@directus/api 33.0.0 → 33.1.0

package/dist/websocket/collab/verify-permissions.js

@@ -0,0 +1,100 @@
+import { useLogger } from '../../logger/index.js';
+import { fetchPermissions } from '../../permissions/lib/fetch-permissions.js';
+import { fetchPolicies } from '../../permissions/lib/fetch-policies.js';
+import { fetchAllowedFields } from '../../permissions/modules/fetch-allowed-fields/fetch-allowed-fields.js';
+import { validateItemAccess } from '../../permissions/modules/validate-access/lib/validate-item-access.js';
+import { extractRequiredDynamicVariableContextForPermissions } from '../../permissions/utils/extract-required-dynamic-variable-context.js';
+import { fetchDynamicVariableData } from '../../permissions/utils/fetch-dynamic-variable-data.js';
+import { processPermissions } from '../../permissions/utils/process-permissions.js';
+import { getService } from '../../utils/get-service.js';
+import { calculateCacheMetadata } from './calculate-cache-metadata.js';
+import { filterToFields } from './filter-to-fields.js';
+import { permissionCache } from './permissions-cache.js';
+/**
+ * Verify if a client has permissions to perform an action on the item.
+ * - `string[]`: List of fields the client has access to, empty if item exists but access is restricted.
+ * - `null`: Indicates the item doesn't exist.
+ */
+export async function verifyPermissions(accountability, collection, item, action = 'read', options) {
+    if (!accountability)
+        return [];
+    const { schema, knex } = options;
+    if (!schema.collections[collection])
+        return [];
+    if (accountability.admin)
+        return ['*'];
+    const cached = permissionCache.get(accountability, collection, String(item), action);
+    if (cached !== undefined)
+        return cached;
+    // Prevent caching stale permissions if invalidation occurs during async steps
+    const startInvalidationCount = permissionCache.getInvalidationCount();
+    let itemData = null;
+    try {
+        const adminService = getService(collection, { schema, knex });
+        const policies = await fetchPolicies(accountability, { knex, schema });
+        const rawPermissions = await fetchPermissions({ action, collections: [collection], policies, accountability, bypassDynamicVariableProcessing: true }, { knex, schema });
+        // Check for item-level rules to skip DB fetch
+        const hasItemRules = rawPermissions.some((p) => p.permissions && Object.keys(p.permissions).length > 0);
+        if (hasItemRules) {
+            // Resolve dynamic variables used in the permission filters
+            const dynamicVariableContext = extractRequiredDynamicVariableContextForPermissions(rawPermissions);
+            const permissionsContext = await fetchDynamicVariableData({ accountability, policies, dynamicVariableContext }, { knex, schema });
+            const processedPermissions = processPermissions({
+                permissions: rawPermissions,
+                accountability,
+                permissionsContext,
+            });
+            const fieldsToFetch = processedPermissions
+                .map((perm) => (perm.permissions ? filterToFields(perm.permissions, collection, schema) : []))
+                .flat();
+            // Fetch current item data to evaluate any conditional permission filters based on record state
+            if (item && action !== 'create') {
+                try {
+                    itemData = await adminService.readOne(item, {
+                        fields: fieldsToFetch,
+                    });
+                }
+                catch {
+                    // Item doesn't exist
+                    permissionCache.set(accountability, collection, String(item), action, null, []);
+                    return null;
+                }
+            }
+            else if (schema.collections[collection]?.singleton && action !== 'create') {
+                const pkField = schema.collections[collection].primary;
+                if (pkField) {
+                    if (Array.from(fieldsToFetch).some((field) => field === '*' || field === pkField) === false) {
+                        fieldsToFetch.push(pkField);
+                    }
+                }
+                itemData = await adminService.readSingleton({ fields: fieldsToFetch });
+            }
+        }
+        let allowedFields = [];
+        if ((item || schema.collections[collection]?.singleton) && hasItemRules) {
+            const primaryKeys = item ? [item] : [];
+            const validationContext = {
+                collection,
+                accountability,
+                action,
+                primaryKeys,
+                returnAllowedRootFields: true,
+            };
+            allowedFields = (await validateItemAccess(validationContext, { knex, schema })).allowedRootFields || [];
+        }
+        else {
+            allowedFields = await fetchAllowedFields({ accountability, action, collection }, { knex, schema });
+        }
+        // Only cache if the state hasn't been invalidated by another operation in the meantime
+        if (permissionCache.getInvalidationCount() === startInvalidationCount) {
+            // Determine TTL and relational dependencies for cache invalidation
+            const { ttlMs, dependencies } = calculateCacheMetadata(collection, itemData, rawPermissions, schema, accountability);
+            permissionCache.set(accountability, collection, String(item), action, allowedFields, dependencies, ttlMs);
+        }
+        return allowedFields;
+    }
+    catch (err) {
+        useLogger().error(err, `[Collab] verifyPermissions failed for user "${accountability.user}", collection "${collection}", and item "${item}"`);
+        return [];
+    }
+}

package/dist/websocket/handlers/index.d.ts

@@ -1,4 +1,6 @@
+import { CollabHandler } from '../collab/collab.js';
 export declare function startWebSocketHandlers(): void;
+export declare function getCollabHandler(): CollabHandler | undefined;
 export * from './heartbeat.js';
 export * from './items.js';
 export * from './logs.js';

package/dist/websocket/handlers/index.js

@@ -1,15 +1,18 @@
 import { useEnv } from '@directus/env';
 import { toBoolean } from '@directus/utils';
+import { CollabHandler } from '../collab/collab.js';
 import { HeartbeatHandler } from './heartbeat.js';
 import { ItemsHandler } from './items.js';
 import { LogsHandler } from './logs.js';
 import { SubscribeHandler } from './subscribe.js';
+let collabHandler;
 export function startWebSocketHandlers() {
     const env = useEnv();
     const heartbeatEnabled = toBoolean(env['WEBSOCKETS_HEARTBEAT_ENABLED']);
     const restEnabled = toBoolean(env['WEBSOCKETS_REST_ENABLED']);
     const graphqlEnabled = toBoolean(env['WEBSOCKETS_GRAPHQL_ENABLED']);
     const logsEnabled = toBoolean(env['WEBSOCKETS_LOGS_ENABLED']);
+    const collabEnabled = toBoolean(env['WEBSOCKETS_COLLAB_ENABLED']);
     if (restEnabled && heartbeatEnabled) {
         new HeartbeatHandler();
     }
@@ -22,6 +25,12 @@ export function startWebSocketHandlers() {
     if (logsEnabled) {
         new LogsHandler();
     }
+    if (collabEnabled) {
+        collabHandler = new CollabHandler();
+    }
+}
+export function getCollabHandler() {
+    return collabHandler;
 }
 export * from './heartbeat.js';
 export * from './items.js';

package/dist/websocket/utils/items.d.ts

@@ -20,7 +20,7 @@ export declare function getPayload(subscription: PSubscription, accountability:
  * @param event Event data
  * @returns the fetched collection data
  */
-export declare function getCollectionPayload(subscription: PSubscription, accountability: Accountability | null, schema: SchemaOverview, event?: WebSocketEvent): Promise<string | number | import("../../types/collection.js").Collection | (string | number)[] | import("../../types/collection.js").Collection[]>;
+export declare function getCollectionPayload(subscription: PSubscription, accountability: Accountability | null, schema: SchemaOverview, event?: WebSocketEvent): Promise<string | number | (string | number)[] | import("../../types/collection.js").Collection | import("../../types/collection.js").Collection[]>;
 /**
  * Get fields items
  *
@@ -29,7 +29,7 @@ export declare function getCollectionPayload(subscription: PSubscription, accoun
  * @param event Event data
  * @returns the fetched field data
  */
-export declare function getFieldsPayload(subscription: PSubscription, accountability: Accountability | null, schema: SchemaOverview, event?: WebSocketEvent): Promise<string | number | Record<string, any> | import("@directus/types").Field[] | (string | number)[]>;
+export declare function getFieldsPayload(subscription: PSubscription, accountability: Accountability | null, schema: SchemaOverview, event?: WebSocketEvent): Promise<string | number | Record<string, any> | (string | number)[] | import("@directus/types").Field[]>;
 /**
  * Get items from a collection using the appropriate service
  *

package/dist/websocket/utils/message.d.ts

@@ -1,4 +1,4 @@
 import type { WebSocketClient } from '../types.js';
 export declare const fmtMessage: (type: string, data?: Record<string, any>, uid?: string | number) => string;
 export declare const safeSend: (client: WebSocketClient, data: string, delay?: number) => Promise<unknown>;
-export declare const getMessageType: (message: any) => string;
+export declare function getMessageType(message: unknown): string;

package/dist/websocket/utils/message.js

@@ -22,6 +22,6 @@ export const safeSend = async (client, data, delay = 100) => {
     return true;
 };
 // an often used message type extractor function
-export const getMessageType = (message) => {
+export function getMessageType(message) {
     return typeof message !== 'object' || Array.isArray(message) || message === null ? '' : String(message.type);
-};
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@directus/api",
-  "version": "33.0.0",
+  "version": "33.1.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "keywords": [
     "directus",
@@ -58,19 +58,21 @@
     "dist"
   ],
   "dependencies": {
-    "@ai-sdk/anthropic": "3.0.0-beta.53",
-    "@ai-sdk/openai": "3.0.0-beta.57",
+    "@ai-sdk/anthropic": "3.0.9",
+    "@ai-sdk/google": "3.0.6",
+    "@ai-sdk/openai": "3.0.7",
+    "@ai-sdk/openai-compatible": "2.0.4",
     "@authenio/samlify-node-xmllint": "2.0.0",
     "@aws-sdk/client-sesv2": "3.928.0",
     "@godaddy/terminus": "4.12.1",
-    "@modelcontextprotocol/sdk": "1.24.0",
+    "@modelcontextprotocol/sdk": "1.26.0",
     "@rollup/plugin-alias": "5.1.1",
     "@rollup/plugin-node-resolve": "16.0.3",
     "@rollup/plugin-virtual": "3.0.2",
     "@tus/server": "2.3.0",
     "@tus/utils": "0.6.0",
+    "ai": "6.0.25",
     "archiver": "7.0.1",
-    "ai": "6.0.0-beta.98",
     "argon2": "0.44.0",
     "async": "3.2.6",
     "async-mutex": "0.5.0",
@@ -114,7 +116,7 @@
     "jsonwebtoken": "9.0.3",
     "keyv": "5.5.3",
     "knex": "3.1.0",
-    "ldapjs": "2.3.3",
+    "ldapts": "8.1.3",
     "liquidjs": "10.24.0",
     "lodash-es": "4.17.21",
     "marked": "16.4.1",
@@ -138,10 +140,10 @@
     "pino-http": "10.5.0",
     "pino-http-print": "3.1.0",
     "pino-pretty": "13.1.2",
-    "pm2": "6.0.13",
+    "pm2": "6.0.14",
     "prom-client": "15.1.3",
     "proxy-addr": "2.0.7",
-    "qs": "6.14.0",
+    "qs": "6.14.1",
     "rate-limiter-flexible": "7.2.0",
     "rolldown": "1.0.0-beta.31",
     "rollup": "4.52.5",
@@ -151,37 +153,38 @@
     "sharp": "0.34.5",
     "snappy": "7.3.3",
     "stream-json": "1.9.1",
-    "tar": "7.5.2",
+    "tar": "7.5.4",
     "tsx": "4.20.6",
     "uuid": "11.1.0",
     "wellknown": "0.5.0",
     "ws": "8.18.3",
     "zod": "4.1.12",
     "zod-validation-error": "4.0.2",
-    "@directus/app": "15.0.0",
+    "@directus/ai": "1.1.0",
+    "@directus/app": "15.1.0",
+    "@directus/env": "5.5.0",
+    "@directus/extensions": "3.0.17",
     "@directus/constants": "14.0.0",
-    "@directus/env": "5.4.0",
-    "@directus/extensions": "3.0.16",
-    "@directus/extensions-registry": "3.0.16",
-    "@directus/errors": "2.1.0",
-    "@directus/extensions-sdk": "17.0.5",
-    "@directus/memory": "3.0.14",
+    "@directus/errors": "2.2.0",
+    "@directus/extensions-registry": "3.0.17",
+    "@directus/memory": "3.1.0",
     "@directus/format-title": "12.1.1",
-    "@directus/pressure": "3.0.14",
+    "@directus/pressure": "3.0.15",
     "@directus/schema": "13.0.5",
-    "@directus/schema-builder": "0.0.11",
+    "@directus/extensions-sdk": "17.0.6",
+    "@directus/schema-builder": "0.0.12",
     "@directus/specs": "12.0.0",
     "@directus/storage": "12.0.3",
-    "@directus/storage-driver-azure": "12.0.14",
-    "@directus/storage-driver-gcs": "12.0.14",
+    "@directus/storage-driver-azure": "12.0.15",
+    "@directus/storage-driver-s3": "12.1.1",
+    "@directus/storage-driver-gcs": "12.0.15",
     "@directus/storage-driver-local": "12.0.3",
-    "@directus/storage-driver-cloudinary": "12.0.14",
-    "@directus/storage-driver-s3": "12.1.0",
-    "@directus/system-data": "4.0.0",
-    "@directus/utils": "13.1.1",
-    "@directus/validation": "2.0.14",
-    "directus": "11.14.1",
-    "@directus/storage-driver-supabase": "3.0.14"
+    "@directus/storage-driver-supabase": "3.0.15",
+    "@directus/system-data": "4.1.0",
+    "@directus/utils": "13.2.0",
+    "directus": "11.15.0",
+    "@directus/validation": "2.0.15",
+    "@directus/storage-driver-cloudinary": "12.0.15"
   },
   "devDependencies": {
     "@directus/tsconfig": "3.0.0",
@@ -204,7 +207,6 @@
     "@types/js-yaml": "4.0.9",
     "@types/json2csv": "5.0.7",
     "@types/jsonwebtoken": "9.0.10",
-    "@types/ldapjs": "2.2.5",
     "@types/lodash-es": "4.17.12",
     "@types/mime-types": "3.0.1",
     "@types/ms": "2.1.0",
@@ -225,8 +227,8 @@
     "knex-mock-client": "3.0.2",
     "typescript": "5.9.3",
     "vitest": "3.2.4",
-    "@directus/schema-builder": "0.0.11",
-    "@directus/types": "14.0.0"
+    "@directus/schema-builder": "0.0.12",
+    "@directus/types": "14.1.0"
   },
   "optionalDependencies": {
     "@keyv/redis": "3.0.1",

package/dist/utils/get-relation-info.d.ts

@@ -1,6 +0,0 @@
-import type { Relation } from '@directus/types';
-export type RelationInfo = {
-    relation: Relation | null;
-    relationType: 'o2m' | 'm2o' | 'a2o' | 'o2a' | null;
-};
-export declare function getRelationInfo(relations: Relation[], collection: string, field: string): RelationInfo;

package/dist/utils/get-relation-info.js

@@ -1,43 +0,0 @@
-import { getRelation } from '@directus/utils';
-import { getRelationType } from './get-relation-type.js';
-function checkImplicitRelation(field) {
-    if (field.startsWith('$FOLLOW(') && field.endsWith(')')) {
-        return field.slice(8, -1).split(',');
-    }
-    return null;
-}
-export function getRelationInfo(relations, collection, field) {
-    if (field.startsWith('$FOLLOW') && field.length > 500) {
-        throw new Error(`Implicit $FOLLOW statement is too big to parse. Got: "${field.substring(500)}..."`);
-    }
-    const implicitRelation = checkImplicitRelation(field);
-    if (implicitRelation) {
-        if (implicitRelation[2] === undefined) {
-            const [m2oCollection, m2oField] = implicitRelation;
-            const relation = {
-                collection: m2oCollection.trim(),
-                field: m2oField.trim(),
-                related_collection: collection,
-                schema: null,
-                meta: null,
-            };
-            return { relation, relationType: 'o2m' };
-        }
-        else {
-            const [a2oCollection, a2oItemField, a2oCollectionField] = implicitRelation;
-            const relation = {
-                collection: a2oCollection.trim(),
-                field: a2oItemField.trim(),
-                related_collection: collection,
-                schema: null,
-                meta: {
-                    one_collection_field: a2oCollectionField.trim(),
-                },
-            };
-            return { relation, relationType: 'o2a' };
-        }
-    }
-    const relation = getRelation(relations, collection, field) ?? null;
-    const relationType = relation ? getRelationType({ relation, collection, field }) : null;
-    return { relation, relationType };
-}

package/dist/utils/get-relation-type.d.ts

@@ -1,6 +0,0 @@
-import type { Relation } from '@directus/types';
-export declare function getRelationType(getRelationOptions: {
-    relation?: Relation | null;
-    collection: string | null;
-    field: string;
-}): 'm2o' | 'o2m' | 'a2o' | null;

package/dist/utils/get-relation-type.js

@@ -1,18 +0,0 @@
-export function getRelationType(getRelationOptions) {
-    const { relation, collection, field } = getRelationOptions;
-    if (!relation)
-        return null;
-    if (relation.collection === collection &&
-        relation.field === field &&
-        relation.meta?.one_collection_field &&
-        relation.meta?.one_allowed_collections) {
-        return 'a2o';
-    }
-    if (relation.collection === collection && relation.field === field) {
-        return 'm2o';
-    }
-    if (relation.related_collection === collection && relation.meta?.one_field === field) {
-        return 'o2m';
-    }
-    return null;
-}

package/dist/utils/versioning/deep-map-with-schema.d.ts

@@ -1,23 +0,0 @@
-import type { CollectionOverview, FieldOverview, Relation, SchemaOverview } from '@directus/types';
-import { type RelationInfo } from '../get-relation-info.js';
-/**
- * Allows to deep map the data like a response or delta changes with collection, field and relation context for each entry.
- * Bottom to Top depth first mapping of values.
- */
-export declare function deepMapWithSchema(object: Record<string, any>, callback: (entry: [key: string | number, value: unknown], context: {
-    collection: CollectionOverview;
-    field: FieldOverview;
-    relation: Relation | null;
-    leaf: boolean;
-    relationType: RelationInfo['relationType'] | null;
-    object: Record<string, any>;
-}) => [key: string | number, value: unknown] | undefined, context: {
-    schema: SchemaOverview;
-    collection: string;
-    relationInfo?: RelationInfo;
-}, options?: {
-    /** If set to true, non-existent fields will be included in the mapping and will have a value of undefined */
-    mapNonExistentFields?: boolean;
-    /** If set to true, it will map the "create", "update" and "delete" syntax for o2m relations found in deltas */
-    detailedUpdateSyntax?: boolean;
-}): any;

package/dist/utils/versioning/deep-map-with-schema.js

@@ -1,81 +0,0 @@
-import assert from 'node:assert';
-import { InvalidQueryError } from '@directus/errors';
-import { isPlainObject } from 'lodash-es';
-import { getRelationInfo } from '../get-relation-info.js';
-/**
- * Allows to deep map the data like a response or delta changes with collection, field and relation context for each entry.
- * Bottom to Top depth first mapping of values.
- */
-export function deepMapWithSchema(object, callback, context, options) {
-    const collection = context.schema.collections[context.collection];
-    assert(isPlainObject(object) && typeof object === 'object' && object !== null, `DeepMapResponse only works on objects, received ${JSON.stringify(object)}`);
-    let fields;
-    if (options?.mapNonExistentFields) {
-        fields = Object.entries(collection.fields);
-    }
-    else {
-        fields = Object.keys(object).map((key) => [key, collection.fields[key]]);
-    }
-    return Object.fromEntries(fields
-        .map(([key, field]) => {
-        let value = object[key];
-        if (!field)
-            return [key, value];
-        const relationInfo = getRelationInfo(context.schema.relations, collection.collection, field.field);
-        let leaf = true;
-        if (relationInfo.relation && typeof value === 'object' && value !== null && isPlainObject(object)) {
-            switch (relationInfo.relationType) {
-                case 'm2o':
-                    value = deepMapWithSchema(value, callback, {
-                        schema: context.schema,
-                        collection: relationInfo.relation.related_collection,
-                        relationInfo,
-                    }, options);
-                    leaf = false;
-                    break;
-                case 'o2m': {
-                    function map(childValue) {
-                        if (isPlainObject(childValue) && typeof childValue === 'object' && childValue !== null) {
-                            leaf = false;
-                            return deepMapWithSchema(childValue, callback, {
-                                schema: context.schema,
-                                collection: relationInfo.relation.collection,
-                                relationInfo,
-                            }, options);
-                        }
-                        else
-                            return childValue;
-                    }
-                    if (Array.isArray(value)) {
-                        value = value.map(map);
-                    }
-                    else if (options?.detailedUpdateSyntax && isPlainObject(value)) {
-                        value = {
-                            create: value['create']?.map(map),
-                            update: value['update']?.map(map),
-                            delete: value['delete']?.map(map),
-                        };
-                    }
-                    break;
-                }
-                case 'a2o': {
-                    const related_collection = object[relationInfo.relation.meta.one_collection_field];
-                    if (!related_collection) {
-                        throw new InvalidQueryError({
-                            reason: `When selecting '${collection.collection}.${field.field}', the field '${collection.collection}.${relationInfo.relation.meta.one_collection_field}' has to be selected when using versioning and m2a relations `,
-                        });
-                    }
-                    value = deepMapWithSchema(value, callback, {
-                        schema: context.schema,
-                        collection: related_collection,
-                        relationInfo,
-                    }, options);
-                    leaf = false;
-                    break;
-                }
-            }
-        }
-        return callback([key, value], { collection, field, ...relationInfo, leaf, object });
-    })
-        .filter((f) => f));
-}