     "@directus/format-title": "12.0.1",
+    "@directus/pressure": "3.0.6",
     "@directus/schema": "13.0.1",
-    "@directus/memory": "3.0.4",
-    "@directus/schema-builder": "0.0.1",
+    "@directus/memory": "3.0.6",
     "@directus/specs": "11.1.0",
+    "@directus/schema-builder": "0.0.3",
     "@directus/storage": "12.0.0",
-    "@directus/pressure": "3.0.4",
-    "@directus/storage-driver-azure": "12.0.4",
-    "@directus/storage-driver-cloudinary": "12.0.4",
-    "@directus/storage-driver-gcs": "12.0.4",
-    "@directus/storage-driver-s3": "12.0.4",
-    "@directus/storage-driver-supabase": "3.0.4",
-    "@directus/utils": "13.0.5",
-    "@directus/validation": "2.0.4",
-    "@directus/system-data": "3.1.0",
-    "directus": "11.7.2",
-    "@directus/storage-driver-local": "12.0.0"
+    "@directus/storage-driver-azure": "12.0.6",
+    "@directus/storage-driver-cloudinary": "12.0.6",
+    "@directus/storage-driver-local": "12.0.0",
+    "@directus/storage-driver-gcs": "12.0.6",
+    "@directus/storage-driver-supabase": "3.0.6",
+    "@directus/storage-driver-s3": "12.0.6",
+    "@directus/utils": "13.0.7",
+    "@directus/validation": "2.0.6",
+    "@directus/system-data": "3.1.1",
+    "directus": "11.9.0"
   },
   "devDependencies": {
     "@directus/tsconfig": "3.0.0",
@@ -204,6 +206,7 @@
     "@types/nodemailer": "6.4.17",
     "@types/object-hash": "3.0.6",
     "@types/papaparse": "5.3.15",
+    "@types/proxy-addr": "2.0.3",
     "@types/qs": "6.9.18",
     "@types/sanitize-html": "2.13.0",
     "@types/stream-json": "1.7.8",
@@ -216,9 +219,9 @@
     "knex-mock-client": "3.0.2",
     "typescript": "5.8.2",
     "vitest": "2.1.9",
+    "@directus/schema-builder": "0.0.3",
     "@directus/random": "2.0.1",
-    "@directus/schema-builder": "0.0.1",
-    "@directus/types": "13.1.1"
+    "@directus/types": "13.2.0"
   },
   "optionalDependencies": {
     "@keyv/redis": "3.0.1",
@@ -233,7 +236,7 @@
     "node": ">=22"
   },
   "scripts": {
-    "build": "tsc --project tsconfig.prod.json && copyfiles \"src/**/*.{yaml,liquid}\" -u 1 dist",
+    "build": "rimraf ./dist && tsc --project tsconfig.prod.json && copyfiles \"src/**/*.{yaml,liquid}\" -u 1 dist",
     "cli": "NODE_ENV=development SERVE_APP=false tsx src/cli/run.ts",
     "dev": "NODE_ENV=development SERVE_APP=true tsx watch --ignore extensions --clear-screen=false src/start.ts",
     "test": "vitest run",

package/dist/utils/map-values-deep.d.ts

@@ -1 +0,0 @@
-export declare function mapValuesDeep(obj: Record<string, any>, fn: (key: string, value: any) => any): Record<string, any>;

package/dist/utils/map-values-deep.js

@@ -1,25 +0,0 @@
-export function mapValuesDeep(obj, fn) {
-    return recurse(obj);
-    function recurse(obj, prefix = '') {
-        if (Array.isArray(obj)) {
-            return obj.map((value, index) => {
-                if (typeof value === 'object' && value !== null) {
-                    return recurse(value, prefix + `[${index}]`);
-                }
-                else {
-                    return fn(prefix + `[${index}]`, value);
-                }
-            });
-        }
-        else {
-            return Object.fromEntries(Object.entries(obj).map(([key, value]) => {
-                if (typeof value === 'object' && value !== null) {
-                    return [key, recurse(value, prefix + (prefix ? '.' : '') + key)];
-                }
-                else {
-                    return [key, fn(prefix + (prefix ? '.' : '') + key, value)];
-                }
-            }));
-        }
-    }
-}