@directus/api 9.25.0

package/dist/utils/jwt.d.ts

@@ -0,0 +1,3 @@
+import type { DirectusTokenPayload } from '../types/index.js';
+export declare function verifyJWT(token: string, secret: string): Record<string, any>;
+export declare function verifyAccessJWT(token: string, secret: string): DirectusTokenPayload;

package/dist/utils/jwt.js

@@ -0,0 +1,29 @@
+import jwt from 'jsonwebtoken';
+import { InvalidTokenException, ServiceUnavailableException, TokenExpiredException } from '../exceptions/index.js';
+export function verifyJWT(token, secret) {
+    let payload;
+    try {
+        payload = jwt.verify(token, secret, {
+            issuer: 'directus',
+        });
+    }
+    catch (err) {
+        if (err instanceof jwt.TokenExpiredError) {
+            throw new TokenExpiredException();
+        }
+        else if (err instanceof jwt.JsonWebTokenError) {
+            throw new InvalidTokenException('Token invalid.');
+        }
+        else {
+            throw new ServiceUnavailableException(`Couldn't verify token.`, { service: 'jwt' });
+        }
+    }
+    return payload;
+}
+export function verifyAccessJWT(token, secret) {
+    const { id, role, app_access, admin_access, share, share_scope } = verifyJWT(token, secret);
+    if (role === undefined || app_access === undefined || admin_access === undefined) {
+        throw new InvalidTokenException('Invalid token payload.');
+    }
+    return { id, role, app_access, admin_access, share, share_scope };
+}

package/dist/utils/jwt.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/map-values-deep.d.ts

@@ -0,0 +1 @@
+export declare function mapValuesDeep(obj: Record<string, any>, fn: (key: string, value: any) => any): Record<string, any>;

package/dist/utils/map-values-deep.js

@@ -0,0 +1,25 @@
+export function mapValuesDeep(obj, fn) {
+    return recurse(obj);
+    function recurse(obj, prefix = '') {
+        if (Array.isArray(obj)) {
+            return obj.map((value, index) => {
+                if (typeof value === 'object' && value !== null) {
+                    return recurse(value, prefix + `[${index}]`);
+                }
+                else {
+                    return fn(prefix + `[${index}]`, value);
+                }
+            });
+        }
+        else {
+            return Object.fromEntries(Object.entries(obj).map(([key, value]) => {
+                if (typeof value === 'object' && value !== null) {
+                    return [key, recurse(value, prefix + (prefix ? '.' : '') + key)];
+                }
+                else {
+                    return [key, fn(prefix + (prefix ? '.' : '') + key, value)];
+                }
+            }));
+        }
+    }
+}

package/dist/utils/map-values-deep.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/md.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Render and sanitize a markdown string
+ */
+export declare function md(str: string): string;

package/dist/utils/md.js

@@ -0,0 +1,8 @@
+import { marked } from 'marked';
+import sanitizeHTML from 'sanitize-html';
+/**
+ * Render and sanitize a markdown string
+ */
+export function md(str) {
+    return sanitizeHTML(marked(str));
+}

package/dist/utils/md.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/merge-permissions-for-share.d.ts

@@ -0,0 +1,4 @@
+import type { Accountability, Filter, Permission, SchemaOverview } from '@directus/types';
+export declare function mergePermissionsForShare(currentPermissions: Permission[], accountability: Accountability, schema: SchemaOverview): Permission[];
+export declare function traverse(schema: SchemaOverview, rootItemPrimaryKeyField: string, rootItemPrimaryKey: string, currentCollection: string, parentCollections?: string[], path?: string[]): Partial<Permission>[];
+export declare function getFilterForPath(type: 'o2m' | 'm2o' | 'a2o', path: string[], rootPrimaryKeyField: string, rootPrimaryKey: string): Filter;

package/dist/utils/merge-permissions-for-share.js

@@ -0,0 +1,109 @@
+import { assign, set, uniq } from 'lodash-es';
+import { schemaPermissions } from '../database/system-data/app-access-permissions/index.js';
+import { mergePermissions } from './merge-permissions.js';
+import { reduceSchema } from './reduce-schema.js';
+export function mergePermissionsForShare(currentPermissions, accountability, schema) {
+    const defaults = {
+        action: 'read',
+        role: accountability.role,
+        collection: '',
+        permissions: {},
+        validation: null,
+        presets: null,
+        fields: null,
+    };
+    const { collection, item } = accountability.share_scope;
+    const parentPrimaryKeyField = schema.collections[collection].primary;
+    const reducedSchema = reduceSchema(schema, currentPermissions, ['read']);
+    const relationalPermissions = traverse(reducedSchema, parentPrimaryKeyField, item, collection);
+    const parentCollectionPermission = assign({}, defaults, {
+        collection,
+        permissions: {
+            [parentPrimaryKeyField]: {
+                _eq: item,
+            },
+        },
+    });
+    // All permissions that will be merged into the original permissions set
+    const allGeneratedPermissions = [
+        parentCollectionPermission,
+        ...relationalPermissions.map((generated) => assign({}, defaults, generated)),
+        ...schemaPermissions,
+    ];
+    // All the collections that are touched through the relational tree from the current root collection, and the schema collections
+    const allowedCollections = uniq(allGeneratedPermissions.map(({ collection }) => collection));
+    const generatedPermissions = [];
+    // Merge all the permissions that relate to the same collection with an _or (this allows you to properly retrieve)
+    // the items of a collection if you entered that collection from multiple angles
+    for (const collection of allowedCollections) {
+        const permissionsForCollection = allGeneratedPermissions.filter((permission) => permission.collection === collection);
+        if (permissionsForCollection.length > 0) {
+            generatedPermissions.push(...mergePermissions('or', permissionsForCollection));
+        }
+        else {
+            generatedPermissions.push(...permissionsForCollection);
+        }
+    }
+    // Explicitly filter out permissions to collections unrelated to the root parent item.
+    const limitedPermissions = currentPermissions.filter(({ action, collection }) => allowedCollections.includes(collection) && action === 'read');
+    return mergePermissions('and', limitedPermissions, generatedPermissions);
+}
+export function traverse(schema, rootItemPrimaryKeyField, rootItemPrimaryKey, currentCollection, parentCollections = [], path = []) {
+    const permissions = [];
+    // If there's already a permissions rule for the collection we're currently checking, we'll shortcircuit.
+    // This prevents infinite loop in recursive relationships, like articles->related_articles->articles, or
+    // articles.author->users.avatar->files.created_by->users.avatar->files.created_by->🔁
+    if (parentCollections.includes(currentCollection)) {
+        return permissions;
+    }
+    const relationsInCollection = schema.relations.filter((relation) => {
+        return relation.collection === currentCollection || relation.related_collection === currentCollection;
+    });
+    for (const relation of relationsInCollection) {
+        let type;
+        if (relation.related_collection === currentCollection) {
+            type = 'o2m';
+        }
+        else if (!relation.related_collection) {
+            type = 'a2o';
+        }
+        else {
+            type = 'm2o';
+        }
+        if (type === 'o2m') {
+            permissions.push({
+                collection: relation.collection,
+                permissions: getFilterForPath(type, [...path, relation.field], rootItemPrimaryKeyField, rootItemPrimaryKey),
+            });
+            permissions.push(...traverse(schema, rootItemPrimaryKeyField, rootItemPrimaryKey, relation.collection, [...parentCollections, currentCollection], [...path, relation.field]));
+        }
+        if (type === 'a2o' && relation.meta?.one_allowed_collections) {
+            for (const collection of relation.meta.one_allowed_collections) {
+                permissions.push({
+                    collection,
+                    permissions: getFilterForPath(type, [...path, `$FOLLOW(${relation.collection},${relation.field},${relation.meta.one_collection_field})`], rootItemPrimaryKeyField, rootItemPrimaryKey),
+                });
+            }
+        }
+        if (type === 'm2o') {
+            permissions.push({
+                collection: relation.related_collection,
+                permissions: getFilterForPath(type, [...path, `$FOLLOW(${relation.collection},${relation.field})`], rootItemPrimaryKeyField, rootItemPrimaryKey),
+            });
+            if (relation.meta?.one_field) {
+                permissions.push(...traverse(schema, rootItemPrimaryKeyField, rootItemPrimaryKey, relation.related_collection, [...parentCollections, currentCollection], [...path, relation.meta?.one_field]));
+            }
+        }
+    }
+    return permissions;
+}
+export function getFilterForPath(type, path, rootPrimaryKeyField, rootPrimaryKey) {
+    const filter = {};
+    if (type === 'm2o' || type === 'a2o') {
+        set(filter, path.reverse(), { [rootPrimaryKeyField]: { _eq: rootPrimaryKey } });
+    }
+    else {
+        set(filter, path.reverse(), { _eq: rootPrimaryKey });
+    }
+    return filter;
+}

package/dist/utils/merge-permissions.d.ts

@@ -0,0 +1,3 @@
+import type { Permission } from '@directus/types';
+export declare function mergePermissions(strategy: 'and' | 'or', ...permissions: Permission[][]): Permission[];
+export declare function mergePermission(strategy: 'and' | 'or', currentPerm: Permission, newPerm: Permission): Omit<Permission, 'id' | 'system'>;

package/dist/utils/merge-permissions.js

@@ -0,0 +1,95 @@
+import { flatten, intersection, isEqual, merge, omit } from 'lodash-es';
+export function mergePermissions(strategy, ...permissions) {
+    const allPermissions = flatten(permissions);
+    const mergedPermissions = allPermissions
+        .reduce((acc, val) => {
+        const key = `${val.collection}__${val.action}__${val.role || '$PUBLIC'}`;
+        const current = acc.get(key);
+        acc.set(key, current ? mergePermission(strategy, current, val) : val);
+        return acc;
+    }, new Map())
+        .values();
+    return Array.from(mergedPermissions);
+}
+export function mergePermission(strategy, currentPerm, newPerm) {
+    const logicalKey = `_${strategy}`;
+    let permissions = currentPerm.permissions;
+    let validation = currentPerm.validation;
+    let fields = currentPerm.fields;
+    let presets = currentPerm.presets;
+    if (newPerm.permissions) {
+        if (currentPerm.permissions && Object.keys(currentPerm.permissions)[0] === logicalKey) {
+            permissions = {
+                [logicalKey]: [
+                    ...currentPerm.permissions[logicalKey],
+                    newPerm.permissions,
+                ],
+            };
+        }
+        else if (currentPerm.permissions) {
+            // Empty {} supersedes other permissions in _OR merge
+            if (strategy === 'or' && (isEqual(currentPerm.permissions, {}) || isEqual(newPerm.permissions, {}))) {
+                permissions = {};
+            }
+            else {
+                permissions = {
+                    [logicalKey]: [currentPerm.permissions, newPerm.permissions],
+                };
+            }
+        }
+        else {
+            permissions = {
+                [logicalKey]: [newPerm.permissions],
+            };
+        }
+    }
+    if (newPerm.validation) {
+        if (currentPerm.validation && Object.keys(currentPerm.validation)[0] === logicalKey) {
+            validation = {
+                [logicalKey]: [
+                    ...currentPerm.validation[logicalKey],
+                    newPerm.validation,
+                ],
+            };
+        }
+        else if (currentPerm.validation) {
+            // Empty {} supersedes other validations in _OR merge
+            if (strategy === 'or' && (isEqual(currentPerm.validation, {}) || isEqual(newPerm.validation, {}))) {
+                validation = {};
+            }
+            else {
+                validation = {
+                    [logicalKey]: [currentPerm.validation, newPerm.validation],
+                };
+            }
+        }
+        else {
+            validation = {
+                [logicalKey]: [newPerm.validation],
+            };
+        }
+    }
+    if (newPerm.fields) {
+        if (Array.isArray(currentPerm.fields) && strategy === 'or') {
+            fields = [...new Set([...currentPerm.fields, ...newPerm.fields])];
+        }
+        else if (Array.isArray(currentPerm.fields) && strategy === 'and') {
+            fields = intersection(currentPerm.fields, newPerm.fields);
+        }
+        else {
+            fields = newPerm.fields;
+        }
+        if (fields.includes('*'))
+            fields = ['*'];
+    }
+    if (newPerm.presets) {
+        presets = merge({}, presets, newPerm.presets);
+    }
+    return omit({
+        ...currentPerm,
+        permissions,
+        validation,
+        fields,
+        presets,
+    }, ['id', 'system']);
+}

package/dist/utils/merge-permissions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/package.d.ts

@@ -0,0 +1,2 @@
+declare const name: string, version: string;
+export { name, version };

package/dist/utils/package.js

@@ -0,0 +1,6 @@
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const { name, version } = JSON.parse(readFileSync(resolve(__dirname, '../../package.json'), 'utf8'));
+export { name, version };

package/dist/utils/parse-image-metadata.d.ts

@@ -0,0 +1,3 @@
+/// <reference types="node" resolution-mode="require"/>
+export declare function parseIptc(buffer: Buffer): Record<string, unknown>;
+export declare function parseXmp(buffer: Buffer): Record<string, unknown>;

package/dist/utils/parse-image-metadata.js

@@ -0,0 +1,68 @@
+const IPTC_ENTRY_TYPES = new Map([
+    [0x78, 'caption'],
+    [0x6e, 'credit'],
+    [0x19, 'keywords'],
+    [0x37, 'dateCreated'],
+    [0x50, 'byline'],
+    [0x55, 'bylineTitle'],
+    [0x7a, 'captionWriter'],
+    [0x69, 'headline'],
+    [0x74, 'copyright'],
+    [0x0f, 'category'],
+]);
+const IPTC_ENTRY_MARKER = Buffer.from([0x1c, 0x02]);
+export function parseIptc(buffer) {
+    if (!Buffer.isBuffer(buffer))
+        return {};
+    const iptc = {};
+    let lastIptcEntryPos = buffer.indexOf(IPTC_ENTRY_MARKER);
+    while (lastIptcEntryPos !== -1) {
+        lastIptcEntryPos = buffer.indexOf(IPTC_ENTRY_MARKER, lastIptcEntryPos + IPTC_ENTRY_MARKER.byteLength);
+        const iptcBlockTypePos = lastIptcEntryPos + IPTC_ENTRY_MARKER.byteLength;
+        const iptcBlockSizePos = iptcBlockTypePos + 1;
+        const iptcBlockDataPos = iptcBlockSizePos + 2;
+        const iptcBlockType = buffer.readUInt8(iptcBlockTypePos);
+        const iptcBlockSize = buffer.readUInt16BE(iptcBlockSizePos);
+        if (!IPTC_ENTRY_TYPES.has(iptcBlockType)) {
+            continue;
+        }
+        const iptcBlockTypeId = IPTC_ENTRY_TYPES.get(iptcBlockType);
+        const iptcData = buffer.subarray(iptcBlockDataPos, iptcBlockDataPos + iptcBlockSize).toString();
+        if (iptcBlockTypeId) {
+            if (iptc[iptcBlockTypeId] == null) {
+                iptc[iptcBlockTypeId] = iptcData;
+            }
+            else if (Array.isArray(iptc[iptcBlockTypeId])) {
+                iptc[iptcBlockTypeId].push(iptcData);
+            }
+            else {
+                iptc[iptcBlockTypeId] = [iptc[iptcBlockTypeId], iptcData];
+            }
+        }
+    }
+    return iptc;
+}
+export function parseXmp(buffer) {
+    const xmp = {};
+    ['title', 'description', 'rights', 'creator', 'subject'].forEach((x) => {
+        const tagRegex = new RegExp(`<dc:${x}>(.*?)</dc:${x}>`, 'smig'), tagMatches = tagRegex.exec(buffer.toString());
+        if (!tagMatches || tagMatches.length === 0) {
+            return;
+        }
+        const value = tagMatches[1]?.trim();
+        if (value?.toLowerCase().indexOf('<rdf:bag>') === 0) {
+            const r = new RegExp('<rdf:li>(.*?)</rdf:li>', 'smig');
+            let match = r.exec(value);
+            const result = [];
+            while (match) {
+                result.push(match[1]);
+                match = r.exec(value);
+            }
+            xmp[x] = result;
+        }
+        else {
+            xmp[x] = value?.replace(/<[^>]*>?/gm, '').trim();
+        }
+    });
+    return xmp;
+}

package/dist/utils/reduce-schema.d.ts

@@ -0,0 +1,9 @@
+import type { Permission, PermissionsAction, SchemaOverview } from '@directus/types';
+/**
+ * Reduces the schema based on the included permissions. The resulting object is the schema structure, but with only
+ * the allowed collections/fields/relations included based on the permissions.
+ * @param schema The full project schema
+ * @param actions Array of permissions actions (crud)
+ * @returns Reduced schema
+ */
+export declare function reduceSchema(schema: SchemaOverview, permissions: Permission[] | null, actions?: PermissionsAction[]): SchemaOverview;

package/dist/utils/reduce-schema.js

@@ -0,0 +1,78 @@
+import { uniq } from 'lodash-es';
+/**
+ * Reduces the schema based on the included permissions. The resulting object is the schema structure, but with only
+ * the allowed collections/fields/relations included based on the permissions.
+ * @param schema The full project schema
+ * @param actions Array of permissions actions (crud)
+ * @returns Reduced schema
+ */
+export function reduceSchema(schema, permissions, actions = ['create', 'read', 'update', 'delete']) {
+    const reduced = {
+        collections: {},
+        relations: [],
+    };
+    const allowedFieldsInCollection = permissions
+        ?.filter((permission) => actions.includes(permission.action))
+        .reduce((acc, permission) => {
+        if (!acc[permission.collection]) {
+            acc[permission.collection] = [];
+        }
+        if (permission.fields) {
+            acc[permission.collection] = uniq([...acc[permission.collection], ...permission.fields]);
+        }
+        return acc;
+    }, {}) ?? {};
+    for (const [collectionName, collection] of Object.entries(schema.collections)) {
+        if (!permissions?.some((permission) => permission.collection === collectionName && actions.includes(permission.action))) {
+            continue;
+        }
+        const fields = {};
+        for (const [fieldName, field] of Object.entries(schema.collections[collectionName].fields)) {
+            if (!allowedFieldsInCollection[collectionName]?.includes('*') &&
+                !allowedFieldsInCollection[collectionName]?.includes(fieldName)) {
+                continue;
+            }
+            const o2mRelation = schema.relations.find((relation) => relation.related_collection === collectionName && relation.meta?.one_field === fieldName);
+            if (o2mRelation &&
+                !permissions?.some((permission) => permission.collection === o2mRelation.collection && actions.includes(permission.action))) {
+                continue;
+            }
+            fields[fieldName] = field;
+        }
+        reduced.collections[collectionName] = {
+            ...collection,
+            fields,
+        };
+    }
+    reduced.relations = schema.relations.filter((relation) => {
+        let collectionsAllowed = true;
+        let fieldsAllowed = true;
+        if (Object.keys(allowedFieldsInCollection).includes(relation.collection) === false) {
+            collectionsAllowed = false;
+        }
+        if (relation.related_collection &&
+            (Object.keys(allowedFieldsInCollection).includes(relation.related_collection) === false ||
+                // Ignore legacy permissions with an empty fields array
+                allowedFieldsInCollection[relation.related_collection]?.length === 0)) {
+            collectionsAllowed = false;
+        }
+        if (relation.meta?.one_allowed_collections &&
+            relation.meta.one_allowed_collections.every((collection) => Object.keys(allowedFieldsInCollection).includes(collection)) === false) {
+            collectionsAllowed = false;
+        }
+        if (!allowedFieldsInCollection[relation.collection] ||
+            (allowedFieldsInCollection[relation.collection]?.includes('*') === false &&
+                allowedFieldsInCollection[relation.collection]?.includes(relation.field) === false)) {
+            fieldsAllowed = false;
+        }
+        if (relation.related_collection &&
+            relation.meta?.one_field &&
+            (!allowedFieldsInCollection[relation.related_collection] ||
+                (allowedFieldsInCollection[relation.related_collection]?.includes('*') === false &&
+                    allowedFieldsInCollection[relation.related_collection]?.includes(relation.meta?.one_field) === false))) {
+            fieldsAllowed = false;
+        }
+        return collectionsAllowed && fieldsAllowed;
+    });
+    return reduced;
+}

package/dist/utils/require-yaml.d.ts

@@ -0,0 +1 @@
+export declare function requireYAML(filepath: string): Record<string, any>;

package/dist/utils/require-yaml.js

@@ -0,0 +1,6 @@
+import fse from 'fs-extra';
+import yaml from 'js-yaml';
+export function requireYAML(filepath) {
+    const yamlRaw = fse.readFileSync(filepath, 'utf8');
+    return yaml.load(yamlRaw);
+}

package/dist/utils/sanitize-query.d.ts

@@ -0,0 +1,2 @@
+import type { Accountability, Query } from '@directus/types';
+export declare function sanitizeQuery(rawQuery: Record<string, any>, accountability?: Accountability | null): Query;

package/dist/utils/sanitize-query.js

@@ -0,0 +1,172 @@
+import { parseFilter, parseJSON } from '@directus/utils';
+import { flatten, get, isPlainObject, merge, set } from 'lodash-es';
+import logger from '../logger.js';
+import { Meta } from '../types/index.js';
+export function sanitizeQuery(rawQuery, accountability) {
+    const query = {};
+    if (rawQuery['limit'] !== undefined) {
+        const limit = sanitizeLimit(rawQuery['limit']);
+        if (typeof limit === 'number') {
+            query.limit = limit;
+        }
+    }
+    if (rawQuery['fields']) {
+        query.fields = sanitizeFields(rawQuery['fields']);
+    }
+    if (rawQuery['groupBy']) {
+        query.group = sanitizeFields(rawQuery['groupBy']);
+    }
+    if (rawQuery['aggregate']) {
+        query.aggregate = sanitizeAggregate(rawQuery['aggregate']);
+    }
+    if (rawQuery['sort']) {
+        query.sort = sanitizeSort(rawQuery['sort']);
+    }
+    if (rawQuery['filter']) {
+        query.filter = sanitizeFilter(rawQuery['filter'], accountability || null);
+    }
+    if (rawQuery['offset']) {
+        query.offset = sanitizeOffset(rawQuery['offset']);
+    }
+    if (rawQuery['page']) {
+        query.page = sanitizePage(rawQuery['page']);
+    }
+    if (rawQuery['meta']) {
+        query.meta = sanitizeMeta(rawQuery['meta']);
+    }
+    if (rawQuery['search'] && typeof rawQuery['search'] === 'string') {
+        query.search = rawQuery['search'];
+    }
+    if (rawQuery['export']) {
+        query.export = rawQuery['export'];
+    }
+    if (rawQuery['deep']) {
+        if (!query.deep)
+            query.deep = {};
+        query.deep = sanitizeDeep(rawQuery['deep'], accountability);
+    }
+    if (rawQuery['alias']) {
+        query.alias = sanitizeAlias(rawQuery['alias']);
+    }
+    return query;
+}
+function sanitizeFields(rawFields) {
+    if (!rawFields)
+        return null;
+    let fields = [];
+    if (typeof rawFields === 'string')
+        fields = rawFields.split(',');
+    else if (Array.isArray(rawFields))
+        fields = rawFields;
+    // Case where array item includes CSV (fe fields[]=id,name):
+    fields = flatten(fields.map((field) => (field.includes(',') ? field.split(',') : field)));
+    fields = fields.map((field) => field.trim());
+    return fields;
+}
+function sanitizeSort(rawSort) {
+    let fields = [];
+    if (typeof rawSort === 'string')
+        fields = rawSort.split(',');
+    else if (Array.isArray(rawSort))
+        fields = rawSort;
+    return fields;
+}
+function sanitizeAggregate(rawAggregate) {
+    let aggregate = rawAggregate;
+    if (typeof rawAggregate === 'string') {
+        try {
+            aggregate = parseJSON(rawAggregate);
+        }
+        catch {
+            logger.warn('Invalid value passed for filter query parameter.');
+        }
+    }
+    for (const [operation, fields] of Object.entries(aggregate)) {
+        if (typeof fields === 'string')
+            aggregate[operation] = fields.split(',');
+        else if (Array.isArray(fields))
+            aggregate[operation] = fields;
+    }
+    return aggregate;
+}
+function sanitizeFilter(rawFilter, accountability) {
+    let filters = rawFilter;
+    if (typeof rawFilter === 'string') {
+        try {
+            filters = parseJSON(rawFilter);
+        }
+        catch {
+            logger.warn('Invalid value passed for filter query parameter.');
+        }
+    }
+    return parseFilter(filters, accountability);
+}
+function sanitizeLimit(rawLimit) {
+    if (rawLimit === undefined || rawLimit === null)
+        return null;
+    return Number(rawLimit);
+}
+function sanitizeOffset(rawOffset) {
+    return Number(rawOffset);
+}
+function sanitizePage(rawPage) {
+    return Number(rawPage);
+}
+function sanitizeMeta(rawMeta) {
+    if (rawMeta === '*') {
+        return Object.values(Meta);
+    }
+    if (rawMeta.includes(',')) {
+        return rawMeta.split(',');
+    }
+    if (Array.isArray(rawMeta)) {
+        return rawMeta;
+    }
+    return [rawMeta];
+}
+function sanitizeDeep(deep, accountability) {
+    const result = {};
+    if (typeof deep === 'string') {
+        try {
+            deep = parseJSON(deep);
+        }
+        catch {
+            logger.warn('Invalid value passed for deep query parameter.');
+        }
+    }
+    parse(deep);
+    return result;
+    function parse(level, path = []) {
+        const parsedLevel = {};
+        for (const [key, value] of Object.entries(level)) {
+            if (!key)
+                break;
+            if (key.startsWith('_')) {
+                // Sanitize query only accepts non-underscore-prefixed query options
+                const parsedSubQuery = sanitizeQuery({ [key.substring(1)]: value }, accountability);
+                // ...however we want to keep them for the nested structure of deep, otherwise there's no
+                // way of knowing when to keep nesting and when to stop
+                const [parsedKey, parsedValue] = Object.entries(parsedSubQuery)[0];
+                parsedLevel[`_${parsedKey}`] = parsedValue;
+            }
+            else if (isPlainObject(value)) {
+                parse(value, [...path, key]);
+            }
+        }
+        if (Object.keys(parsedLevel).length > 0) {
+            set(result, path, merge({}, get(result, path, {}), parsedLevel));
+        }
+    }
+}
+function sanitizeAlias(rawAlias) {
+    let alias = rawAlias;
+    if (typeof rawAlias === 'string') {
+        try {
+            alias = parseJSON(rawAlias);
+        }
+        catch (err) {
+            logger.warn('Invalid value passed for alias query parameter.');
+        }
+    }
+    return alias;
+}