@directus/api 32.1.0 → 32.2.0

package/dist/{auth/utils → utils}/is-login-redirect-allowed.js

@@ -1,23 +1,19 @@
 import { useEnv } from '@directus/env';
 import { toArray } from '@directus/utils';
-import { useLogger } from '../../logger/index.js';
-import isUrlAllowed from '../../utils/is-url-allowed.js';
+import { useLogger } from '../logger/index.js';
+import isUrlAllowed from './is-url-allowed.js';
 /**
- * Check if the redirect URL is allowed
- * @param originUrl Origin URL
- * @param provider OAuth provider name
- * @param redirect URL to redirect to
- * @returns True if the redirect is allowed, false otherwise
+ * Checks if the defined redirect after successful SSO login is in the allow list
  */
-export function isLoginRedirectAllowed(provider, originUrl, redirect) {
+export function isLoginRedirectAllowed(redirect, provider) {
     if (!redirect)
         return true; // empty redirect
     if (typeof redirect !== 'string')
         return false; // invalid type
     const env = useEnv();
     const publicUrl = env['PUBLIC_URL'];
-    if (!URL.canParse(redirect)) {
-        if (!redirect.startsWith('//')) {
+    if (URL.canParse(redirect) === false) {
+        if (redirect.startsWith('//') === false) {
             // should be a relative path like `/admin/test`
             return true;
         }
@@ -25,10 +21,6 @@ export function isLoginRedirectAllowed(provider, originUrl, redirect) {
         return false;
     }
     const { protocol: redirectProtocol, hostname: redirectDomain } = new URL(redirect);
-    const redirectUrl = `${redirectProtocol}//${redirectDomain}`;
-    // Security check: redirect URL must match the request origin
-    if (redirectUrl !== originUrl)
-        return false;
     const envKey = `AUTH_${provider.toUpperCase()}_REDIRECT_ALLOW_LIST`;
     if (envKey in env) {
         if (isUrlAllowed(redirect, [...toArray(env[envKey]), publicUrl]))
@@ -38,7 +30,7 @@ export function isLoginRedirectAllowed(provider, originUrl, redirect) {
         useLogger().error('Invalid PUBLIC_URL for login redirect');
         return false;
     }
-    const { protocol: publicProtocol, hostname: publicDomain } = new URL(publicUrl);
     // allow redirects to the defined PUBLIC_URL
-    return redirectUrl === `${publicProtocol}//${publicDomain}`;
+    const { protocol: publicProtocol, hostname: publicDomain } = new URL(publicUrl);
+    return `${redirectProtocol}//${redirectDomain}` === `${publicProtocol}//${publicDomain}`;
 }

package/dist/utils/require-text.d.ts

@@ -0,0 +1 @@
+export declare function requireText(filepath: string): string;

package/dist/utils/require-text.js

@@ -0,0 +1,4 @@
+import fse from 'fs-extra';
+export function requireText(filepath) {
+    return fse.readFileSync(filepath, 'utf8');
+}

package/dist/utils/require-yaml.js

@@ -1,6 +1,6 @@
-import fse from 'fs-extra';
 import yaml from 'js-yaml';
+import { requireText } from './require-text.js';
 export function requireYAML(filepath) {
-    const yamlRaw = fse.readFileSync(filepath, 'utf8');
+    const yamlRaw = requireText(filepath);
     return yaml.load(yamlRaw);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "32.1.0",
+  "version": "32.2.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "keywords": [
     "directus",
@@ -58,15 +58,19 @@
     "dist"
   ],
   "dependencies": {
+    "@ai-sdk/anthropic": "3.0.0-beta.53",
+    "@ai-sdk/openai": "3.0.0-beta.57",
     "@authenio/samlify-node-xmllint": "2.0.0",
     "@aws-sdk/client-sesv2": "3.928.0",
     "@godaddy/terminus": "4.12.1",
-    "@modelcontextprotocol/sdk": "1.21.1",
+    "@modelcontextprotocol/sdk": "1.24.0",
     "@rollup/plugin-alias": "5.1.1",
     "@rollup/plugin-node-resolve": "16.0.3",
     "@rollup/plugin-virtual": "3.0.2",
     "@tus/server": "2.3.0",
     "@tus/utils": "0.6.0",
+    "archiver": "7.0.1",
+    "ai": "6.0.0-beta.98",
     "argon2": "0.44.0",
     "async": "3.2.6",
     "async-mutex": "0.5.0",
@@ -81,6 +85,7 @@
     "cookie": "1.0.2",
     "cookie-parser": "1.4.7",
     "cors": "2.8.5",
+    "cron": "4.3.4",
     "date-fns": "4.1.0",
     "deep-diff": "1.0.2",
     "destroy": "1.2.0",
@@ -106,7 +111,7 @@
     "js-yaml": "4.1.1",
     "js2xmlparser": "5.0.0",
     "json2csv": "5.0.7",
-    "jsonwebtoken": "9.0.2",
+    "jsonwebtoken": "9.0.3",
     "keyv": "5.5.3",
     "knex": "3.1.0",
     "ldapjs": "2.3.3",
@@ -120,7 +125,6 @@
     "ms": "2.1.3",
     "nanoid": "5.1.6",
     "node-machine-id": "1.1.12",
-    "cron": "4.3.4",
     "nodemailer": "7.0.10",
     "object-hash": "3.0.0",
     "openapi3-ts": "4.5.0",
@@ -141,7 +145,8 @@
     "rate-limiter-flexible": "7.2.0",
     "rolldown": "1.0.0-beta.31",
     "rollup": "4.52.5",
-    "samlify": "2.10.1",
+    "samlify": "2.10.2",
+    "sanitize-filename": "1.6.3",
     "sanitize-html": "2.17.0",
     "sharp": "0.34.5",
     "snappy": "7.3.3",
@@ -153,34 +158,35 @@
     "ws": "8.18.3",
     "zod": "4.1.12",
     "zod-validation-error": "4.0.2",
-    "@directus/app": "14.2.0",
-    "@directus/env": "5.3.2",
+    "@directus/app": "14.4.0",
+    "@directus/extensions": "3.0.15",
+    "@directus/errors": "2.1.0",
+    "@directus/extensions-sdk": "17.0.4",
     "@directus/constants": "14.0.0",
-    "@directus/errors": "2.0.5",
-    "@directus/extensions-registry": "3.0.14",
-    "@directus/extensions-sdk": "17.0.3",
+    "@directus/extensions-registry": "3.0.15",
+    "@directus/env": "5.3.3",
     "@directus/format-title": "12.1.1",
-    "@directus/extensions": "3.0.14",
-    "@directus/pressure": "3.0.12",
+    "@directus/memory": "3.0.13",
+    "@directus/pressure": "3.0.13",
     "@directus/schema": "13.0.4",
-    "@directus/memory": "3.0.12",
-    "@directus/schema-builder": "0.0.9",
     "@directus/storage": "12.0.3",
     "@directus/specs": "11.2.0",
-    "@directus/storage-driver-azure": "12.0.12",
-    "@directus/storage-driver-cloudinary": "12.0.12",
-    "@directus/storage-driver-gcs": "12.0.12",
-    "@directus/storage-driver-s3": "12.0.12",
+    "@directus/schema-builder": "0.0.10",
+    "@directus/storage-driver-azure": "12.0.13",
+    "@directus/storage-driver-cloudinary": "12.0.13",
+    "@directus/storage-driver-gcs": "12.0.13",
     "@directus/storage-driver-local": "12.0.3",
-    "@directus/storage-driver-supabase": "3.0.12",
-    "@directus/system-data": "3.4.2",
-    "@directus/validation": "2.0.12",
-    "@directus/utils": "13.0.13",
-    "directus": "11.13.3"
+    "@directus/system-data": "3.5.0",
+    "@directus/storage-driver-supabase": "3.0.13",
+    "@directus/utils": "13.1.0",
+    "@directus/validation": "2.0.13",
+    "@directus/storage-driver-s3": "12.0.13",
+    "directus": "11.14.0"
   },
   "devDependencies": {
     "@directus/tsconfig": "3.0.0",
     "@ngneat/falso": "8.0.2",
+    "@types/archiver": "7.0.0",
     "@types/async": "3.2.25",
     "@types/busboy": "1.5.4",
     "@types/bytes": "3.1.5",
@@ -219,8 +225,8 @@
     "knex-mock-client": "3.0.2",
     "typescript": "5.9.3",
     "vitest": "3.2.4",
-    "@directus/types": "13.4.0",
-    "@directus/schema-builder": "0.0.9"
+    "@directus/schema-builder": "0.0.10",
+    "@directus/types": "13.5.0"
   },
   "optionalDependencies": {
     "@keyv/redis": "3.0.1",

package/dist/auth/utils/generate-callback-url.d.ts

@@ -1,8 +0,0 @@
-/**
- * Generate callback URL from origin
- *
- * @param string Origin URL
- * @param providerName OAuth provider name
- * @returns url
- */
-export declare function generateCallbackUrl(providerName: string, originUrl: string): string;

package/dist/auth/utils/generate-callback-url.js

@@ -1,11 +0,0 @@
-import { Url } from '../../utils/url.js';
-/**
- * Generate callback URL from origin
- *
- * @param string Origin URL
- * @param providerName OAuth provider name
- * @returns url
- */
-export function generateCallbackUrl(providerName, originUrl) {
-    return new Url(originUrl).addPath('auth', 'login', providerName, 'callback').toString();
-}

package/dist/auth/utils/is-login-redirect-allowed.d.ts

@@ -1,8 +0,0 @@
-/**
- * Check if the redirect URL is allowed
- * @param originUrl Origin URL
- * @param provider OAuth provider name
- * @param redirect URL to redirect to
- * @returns True if the redirect is allowed, false otherwise
- */
-export declare function isLoginRedirectAllowed(provider: string, originUrl: string, redirect: unknown): boolean;

package/dist/extensions/lib/sync-extensions.d.ts

@@ -1,3 +0,0 @@
-export declare const syncExtensions: (options?: {
-    force: boolean;
-}) => Promise<void>;

package/dist/extensions/lib/sync-extensions.js

@@ -1,70 +0,0 @@
-import { useEnv } from '@directus/env';
-import { exists } from 'fs-extra';
-import mid from 'node-machine-id';
-import { createWriteStream } from 'node:fs';
-import { mkdir, rm } from 'node:fs/promises';
-import { dirname, join, relative, resolve, sep } from 'node:path';
-import { pipeline } from 'node:stream/promises';
-import Queue from 'p-queue';
-import { useBus } from '../../bus/index.js';
-import { useLock } from '../../lock/index.js';
-import { useLogger } from '../../logger/index.js';
-import { getStorage } from '../../storage/index.js';
-import { getExtensionsPath } from './get-extensions-path.js';
-import { SyncStatus, getSyncStatus, setSyncStatus } from './sync-status.js';
-export const syncExtensions = async (options) => {
-    const lock = useLock();
-    const messenger = useBus();
-    const env = useEnv();
-    const logger = useLogger();
-    if (!options?.force) {
-        const isDone = (await getSyncStatus()) === SyncStatus.DONE;
-        if (isDone)
-            return;
-    }
-    const machineId = await mid.machineId();
-    const machineKey = `extensions-sync/${machineId}`;
-    const processId = await lock.increment(machineKey);
-    const currentProcessShouldHandleSync = processId === 1;
-    if (currentProcessShouldHandleSync === false) {
-        logger.trace('Extensions already being synced to this machine from another process.');
-        // Wait until the process that called the lock publishes a message that the syncing is complete
-        return new Promise((resolve) => {
-            messenger.subscribe(machineKey, () => resolve());
-        });
-    }
-    try {
-        const extensionsPath = getExtensionsPath();
-        const storageExtensionsPath = env['EXTENSIONS_PATH'];
-        if (await exists(extensionsPath)) {
-            // In case the FS still contains the cached extensions from a previous invocation. We have to
-            // clear them out to ensure the remote extensions folder remains the source of truth for all
-            // extensions that are loaded.
-            await rm(extensionsPath, { recursive: true, force: true });
-        }
-        // Ensure that the local extensions cache path exists
-        await mkdir(extensionsPath, { recursive: true });
-        await setSyncStatus(SyncStatus.SYNCING);
-        logger.trace('Syncing extensions from configured storage location...');
-        const storage = await getStorage();
-        const disk = storage.location(env['EXTENSIONS_LOCATION']);
-        // Make sure we don't overload the file handles
-        const queue = new Queue({ concurrency: 1000 });
-        for await (const filepath of disk.list(storageExtensionsPath)) {
-            const readStream = await disk.read(filepath);
-            // We want files to be stored in the root of `$TEMP_PATH/extensions`, so gotta remove the
-            // extensions path on disk from the start of the file path
-            const destPath = join(extensionsPath, relative(resolve(sep, storageExtensionsPath), resolve(sep, filepath)));
-            // Ensure that the directory path exists
-            await mkdir(dirname(destPath), { recursive: true });
-            const writeStream = createWriteStream(destPath);
-            queue.add(() => pipeline(readStream, writeStream));
-        }
-        await queue.onIdle();
-        await setSyncStatus(SyncStatus.DONE);
-        messenger.publish(machineKey, { ready: true });
-    }
-    finally {
-        await lock.delete(machineKey);
-    }
-};

package/dist/extensions/lib/sync-status.d.ts

@@ -1,10 +0,0 @@
-export declare enum SyncStatus {
-    UNKNOWN = "UNKNOWN",
-    SYNCING = "SYNCING",
-    DONE = "DONE"
-}
-/**
- * Retrieves the sync status from the `.status` file in the local extensions folder
- */
-export declare const getSyncStatus: () => Promise<string>;
-export declare const setSyncStatus: (status: SyncStatus) => Promise<void>;

package/dist/extensions/lib/sync-status.js

@@ -1,27 +0,0 @@
-import { exists } from 'fs-extra';
-import { readFile, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { getExtensionsPath } from './get-extensions-path.js';
-export var SyncStatus;
-(function (SyncStatus) {
-    SyncStatus["UNKNOWN"] = "UNKNOWN";
-    SyncStatus["SYNCING"] = "SYNCING";
-    SyncStatus["DONE"] = "DONE";
-})(SyncStatus || (SyncStatus = {}));
-/**
- * Retrieves the sync status from the `.status` file in the local extensions folder
- */
-export const getSyncStatus = async () => {
-    const statusFilePath = join(getExtensionsPath(), '.status');
-    if (await exists(statusFilePath)) {
-        const status = await readFile(statusFilePath, 'utf8');
-        return status;
-    }
-    else {
-        return SyncStatus.UNKNOWN;
-    }
-};
-export const setSyncStatus = async (status) => {
-    const statusFilePath = join(getExtensionsPath(), '.status');
-    await writeFile(statusFilePath, status);
-};

package/dist/mcp/tools/index.d.ts

@@ -1,15 +0,0 @@
-import type { ToolConfig } from '../types.js';
-import { collections } from './collections.js';
-import { fields } from './fields.js';
-import { files } from './files.js';
-import { flows } from './flows.js';
-import { items } from './items.js';
-import { operations } from './operations.js';
-import { relations } from './relations.js';
-import { schema } from './schema.js';
-import { system } from './system.js';
-import { triggerFlow } from './trigger-flow.js';
-export declare const ALL_TOOLS: ToolConfig<any>[];
-export declare const getAllMcpTools: () => ToolConfig<any>[];
-export declare const findMcpTool: (name: string) => ToolConfig<any> | undefined;
-export { collections, fields, files, flows, items, operations, relations, schema, system, triggerFlow };

package/dist/mcp/tools/index.js

@@ -1,29 +0,0 @@
-import { assets } from './assets.js';
-import { collections } from './collections.js';
-import { fields } from './fields.js';
-import { files } from './files.js';
-import { flows } from './flows.js';
-import { folders } from './folders.js';
-import { items } from './items.js';
-import { operations } from './operations.js';
-import { relations } from './relations.js';
-import { schema } from './schema.js';
-import { system } from './system.js';
-import { triggerFlow } from './trigger-flow.js';
-export const ALL_TOOLS = [
-    system,
-    items,
-    files,
-    folders,
-    assets,
-    flows,
-    triggerFlow,
-    operations,
-    schema,
-    collections,
-    fields,
-    relations,
-];
-export const getAllMcpTools = () => ALL_TOOLS;
-export const findMcpTool = (name) => ALL_TOOLS.find((tool) => tool.name === name);
-export { collections, fields, files, flows, items, operations, relations, schema, system, triggerFlow };

package/dist/mcp/tools/prompts/index.d.ts

@@ -1,16 +0,0 @@
-declare const _default: {
-    assets: string;
-    collections: string;
-    fields: string;
-    files: string;
-    folders: string;
-    flows: string;
-    items: string;
-    operations: string;
-    relations: string;
-    schema: string;
-    systemPrompt: string;
-    systemPromptDescription: string;
-    triggerFlow: string;
-};
-export default _default;

package/dist/mcp/tools/prompts/index.js

@@ -1,19 +0,0 @@
-import fse from 'fs-extra';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-export default {
-    assets: fse.readFileSync(join(__dirname, 'assets.md'), 'utf8'),
-    collections: fse.readFileSync(join(__dirname, 'collections.md'), 'utf8'),
-    fields: fse.readFileSync(join(__dirname, 'fields.md'), 'utf8'),
-    files: fse.readFileSync(join(__dirname, 'files.md'), 'utf8'),
-    folders: fse.readFileSync(join(__dirname, 'folders.md'), 'utf8'),
-    flows: fse.readFileSync(join(__dirname, 'flows.md'), 'utf8'),
-    items: fse.readFileSync(join(__dirname, 'items.md'), 'utf8'),
-    operations: fse.readFileSync(join(__dirname, 'operations.md'), 'utf8'),
-    relations: fse.readFileSync(join(__dirname, 'relations.md'), 'utf8'),
-    schema: fse.readFileSync(join(__dirname, 'schema.md'), 'utf8'),
-    systemPrompt: fse.readFileSync(join(__dirname, 'system-prompt.md'), 'utf8'),
-    systemPromptDescription: fse.readFileSync(join(__dirname, 'system-prompt-description.md'), 'utf8'),
-    triggerFlow: fse.readFileSync(join(__dirname, 'trigger-flow.md'), 'utf8'),
-};

package/dist/permissions/modules/fetch-global-access/lib/fetch-global-access-for-roles.d.ts

@@ -1,5 +0,0 @@
-import type { Accountability } from '@directus/types';
-import type { Knex } from 'knex';
-import type { GlobalAccess } from '../types.js';
-export declare const fetchGlobalAccessForRoles: typeof _fetchGlobalAccessForRoles;
-export declare function _fetchGlobalAccessForRoles(accountability: Pick<Accountability, 'roles' | 'ip'>, knex: Knex): Promise<GlobalAccess>;

package/dist/permissions/modules/fetch-global-access/lib/fetch-global-access-for-roles.js

@@ -1,7 +0,0 @@
-import { withCache } from '../../../utils/with-cache.js';
-import { fetchGlobalAccessForQuery } from '../utils/fetch-global-access-for-query.js';
-export const fetchGlobalAccessForRoles = withCache('global-access-role', _fetchGlobalAccessForRoles, ({ roles, ip }) => ({ roles, ip }));
-export async function _fetchGlobalAccessForRoles(accountability, knex) {
-    const query = knex.where('role', 'in', accountability.roles);
-    return await fetchGlobalAccessForQuery(query, accountability);
-}

package/dist/permissions/modules/fetch-global-access/lib/fetch-global-access-for-user.d.ts

@@ -1,5 +0,0 @@
-import type { Accountability } from '@directus/types';
-import type { Knex } from 'knex';
-import type { GlobalAccess } from '../types.js';
-export declare const fetchGlobalAccessForUser: typeof _fetchGlobalAccessForUser;
-export declare function _fetchGlobalAccessForUser(accountability: Pick<Accountability, 'user' | 'ip'>, knex: Knex): Promise<GlobalAccess>;

package/dist/permissions/modules/fetch-global-access/lib/fetch-global-access-for-user.js

@@ -1,10 +0,0 @@
-import { withCache } from '../../../utils/with-cache.js';
-import { fetchGlobalAccessForQuery } from '../utils/fetch-global-access-for-query.js';
-export const fetchGlobalAccessForUser = withCache('global-access-user', _fetchGlobalAccessForUser, ({ user, ip }) => ({
-    user,
-    ip,
-}));
-export async function _fetchGlobalAccessForUser(accountability, knex) {
-    const query = knex.where('user', '=', accountability.user);
-    return await fetchGlobalAccessForQuery(query, accountability);
-}

package/dist/permissions/modules/fetch-global-access/types.d.ts

@@ -1,4 +0,0 @@
-export interface GlobalAccess {
-    app: boolean;
-    admin: boolean;
-}

package/dist/permissions/modules/fetch-global-access/utils/fetch-global-access-for-query.d.ts

@@ -1,4 +0,0 @@
-import type { Accountability } from '@directus/types';
-import type { Knex } from 'knex';
-import type { GlobalAccess } from '../types.js';
-export declare function fetchGlobalAccessForQuery(query: Knex.QueryBuilder<any, any[]>, accountability: Pick<Accountability, 'ip'>): Promise<GlobalAccess>;

package/dist/permissions/modules/fetch-global-access/utils/fetch-global-access-for-query.js

@@ -1,27 +0,0 @@
-import { toBoolean, toArray } from '@directus/utils';
-import { ipInNetworks } from '../../../../utils/ip-in-networks.js';
-export async function fetchGlobalAccessForQuery(query, accountability) {
-    const globalAccess = {
-        app: false,
-        admin: false,
-    };
-    const accessRows = await query
-        .select('directus_policies.admin_access', 'directus_policies.app_access', 'directus_policies.ip_access')
-        .from('directus_access')
-        // @NOTE: `where` clause comes from the caller
-        .leftJoin('directus_policies', 'directus_policies.id', 'directus_access.policy');
-    // Additively merge access permissions
-    for (const { admin_access, app_access, ip_access } of accessRows) {
-        if (accountability.ip && ip_access) {
-            // Skip row if IP is not in the allowed networks
-            const networks = toArray(ip_access);
-            if (!ipInNetworks(accountability.ip, networks))
-                continue;
-        }
-        globalAccess.admin ||= toBoolean(admin_access);
-        globalAccess.app ||= globalAccess.admin || toBoolean(app_access);
-        if (globalAccess.admin)
-            break;
-    }
-    return globalAccess;
-}

package/dist/utils/get-date-formatted.d.ts

@@ -1 +0,0 @@
-export declare function getDateFormatted(): string;

package/dist/utils/get-date-formatted.js

@@ -1,10 +0,0 @@
-export function getDateFormatted() {
-    const date = new Date();
-    let month = String(date.getMonth() + 1);
-    if (month.length === 1)
-        month = '0' + month;
-    let day = String(date.getDate());
-    if (day.length === 1)
-        day = '0' + day;
-    return `${date.getFullYear()}${month}${day}-${date.getHours()}${date.getMinutes()}${date.getSeconds()}`;
-}

package/dist/utils/ip-in-networks.d.ts

@@ -1,6 +0,0 @@
-/**
- * Checks if an IP address is contained in a list of networks
- * @param networks List of IP addresses (192.168.0.1), CIDR notations (192.168.0.0/24) or IP ranges (192-168.0.0-192.168.2.0)
- * @throws Will throw if list contains invalid network definitions
- */
-export declare function ipInNetworks(ip: string, networks: string[]): boolean;

package/dist/utils/ip-in-networks.js

@@ -1,13 +0,0 @@
-import { matches } from 'ip-matching';
-/**
- * Checks if an IP address is contained in a list of networks
- * @param networks List of IP addresses (192.168.0.1), CIDR notations (192.168.0.0/24) or IP ranges (192-168.0.0-192.168.2.0)
- * @throws Will throw if list contains invalid network definitions
- */
-export function ipInNetworks(ip, networks) {
-    for (const allowedIp of networks) {
-        if (matches(ip, allowedIp))
-            return true;
-    }
-    return false;
-}