@directus/api 35.0.2 → 35.1.0

package/dist/permissions/lib/fetch-policies.js

@@ -14,13 +14,10 @@ async function _fetchPolicies({ roles, user, ip }, context) {
 	const { AccessService } = await import("../../services/access.js");
 	const accessService = new AccessService(context);
 	let roleFilter;
-	if (roles.length === 0) {
-		roleFilter = { _and: [{ role: { _null: true } }, { user: { _null: true } }] };
-	} else {
-		roleFilter = { role: { _in: roles } };
-	}
+	if (roles.length === 0) roleFilter = { _and: [{ role: { _null: true } }, { user: { _null: true } }] };
+	else roleFilter = { role: { _in: roles } };
 	const filter = user ? { _or: [{ user: { _eq: user } }, roleFilter] } : roleFilter;
-	const accessRows = await accessService.readByQuery({
+	const filteredAccessRows = filterPoliciesByIp(await accessService.readByQuery({
 		filter,
 		fields: [
 			"policy.id",
@@ -28,16 +25,14 @@ async function _fetchPolicies({ roles, user, ip }, context) {
 			"role"
 		],
 		limit: -1
-	});
-	const filteredAccessRows = filterPoliciesByIp(accessRows, ip);
+	}), ip);
 	filteredAccessRows.sort((a, b) => {
 		if (!a.role && !b.role) return 0;
 		if (!a.role) return 1;
 		if (!b.role) return -1;
 		return roles.indexOf(a.role) - roles.indexOf(b.role);
 	});
-	const ids = filteredAccessRows.map(({ policy }) => policy.id);
-	return ids;
+	return filteredAccessRows.map(({ policy }) => policy.id);
 }
 
 //#endregion

package/dist/permissions/modules/fetch-accountability-collection-access/fetch-accountability-collection-access.js

@@ -9,47 +9,34 @@ import { PERMISSION_ACTIONS } from "@directus/constants";
 * The permissions will be filtered by IP access.
 */
 async function fetchAccountabilityCollectionAccess(accountability, context) {
-	if (accountability.admin) {
-		return mapValues(context.schema.collections, () => Object.fromEntries(PERMISSION_ACTIONS.map((action) => [action, {
-			access: "full",
-			fields: ["*"]
-		}])));
-	}
-	const policies = await fetchPolicies(accountability, context);
+	if (accountability.admin) return mapValues(context.schema.collections, () => Object.fromEntries(PERMISSION_ACTIONS.map((action) => [action, {
+		access: "full",
+		fields: ["*"]
+	}])));
 	const permissions = await fetchPermissions({
-		policies,
+		policies: await fetchPolicies(accountability, context),
 		accountability
 	}, context);
 	const infos = {};
 	for (const perm of permissions) {
-		if (!infos[perm.collection]) {
-			infos[perm.collection] = {
-				read: { access: "none" },
-				create: { access: "none" },
-				update: { access: "none" },
-				delete: { access: "none" },
-				share: { access: "none" }
-			};
-		}
-		if (infos[perm.collection][perm.action]?.access === "none") {
-			infos[perm.collection][perm.action].access = "full";
-		}
+		if (!infos[perm.collection]) infos[perm.collection] = {
+			read: { access: "none" },
+			create: { access: "none" },
+			update: { access: "none" },
+			delete: { access: "none" },
+			share: { access: "none" }
+		};
+		if (infos[perm.collection][perm.action]?.access === "none") infos[perm.collection][perm.action].access = "full";
 		const info = infos[perm.collection][perm.action];
-		if (info.access === "full" && perm.permissions && Object.keys(perm.permissions).length > 0) {
-			info.access = "partial";
-		}
+		if (info.access === "full" && perm.permissions && Object.keys(perm.permissions).length > 0) info.access = "partial";
 		if (perm.fields && info.fields?.[0] !== "*") {
 			info.fields = uniq([...info.fields || [], ...perm.fields || []]);
-			if (info.fields.includes("*")) {
-				info.fields = ["*"];
-			}
-		}
-		if (perm.presets) {
-			info.presets = {
-				...info.presets ?? {},
-				...perm.presets
-			};
+			if (info.fields.includes("*")) info.fields = ["*"];
 		}
+		if (perm.presets) info.presets = {
+			...info.presets ?? {},
+			...perm.presets
+		};
 	}
 	return infos;
 }

package/dist/permissions/modules/fetch-allowed-collections/fetch-allowed-collections.js

@@ -4,23 +4,18 @@ import { uniq } from "lodash-es";
 
 //#region src/permissions/modules/fetch-allowed-collections/fetch-allowed-collections.ts
 async function fetchAllowedCollections({ action, accountability }, { knex, schema }) {
-	if (accountability.admin) {
-		return Object.keys(schema.collections);
-	}
-	const policies = await fetchPolicies(accountability, {
-		knex,
-		schema
-	});
-	const permissions = await fetchPermissions({
+	if (accountability.admin) return Object.keys(schema.collections);
+	return uniq((await fetchPermissions({
 		action,
-		policies,
+		policies: await fetchPolicies(accountability, {
+			knex,
+			schema
+		}),
 		accountability
 	}, {
 		knex,
 		schema
-	});
-	const collections = permissions.map(({ collection }) => collection);
-	return uniq(collections);
+	})).map(({ collection }) => collection));
 }
 
 //#endregion

package/dist/permissions/modules/fetch-allowed-field-map/fetch-allowed-field-map.js

@@ -6,34 +6,25 @@ import { uniq } from "lodash-es";
 async function fetchAllowedFieldMap({ accountability, action }, { knex, schema }) {
 	const fieldMap = {};
 	if (accountability.admin) {
-		for (const [collection, { fields }] of Object.entries(schema.collections)) {
-			fieldMap[collection] = Object.keys(fields);
-		}
+		for (const [collection, { fields }] of Object.entries(schema.collections)) fieldMap[collection] = Object.keys(fields);
 		return fieldMap;
 	}
-	const policies = await fetchPolicies(accountability, {
-		knex,
-		schema
-	});
 	const permissions = await fetchPermissions({
 		action,
-		policies,
+		policies: await fetchPolicies(accountability, {
+			knex,
+			schema
+		}),
 		accountability
 	}, {
 		knex,
 		schema
 	});
 	for (const { collection, fields } of permissions) {
-		if (!fieldMap[collection]) {
-			fieldMap[collection] = [];
-		}
-		if (fields) {
-			fieldMap[collection].push(...fields);
-		}
-	}
-	for (const [collection, fields] of Object.entries(fieldMap)) {
-		fieldMap[collection] = uniq(fields);
+		if (!fieldMap[collection]) fieldMap[collection] = [];
+		if (fields) fieldMap[collection].push(...fields);
 	}
+	for (const [collection, fields] of Object.entries(fieldMap)) fieldMap[collection] = uniq(fields);
 	return fieldMap;
 }
 

package/dist/permissions/modules/fetch-global-access/fetch-global-access.js

@@ -23,7 +23,7 @@ async function _fetchGlobalAccess(accountability, context) {
 		knex: context.knex,
 		ip: accountability.ip
 	});
-	if (accountability.user !== undefined) {
+	if (accountability.user !== void 0) {
 		const userAccess = await fetchGlobalAccessForUser$1(accountability.user, {
 			knex: context.knex,
 			ip: accountability.ip

package/dist/permissions/modules/fetch-inconsistent-field-map/fetch-inconsistent-field-map.js

@@ -9,18 +9,15 @@ import { difference, intersection, uniq } from "lodash-es";
 async function fetchInconsistentFieldMap({ accountability, action }, { knex, schema }) {
 	const fieldMap = {};
 	if (!accountability || accountability.admin) {
-		for (const collection of Object.keys(schema.collections)) {
-			fieldMap[collection] = [];
-		}
+		for (const collection of Object.keys(schema.collections)) fieldMap[collection] = [];
 		return fieldMap;
 	}
-	const policies = await fetchPolicies(accountability, {
-		knex,
-		schema
-	});
 	const permissions = await fetchPermissions({
 		action,
-		policies,
+		policies: await fetchPolicies(accountability, {
+			knex,
+			schema
+		}),
 		accountability
 	}, {
 		knex,
@@ -30,8 +27,7 @@ async function fetchInconsistentFieldMap({ accountability, action }, { knex, sch
 	for (const collection of collections) {
 		const fields = permissions.filter((permission) => permission.collection === collection).map((permission) => permission.fields ?? []);
 		const availableEverywhere = intersection(...fields);
-		const availableSomewhere = difference(uniq(fields.flat()), availableEverywhere);
-		fieldMap[collection] = availableSomewhere;
+		fieldMap[collection] = difference(uniq(fields.flat()), availableEverywhere);
 	}
 	return fieldMap;
 }

package/dist/permissions/modules/fetch-policies-ip-access/fetch-policies-ip-access.js

@@ -8,21 +8,15 @@ const fetchPoliciesIpAccess = withCache("policies-ip-access", _fetchPoliciesIpAc
 }));
 async function _fetchPoliciesIpAccess(accountability, knex) {
 	const query = knex("directus_access").select({ ip_access: "directus_policies.ip_access" }).leftJoin("directus_policies", "directus_access.policy", "directus_policies.id").whereNotNull("directus_policies.ip_access");
-	if (accountability.roles.length === 0 && !accountability.user) {
-		query.where({
-			role: null,
-			user: null
-		});
-	} else {
-		query.where(function() {
-			if (accountability.user) {
-				this.orWhere("directus_access.user", accountability.user);
-			}
-			this.orWhereIn("directus_access.role", accountability.roles);
-		});
-	}
-	const rows = await query;
-	return rows.filter(({ ip_access }) => ip_access).map(({ ip_access }) => toArray(ip_access));
+	if (accountability.roles.length === 0 && !accountability.user) query.where({
+		role: null,
+		user: null
+	});
+	else query.where(function() {
+		if (accountability.user) this.orWhere("directus_access.user", accountability.user);
+		this.orWhereIn("directus_access.role", accountability.roles);
+	});
+	return (await query).filter(({ ip_access }) => ip_access).map(({ ip_access }) => toArray(ip_access));
 }
 
 //#endregion

package/dist/permissions/modules/process-ast/lib/extract-fields-from-children.js

@@ -9,14 +9,8 @@ function extractFieldsFromChildren(collection, children, fieldMap, schema, path
 	for (const child of children) {
 		info.fields.add(getUnaliasedFieldKey(child));
 		if (child.type === "a2o") {
-			for (const [collection$1, children$1] of Object.entries(child.children)) {
-				extractFieldsFromChildren(collection$1, children$1, fieldMap, schema, [...path, formatA2oKey(child.fieldKey, collection$1)]);
-			}
-			if (child.query) {
-				for (const [collection$1, query] of Object.entries(child.query)) {
-					extractFieldsFromQuery(collection$1, query, fieldMap, schema, [...path, formatA2oKey(child.fieldKey, collection$1)]);
-				}
-			}
+			for (const [collection$1, children$1] of Object.entries(child.children)) extractFieldsFromChildren(collection$1, children$1, fieldMap, schema, [...path, formatA2oKey(child.fieldKey, collection$1)]);
+			if (child.query) for (const [collection$1, query] of Object.entries(child.query)) extractFieldsFromQuery(collection$1, query, fieldMap, schema, [...path, formatA2oKey(child.fieldKey, collection$1)]);
 		} else if (child.type === "m2o") {
 			extractFieldsFromChildren(child.relation.related_collection, child.children, fieldMap, schema, [...path, child.fieldKey]);
 			extractFieldsFromQuery(child.relation.related_collection, child.query, fieldMap, schema, [...path, child.fieldKey]);

package/dist/permissions/modules/process-ast/lib/extract-fields-from-query.js

@@ -11,42 +11,40 @@ function extractFieldsFromQuery(collection, query, fieldMap, schema, pathPrefix
 		other: otherPaths,
 		read: readOnlyPaths
 	};
-	for (const [group, paths] of Object.entries(groupedPaths)) {
-		for (const path of paths) {
-			/**
-			* Current path stack. For each iteration of the path loop this will be appended with the
-			* current part we're operating on. So when looping over ['category', 'created_by', 'name']
-			* the first iteration it'll be `['category']`, and then `['category', 'created_by']` etc.
-			*/
-			const stack = [];
+	for (const [group, paths] of Object.entries(groupedPaths)) for (const path of paths) {
+		/**
+		* Current path stack. For each iteration of the path loop this will be appended with the
+		* current part we're operating on. So when looping over ['category', 'created_by', 'name']
+		* the first iteration it'll be `['category']`, and then `['category', 'created_by']` etc.
+		*/
+		const stack = [];
+		/**
+		* Current collection the path part we're operating on lives in. Once we hit a relational
+		* field, this will be updated to the related collection, so we can follow the relational path
+		* left to right.
+		*/
+		let collectionContext = collection;
+		for (const part of path) {
+			const info = getInfoForPath(fieldMap, group, [...pathPrefix, ...stack], collectionContext);
+			if (part.includes(":")) {
+				const [fieldKey, collection$1] = part.split(":");
+				info.fields.add(fieldKey);
+				collectionContext = collection$1;
+				stack.push(part);
+				continue;
+			}
+			if (part.startsWith("$FOLLOW(") && part.endsWith(")")) {} else {
+				const { fieldName } = parseFilterKey(part);
+				info.fields.add(fieldName);
+			}
 			/**
-			* Current collection the path part we're operating on lives in. Once we hit a relational
-			* field, this will be updated to the related collection, so we can follow the relational path
-			* left to right.
+			* Related collection for the current part. Is null when the current field isn't a
+			* relational field.
 			*/
-			let collectionContext = collection;
-			for (const part of path) {
-				const info = getInfoForPath(fieldMap, group, [...pathPrefix, ...stack], collectionContext);
-				if (part.includes(":")) {
-					const [fieldKey, collection$1] = part.split(":");
-					info.fields.add(fieldKey);
-					collectionContext = collection$1;
-					stack.push(part);
-					continue;
-				}
-				if (part.startsWith("$FOLLOW(") && part.endsWith(")")) {} else {
-					const { fieldName } = parseFilterKey(part);
-					info.fields.add(fieldName);
-				}
-				/**
-				* Related collection for the current part. Is null when the current field isn't a
-				* relational field.
-				*/
-				const relatedCollection = findRelatedCollection(collectionContext, part, schema);
-				if (relatedCollection) {
-					collectionContext = relatedCollection;
-					stack.push(part);
-				}
+			const relatedCollection = findRelatedCollection(collectionContext, part, schema);
+			if (relatedCollection) {
+				collectionContext = relatedCollection;
+				stack.push(part);
 			}
 		}
 	}

package/dist/permissions/modules/process-ast/lib/field-map-from-ast.js

@@ -4,8 +4,8 @@ import { extractFieldsFromChildren } from "./extract-fields-from-children.js";
 //#region src/permissions/modules/process-ast/lib/field-map-from-ast.ts
 function fieldMapFromAst(ast, schema) {
 	const fieldMap = {
-		read: new Map(),
-		other: new Map()
+		read: /* @__PURE__ */ new Map(),
+		other: /* @__PURE__ */ new Map()
 	};
 	extractFieldsFromChildren(ast.name, ast.children, fieldMap, schema);
 	extractFieldsFromQuery(ast.name, ast.query, fieldMap, schema);

package/dist/permissions/modules/process-ast/lib/get-cases.js

@@ -9,21 +9,16 @@ function getCases(collection, permissions, requestedKeys) {
 	const caseMap = {};
 	let index = 0;
 	for (const { rule, fields } of rules) {
-		if (requestedKeys.length > 0 && fields.has("*") === false && Array.from(fields).every((field) => requestedKeys.includes(field) === false)) {
-			continue;
-		}
+		if (requestedKeys.length > 0 && fields.has("*") === false && Array.from(fields).every((field) => requestedKeys.includes(field) === false)) continue;
 		if (rule === null) continue;
 		cases.push(rule);
-		for (const field of fields) {
-			caseMap[field] = [...caseMap[field] ?? [], index];
-		}
+		for (const field of fields) caseMap[field] = [...caseMap[field] ?? [], index];
 		index++;
 	}
-	const allowedFields = new Set(permissionsForCollection.filter((permission) => hasItemPermissions(permission) === false).map((permission) => permission.fields ?? []).flat());
 	return {
 		cases,
 		caseMap,
-		allowedFields
+		allowedFields: new Set(permissionsForCollection.filter((permission) => hasItemPermissions(permission) === false).map((permission) => permission.fields ?? []).flat())
 	};
 }
 

package/dist/permissions/modules/process-ast/lib/inject-cases.js

@@ -13,29 +13,16 @@ function injectCases(ast, permissions) {
 	ast.cases = processChildren(ast.name, ast.children, permissions);
 }
 function processChildren(collection, children, permissions) {
-	const requestedKeys = uniq(children.map(getUnaliasedFieldKey));
-	const { cases, caseMap, allowedFields } = getCases(collection, permissions, requestedKeys);
+	const { cases, caseMap, allowedFields } = getCases(collection, permissions, uniq(children.map(getUnaliasedFieldKey)));
 	for (const child of children) {
 		const fieldKey = getUnaliasedFieldKey(child);
 		const globalWhenCase = caseMap["*"];
 		const fieldWhenCase = caseMap[fieldKey];
-		if (!globalWhenCase && !fieldWhenCase) {
-			throw new Error(`Cannot extract access permissions for field "${fieldKey}" in collection "${collection}"`);
-		}
-		if (!allowedFields.has("*") && !allowedFields.has(fieldKey)) {
-			child.whenCase = [...globalWhenCase ?? [], ...fieldWhenCase ?? []];
-		}
-		if (child.type === "m2o") {
-			child.cases = processChildren(child.relation.related_collection, child.children, permissions);
-		}
-		if (child.type === "o2m") {
-			child.cases = processChildren(child.relation.collection, child.children, permissions);
-		}
-		if (child.type === "a2o") {
-			for (const collection$1 of child.names) {
-				child.cases[collection$1] = processChildren(collection$1, child.children[collection$1] ?? [], permissions);
-			}
-		}
+		if (!globalWhenCase && !fieldWhenCase) throw new Error(`Cannot extract access permissions for field "${fieldKey}" in collection "${collection}"`);
+		if (!allowedFields.has("*") && !allowedFields.has(fieldKey)) child.whenCase = [...globalWhenCase ?? [], ...fieldWhenCase ?? []];
+		if (child.type === "m2o") child.cases = processChildren(child.relation.related_collection, child.children, permissions);
+		if (child.type === "o2m") child.cases = processChildren(child.relation.collection, child.children, permissions);
+		if (child.type === "a2o") for (const collection$1 of child.names) child.cases[collection$1] = processChildren(collection$1, child.children[collection$1] ?? [], permissions);
 		if (child.type === "functionField") {
 			const { cases: cases$1 } = getCases(child.relatedCollection, permissions, []);
 			child.cases = cases$1;

package/dist/permissions/modules/process-ast/process-ast.js

@@ -11,9 +11,7 @@ async function processAst(options, context) {
 	const fieldMap = fieldMapFromAst(options.ast, context.schema);
 	const collections = collectionsInFieldMap(fieldMap);
 	if (!options.accountability || options.accountability.admin) {
-		for (const [path, { collection, fields }] of [...fieldMap.read.entries(), ...fieldMap.other.entries()]) {
-			validatePathExistence(path, collection, fields, context.schema);
-		}
+		for (const [path, { collection, fields }] of [...fieldMap.read.entries(), ...fieldMap.other.entries()]) validatePathExistence(path, collection, fields, context.schema);
 		return options.ast;
 	}
 	const policies = await fetchPolicies(options.accountability, context);
@@ -29,15 +27,9 @@ async function processAst(options, context) {
 		collections,
 		accountability: options.accountability
 	}, context);
-	for (const [path, { collection, fields }] of [...fieldMap.read.entries(), ...fieldMap.other.entries()]) {
-		validatePathExistence(path, collection, fields, context.schema);
-	}
-	for (const [path, { collection, fields }] of fieldMap.other.entries()) {
-		validatePathPermissions(path, permissions, collection, fields);
-	}
-	for (const [path, { collection, fields }] of fieldMap.read.entries()) {
-		validatePathPermissions(path, readPermissions, collection, fields);
-	}
+	for (const [path, { collection, fields }] of [...fieldMap.read.entries(), ...fieldMap.other.entries()]) validatePathExistence(path, collection, fields, context.schema);
+	for (const [path, { collection, fields }] of fieldMap.other.entries()) validatePathPermissions(path, permissions, collection, fields);
+	for (const [path, { collection, fields }] of fieldMap.read.entries()) validatePathPermissions(path, readPermissions, collection, fields);
 	injectCases(options.ast, permissions);
 	return options.ast;
 }

package/dist/permissions/modules/process-ast/utils/collections-in-field-map.js

@@ -1,9 +1,7 @@
 //#region src/permissions/modules/process-ast/utils/collections-in-field-map.ts
 function collectionsInFieldMap(fieldMap) {
-	const collections = new Set();
-	for (const { collection } of [...fieldMap.other.values(), ...fieldMap.read.values()]) {
-		collections.add(collection);
-	}
+	const collections = /* @__PURE__ */ new Set();
+	for (const { collection } of [...fieldMap.other.values(), ...fieldMap.read.values()]) collections.add(collection);
 	return Array.from(collections);
 }
 

package/dist/permissions/modules/process-ast/utils/dedupe-access.js

@@ -9,23 +9,19 @@ import hash from "object-hash";
 * case/when clauses for permission sets where the rule access is identical
 */
 function dedupeAccess(permissions) {
-	const map = new Map();
+	const map = /* @__PURE__ */ new Map();
 	for (const permission of permissions) {
 		const rule = permission.permissions ?? {};
 		const ruleHash = hash(rule, {
 			algorithm: "passthrough",
 			unorderedArrays: true
 		});
-		if (map.has(ruleHash) === false) {
-			map.set(ruleHash, {
-				rule,
-				fields: new Set()
-			});
-		}
+		if (map.has(ruleHash) === false) map.set(ruleHash, {
+			rule,
+			fields: /* @__PURE__ */ new Set()
+		});
 		const info = map.get(ruleHash);
-		for (const field of permission.fields ?? []) {
-			info.fields.add(field);
-		}
+		for (const field of permission.fields ?? []) info.fields.add(field);
 	}
 	return Array.from(map.values());
 }

package/dist/permissions/modules/process-ast/utils/extract-paths-from-query.js

@@ -19,33 +19,17 @@ function extractPathsFromQuery(query) {
 	*/
 	const paths = [];
 	const readOnlyPaths = [];
-	if (query.filter) {
-		flattenFilter(readOnlyPaths, query.filter);
+	if (query.filter) flattenFilter(readOnlyPaths, query.filter);
+	if (query.sort) for (const field of query.sort) {
+		const parts = field.split(".").map((field$1) => field$1.startsWith("-") ? field$1.substring(1) : field$1);
+		if (query.aggregate && parts.length > 0 && parts[0] in query.aggregate) continue;
+		readOnlyPaths.push(parts);
 	}
-	if (query.sort) {
-		for (const field of query.sort) {
-			const parts = field.split(".").map((field$1) => field$1.startsWith("-") ? field$1.substring(1) : field$1);
-			if (query.aggregate && parts.length > 0 && parts[0] in query.aggregate) {
-				continue;
-			}
-			readOnlyPaths.push(parts);
-		}
-	}
-	if (query.aggregate) {
-		for (const fields of Object.values(query.aggregate)) {
-			for (const field of fields) {
-				if (field === "*") {
-					continue;
-				}
-				paths.push(field.split("."));
-			}
-		}
-	}
-	if (query.group) {
-		for (const field of query.group) {
-			paths.push(field.split("."));
-		}
+	if (query.aggregate) for (const fields of Object.values(query.aggregate)) for (const field of fields) {
+		if (field === "*") continue;
+		paths.push(field.split("."));
 	}
+	if (query.group) for (const field of query.group) paths.push(field.split("."));
 	return {
 		paths: uniqWith(paths, isEqual),
 		readOnlyPaths: uniqWith(readOnlyPaths, isEqual)

package/dist/permissions/modules/process-ast/utils/find-related-collection.js

@@ -4,9 +4,7 @@ import { getRelationInfo } from "@directus/utils";
 function findRelatedCollection(collection, field, schema) {
 	const { relation } = getRelationInfo(schema.relations, collection, field);
 	if (!relation) return null;
-	const isO2m = relation.related_collection === collection;
-	const relatedCollectionName = isO2m ? relation.collection : relation.related_collection;
-	return relatedCollectionName;
+	return relation.related_collection === collection ? relation.collection : relation.related_collection;
 }
 
 //#endregion

package/dist/permissions/modules/process-ast/utils/flatten-filter.js

@@ -9,16 +9,13 @@ function flattenFilter(paths, filter) {
 		const { current, path } = stack.pop();
 		if (typeof current === "object" && current !== null) {
 			const isArray = Array.isArray(current);
-			for (const key in current) {
-				if (!key.startsWith("_") || key === "_and" || key === "_or" || key === "_some" || key === "_none") {
-					stack.push({
-						current: current[key],
-						path: isArray ? path : [...path, key]
-					});
-				} else {
-					const parts = path.filter((part) => part.startsWith("_") === false);
-					if (parts.length > 0) paths.push(parts);
-				}
+			for (const key in current) if (!key.startsWith("_") || key === "_and" || key === "_or" || key === "_some" || key === "_none") stack.push({
+				current: current[key],
+				path: isArray ? path : [...path, key]
+			});
+			else {
+				const parts = path.filter((part) => part.startsWith("_") === false);
+				if (parts.length > 0) paths.push(parts);
 			}
 		} else {
 			const parts = path.filter((part) => part.startsWith("_") === false);

package/dist/permissions/modules/process-ast/utils/get-info-for-path.js

@@ -1,12 +1,10 @@
 //#region src/permissions/modules/process-ast/utils/get-info-for-path.ts
 function getInfoForPath(fieldMap, group, path, collection) {
 	const pathStr = path.join(".");
-	if (fieldMap[group].has(pathStr) === false) {
-		fieldMap[group].set(pathStr, {
-			collection,
-			fields: new Set()
-		});
-	}
+	if (fieldMap[group].has(pathStr) === false) fieldMap[group].set(pathStr, {
+		collection,
+		fields: /* @__PURE__ */ new Set()
+	});
 	return fieldMap[group].get(pathStr);
 }
 

package/dist/permissions/modules/process-ast/utils/validate-path/create-error.js

@@ -2,8 +2,7 @@ import { ForbiddenError } from "@directus/errors";
 
 //#region src/permissions/modules/process-ast/utils/validate-path/create-error.ts
 function createCollectionForbiddenError(path, collection) {
-	const pathSuffix = path === "" ? "root" : `"${path}"`;
-	return new ForbiddenError({ reason: `You don't have permission to access collection "${collection}" or it does not exist. Queried in ${pathSuffix}.` });
+	return new ForbiddenError({ reason: `You don't have permission to access collection "${collection}" or it does not exist. Queried in ${path === "" ? "root" : `"${path}"`}.` });
 }
 function createFieldsForbiddenError(path, collection, fields) {
 	const pathSuffix = path === "" ? "root" : `"${path}"`;

package/dist/permissions/modules/process-ast/utils/validate-path/validate-path-existence.js

@@ -3,14 +3,9 @@ import { createCollectionForbiddenError, createFieldsForbiddenError } from "./cr
 //#region src/permissions/modules/process-ast/utils/validate-path/validate-path-existence.ts
 function validatePathExistence(path, collection, fields, schema) {
 	const collectionInfo = schema.collections[collection];
-	if (collectionInfo === undefined) {
-		throw createCollectionForbiddenError(path, collection);
-	}
-	const requestedFields = Array.from(fields);
-	const nonExistentFields = requestedFields.filter((field) => collectionInfo.fields[field] === undefined);
-	if (nonExistentFields.length > 0) {
-		throw createFieldsForbiddenError(path, collection, nonExistentFields);
-	}
+	if (collectionInfo === void 0) throw createCollectionForbiddenError(path, collection);
+	const nonExistentFields = Array.from(fields).filter((field) => collectionInfo.fields[field] === void 0);
+	if (nonExistentFields.length > 0) throw createFieldsForbiddenError(path, collection, nonExistentFields);
 }
 
 //#endregion