@directus/api 9.25.0

package/dist/utils/validate-query.js

@@ -0,0 +1,198 @@
+import Joi from 'joi';
+import { isPlainObject, uniq } from 'lodash-es';
+import { stringify } from 'wellknown';
+import env from '../env.js';
+import { InvalidQueryException } from '../exceptions/invalid-query.js';
+import { calculateFieldDepth } from './calculate-field-depth.js';
+const querySchema = Joi.object({
+    fields: Joi.array().items(Joi.string()),
+    group: Joi.array().items(Joi.string()),
+    sort: Joi.array().items(Joi.string()),
+    filter: Joi.object({}).unknown(),
+    limit: Joi.number().integer().min(-1),
+    offset: Joi.number().integer().min(0),
+    page: Joi.number().integer().min(0),
+    meta: Joi.array().items(Joi.string().valid('total_count', 'filter_count')),
+    search: Joi.string(),
+    export: Joi.string().valid('csv', 'json', 'xml', 'yaml'),
+    aggregate: Joi.object(),
+    deep: Joi.object(),
+    alias: Joi.object(),
+}).id('query');
+export function validateQuery(query) {
+    const { error } = querySchema.validate(query);
+    if (query.filter && Object.keys(query.filter).length > 0) {
+        validateFilter(query.filter);
+    }
+    if (query.alias) {
+        validateAlias(query.alias);
+    }
+    validateRelationalDepth(query);
+    if (error) {
+        throw new InvalidQueryException(error.message);
+    }
+    return query;
+}
+function validateFilter(filter) {
+    if (!filter)
+        throw new InvalidQueryException('Invalid filter object');
+    for (const [key, nested] of Object.entries(filter)) {
+        if (key === '_and' || key === '_or') {
+            nested.forEach(validateFilter);
+        }
+        else if (key.startsWith('_')) {
+            const value = nested;
+            switch (key) {
+                case '_in':
+                case '_nin':
+                case '_between':
+                case '_nbetween':
+                    validateList(value, key);
+                    break;
+                case '_null':
+                case '_nnull':
+                case '_empty':
+                case '_nempty':
+                    validateBoolean(value, key);
+                    break;
+                case '_intersects':
+                case '_nintersects':
+                case '_intersects_bbox':
+                case '_nintersects_bbox':
+                    validateGeometry(value, key);
+                    break;
+                case '_none':
+                case '_some':
+                    validateFilter(nested);
+                    break;
+                case '_eq':
+                case '_neq':
+                case '_contains':
+                case '_ncontains':
+                case '_starts_with':
+                case '_nstarts_with':
+                case '_ends_with':
+                case '_nends_with':
+                case '_gt':
+                case '_gte':
+                case '_lt':
+                case '_lte':
+                default:
+                    validateFilterPrimitive(value, key);
+                    break;
+            }
+        }
+        else if (isPlainObject(nested)) {
+            validateFilter(nested);
+        }
+        else if (Array.isArray(nested) === false) {
+            validateFilterPrimitive(nested, '_eq');
+        }
+        else {
+            validateFilter(nested);
+        }
+    }
+}
+function validateFilterPrimitive(value, key) {
+    if (value === null)
+        return true;
+    if ((typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean' || value instanceof Date) ===
+        false) {
+        throw new InvalidQueryException(`The filter value for "${key}" has to be a string, number, or boolean`);
+    }
+    if (typeof value === 'number' && (Number.isNaN(value) || value > Number.MAX_SAFE_INTEGER)) {
+        throw new InvalidQueryException(`The filter value for "${key}" is not a valid number`);
+    }
+    if (typeof value === 'string' && value.length === 0) {
+        throw new InvalidQueryException(`You can't filter for an empty string in "${key}". Use "_empty" or "_nempty" instead`);
+    }
+    return true;
+}
+function validateList(value, key) {
+    if (Array.isArray(value) === false || value.length === 0) {
+        throw new InvalidQueryException(`"${key}" has to be an array of values`);
+    }
+    return true;
+}
+function validateBoolean(value, key) {
+    if (value === null)
+        return true;
+    if (typeof value !== 'boolean') {
+        throw new InvalidQueryException(`"${key}" has to be a boolean`);
+    }
+    return true;
+}
+function validateGeometry(value, key) {
+    if (value === null)
+        return true;
+    try {
+        stringify(value);
+    }
+    catch {
+        throw new InvalidQueryException(`"${key}" has to be a valid GeoJSON object`);
+    }
+    return true;
+}
+function validateAlias(alias) {
+    if (isPlainObject(alias) === false) {
+        throw new InvalidQueryException(`"alias" has to be an object`);
+    }
+    for (const [key, value] of Object.entries(alias)) {
+        if (typeof key !== 'string') {
+            throw new InvalidQueryException(`"alias" key has to be a string. "${typeof key}" given.`);
+        }
+        if (typeof value !== 'string') {
+            throw new InvalidQueryException(`"alias" value has to be a string. "${typeof key}" given.`);
+        }
+        if (key.includes('.') || value.includes('.')) {
+            throw new InvalidQueryException(`"alias" key/value can't contain a period character \`.\``);
+        }
+    }
+}
+function validateRelationalDepth(query) {
+    const maxRelationalDepth = Number(env['MAX_RELATIONAL_DEPTH']) > 2 ? Number(env['MAX_RELATIONAL_DEPTH']) : 2;
+    // Process the fields in the same way as api/src/utils/get-ast-from-query.ts
+    let fields = ['*'];
+    if (query.fields) {
+        fields = query.fields;
+    }
+    /**
+     * When using aggregate functions, you can't have any other regular fields
+     * selected. This makes sure you never end up in a non-aggregate fields selection error
+     */
+    if (Object.keys(query.aggregate || {}).length > 0) {
+        fields = [];
+    }
+    /**
+     * Similarly, when grouping on a specific field, you can't have other non-aggregated fields.
+     * The group query will override the fields query
+     */
+    if (query.group) {
+        fields = query.group;
+    }
+    fields = uniq(fields);
+    for (const field of fields) {
+        if (field.split('.').length > maxRelationalDepth) {
+            throw new InvalidQueryException('Max relational depth exceeded.');
+        }
+    }
+    if (query.filter) {
+        const filterRelationalDepth = calculateFieldDepth(query.filter);
+        if (filterRelationalDepth > maxRelationalDepth) {
+            throw new InvalidQueryException('Max relational depth exceeded.');
+        }
+    }
+    if (query.sort) {
+        for (const sort of query.sort) {
+            if (sort.split('.').length > maxRelationalDepth) {
+                throw new InvalidQueryException('Max relational depth exceeded.');
+            }
+        }
+    }
+    if (query.deep) {
+        const deepRelationalDepth = calculateFieldDepth(query.deep, ['_sort']);
+        if (deepRelationalDepth > maxRelationalDepth) {
+            throw new InvalidQueryException('Max relational depth exceeded.');
+        }
+    }
+}

package/dist/utils/validate-query.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/validate-snapshot.d.ts

@@ -0,0 +1,5 @@
+import { Snapshot } from '../types/index.js';
+/**
+ * Validates the snapshot against the current instance.
+ **/
+export declare function validateSnapshot(snapshot: Snapshot, force?: boolean): void;

package/dist/utils/validate-snapshot.js

@@ -0,0 +1,64 @@
+import { version as currentDirectusVersion } from './package.js';
+import { InvalidPayloadException } from '../exceptions/invalid-payload.js';
+import { getDatabaseClient } from '../database/index.js';
+import Joi from 'joi';
+import { TYPES } from '@directus/constants';
+import { ALIAS_TYPES } from '../constants.js';
+import { DatabaseClients } from '../types/index.js';
+const snapshotJoiSchema = Joi.object({
+    version: Joi.number().valid(1).required(),
+    directus: Joi.string().required(),
+    vendor: Joi.string()
+        .valid(...DatabaseClients)
+        .optional(),
+    collections: Joi.array().items(Joi.object({
+        collection: Joi.string(),
+        meta: Joi.any(),
+        schema: Joi.object({
+            name: Joi.string(),
+        }),
+    })),
+    fields: Joi.array().items(Joi.object({
+        collection: Joi.string(),
+        field: Joi.string(),
+        meta: Joi.any(),
+        schema: Joi.object({
+            default_value: Joi.any(),
+            max_length: [Joi.number(), Joi.string(), Joi.valid(null)],
+            is_nullable: Joi.bool(),
+        })
+            .unknown()
+            .allow(null),
+        type: Joi.string()
+            .valid(...TYPES, ...ALIAS_TYPES)
+            .allow(null),
+    })),
+    relations: Joi.array().items(Joi.object({
+        collection: Joi.string(),
+        field: Joi.string(),
+        meta: Joi.any(),
+        related_collection: Joi.any(),
+        schema: Joi.any(),
+    })),
+});
+/**
+ * Validates the snapshot against the current instance.
+ **/
+export function validateSnapshot(snapshot, force = false) {
+    const { error } = snapshotJoiSchema.validate(snapshot);
+    if (error)
+        throw new InvalidPayloadException(error.message);
+    // Bypass checks when "force" option is enabled
+    if (force)
+        return;
+    if (snapshot.directus !== currentDirectusVersion) {
+        throw new InvalidPayloadException(`Provided snapshot's directus version ${snapshot.directus} does not match the current instance's version ${currentDirectusVersion}. You can bypass this check by passing the "force" query parameter.`);
+    }
+    if (!snapshot.vendor) {
+        throw new InvalidPayloadException('Provided snapshot does not contain the "vendor" property. You can bypass this check by passing the "force" query parameter.');
+    }
+    const currentVendor = getDatabaseClient();
+    if (snapshot.vendor !== currentVendor) {
+        throw new InvalidPayloadException(`Provided snapshot's vendor ${snapshot.vendor} does not match the current instance's vendor ${currentVendor}. You can bypass this check by passing the "force" query parameter.`);
+    }
+}

package/dist/utils/validate-snapshot.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/validate-storage.d.ts

@@ -0,0 +1 @@
+export declare function validateStorage(): Promise<void>;

package/dist/utils/validate-storage.js

@@ -0,0 +1,31 @@
+import env from '../env.js';
+import logger from '../logger.js';
+import { access } from 'node:fs/promises';
+import { constants } from 'fs';
+import path from 'path';
+import { toArray } from '@directus/utils';
+export async function validateStorage() {
+    if (env['DB_CLIENT'] === 'sqlite3') {
+        try {
+            await access(path.dirname(env['DB_FILENAME']), constants.R_OK | constants.W_OK);
+        }
+        catch {
+            logger.warn(`Directory for SQLite database file (${path.resolve(path.dirname(env['DB_FILENAME']))}) is not read/writeable!`);
+        }
+    }
+    const usedStorageDrivers = toArray(env['STORAGE_LOCATIONS']).map((location) => env[`STORAGE_${location.toUpperCase()}_DRIVER`]);
+    if (usedStorageDrivers.includes('local')) {
+        try {
+            await access(env['STORAGE_LOCAL_ROOT'], constants.R_OK | constants.W_OK);
+        }
+        catch {
+            logger.warn(`Upload directory (${path.resolve(env['STORAGE_LOCAL_ROOT'])}) is not read/writeable!`);
+        }
+    }
+    try {
+        await access(env['EXTENSIONS_PATH'], constants.R_OK);
+    }
+    catch {
+        logger.warn(`Extensions directory (${path.resolve(env['EXTENSIONS_PATH'])}) is not readable!`);
+    }
+}

package/dist/webhooks.d.ts

@@ -0,0 +1,4 @@
+export declare function init(): Promise<void>;
+export declare function reload(): Promise<void>;
+export declare function register(): Promise<void>;
+export declare function unregister(): void;

package/dist/webhooks.js

@@ -0,0 +1,79 @@
+import getDatabase from './database/index.js';
+import emitter from './emitter.js';
+import logger from './logger.js';
+import { getMessenger } from './messenger.js';
+import { getAxios } from './request/index.js';
+import { WebhooksService } from './services/webhooks.js';
+import { getSchema } from './utils/get-schema.js';
+import { JobQueue } from './utils/job-queue.js';
+let registered = [];
+const reloadQueue = new JobQueue();
+export async function init() {
+    await register();
+    const messenger = getMessenger();
+    messenger.subscribe('webhooks', (event) => {
+        if (event['type'] === 'reload') {
+            reloadQueue.enqueue(async () => {
+                await reload();
+            });
+        }
+    });
+}
+export async function reload() {
+    unregister();
+    await register();
+}
+export async function register() {
+    const webhookService = new WebhooksService({ knex: getDatabase(), schema: await getSchema() });
+    const webhooks = await webhookService.readByQuery({ filter: { status: { _eq: 'active' } } });
+    for (const webhook of webhooks) {
+        for (const action of webhook.actions) {
+            const event = `items.${action}`;
+            const handler = createHandler(webhook, event);
+            emitter.onAction(event, handler);
+            registered.push({ event, handler });
+        }
+    }
+}
+export function unregister() {
+    for (const { event, handler } of registered) {
+        emitter.offAction(event, handler);
+    }
+    registered = [];
+}
+function createHandler(webhook, event) {
+    return async (meta, context) => {
+        if (webhook.collections.includes(meta['collection']) === false)
+            return;
+        const axios = await getAxios();
+        const webhookPayload = {
+            event,
+            accountability: context.accountability
+                ? {
+                    user: context.accountability.user,
+                    role: context.accountability.role,
+                }
+                : null,
+            ...meta,
+        };
+        try {
+            await axios({
+                url: webhook.url,
+                method: webhook.method,
+                data: webhook.data ? webhookPayload : null,
+                headers: mergeHeaders(webhook.headers),
+            });
+        }
+        catch (error) {
+            logger.warn(`Webhook "${webhook.name}" (id: ${webhook.id}) failed`);
+            logger.warn(error);
+        }
+    };
+}
+function mergeHeaders(headerArray) {
+    const headers = {};
+    for (const { header, value } of headerArray ?? []) {
+        headers[header] = value;
+    }
+    return headers;
+}

package/package.json

@@ -0,0 +1,231 @@
+{
+  "name": "@directus/api",
+  "version": "9.25.0",
+  "description": "Directus is a real-time API and App dashboard for managing SQL database content",
+  "type": "module",
+  "keywords": [
+    "directus",
+    "realtime",
+    "database",
+    "content",
+    "api",
+    "rest",
+    "graphql",
+    "app",
+    "dashboard",
+    "headless",
+    "cms",
+    "mysql",
+    "postgresql",
+    "cockroachdb",
+    "sqlite",
+    "framework",
+    "vue"
+  ],
+  "homepage": "https://directus.io",
+  "bugs": {
+    "url": "https://github.com/directus/directus/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/directus/directus.git",
+    "directory": "api"
+  },
+  "funding": "https://github.com/directus/directus?sponsor=1",
+  "license": "GPL-3.0-only",
+  "author": {
+    "name": "Monospace Inc",
+    "email": "info@monospace.io",
+    "url": "https://monospace.io"
+  },
+  "maintainers": [
+    {
+      "name": "Rijk van Zanten",
+      "email": "rijkvanzanten@me.com",
+      "url": "https://github.com/rijkvanzanten"
+    },
+    {
+      "name": "Ben Haynes",
+      "email": "ben@rngr.org",
+      "url": "https://github.com/benhaynes"
+    }
+  ],
+  "exports": {
+    ".": "./dist/index.js",
+    "./*": "./dist/*.js",
+    "./cli/run.js": "./dist/cli/run.js",
+    "./package.json": "./package.json"
+  },
+  "main": "dist/index.js",
+  "files": [
+    "dist",
+    "!**/*.test.js",
+    "!**/__*__/"
+  ],
+  "dependencies": {
+    "@authenio/samlify-node-xmllint": "2.0.0",
+    "@aws-sdk/client-ses": "3.292.0",
+    "@directus/format-title": "10.0.0",
+    "@godaddy/terminus": "4.11.2",
+    "@rollup/plugin-alias": "4.0.3",
+    "@rollup/plugin-node-resolve": "15.0.1",
+    "@rollup/plugin-virtual": "3.0.1",
+    "argon2": "0.30.3",
+    "async": "3.2.4",
+    "axios": "1.3.4",
+    "busboy": "1.6.0",
+    "bytes": "3.1.2",
+    "camelcase": "6.3.0",
+    "chalk": "4.1.2",
+    "chokidar": "3.5.3",
+    "commander": "9.5.0",
+    "content-disposition": "0.5.4",
+    "cookie-parser": "1.4.6",
+    "cors": "2.8.5",
+    "csv-parser": "3.0.0",
+    "date-fns": "2.29.3",
+    "deep-diff": "1.0.2",
+    "destroy": "1.2.0",
+    "dotenv": "16.0.3",
+    "encodeurl": "1.0.2",
+    "eventemitter2": "6.4.9",
+    "execa": "5.1.1",
+    "exif-reader": "1.2.0",
+    "express": "4.18.2",
+    "fast-redact": "3.1.2",
+    "flat": "5.0.2",
+    "fs-extra": "11.1.0",
+    "globby": "11.1.0",
+    "graphql": "16.6.0",
+    "graphql-compose": "9.0.10",
+    "helmet": "6.0.1",
+    "icc": "2.0.0",
+    "inquirer": "8.2.5",
+    "ioredis": "5.3.1",
+    "joi": "17.8.4",
+    "js-yaml": "4.1.0",
+    "js2xmlparser": "5.0.0",
+    "json2csv": "5.0.7",
+    "jsonwebtoken": "9.0.0",
+    "keyv": "4.5.2",
+    "knex": "2.4.2",
+    "ldapjs": "2.3.3",
+    "liquidjs": "10.6.1",
+    "lodash-es": "4.17.21",
+    "marked": "4.2.12",
+    "micromustache": "8.0.3",
+    "mime-types": "2.1.35",
+    "ms": "2.1.3",
+    "nanoid": "3.3.4",
+    "node-cron": "3.0.2",
+    "node-machine-id": "1.1.12",
+    "nodemailer": "6.9.1",
+    "object-hash": "3.0.0",
+    "openapi3-ts": "3.2.0",
+    "openid-client": "5.4.0",
+    "ora": "5.4.1",
+    "otplib": "12.0.1",
+    "pino": "8.11.0",
+    "pino-http": "8.3.3",
+    "pino-http-print": "3.1.0",
+    "pino-pretty": "10.0.0",
+    "qs": "6.11.1",
+    "rate-limiter-flexible": "2.4.1",
+    "rollup": "3.19.1",
+    "samlify": "2.8.10",
+    "sanitize-html": "2.10.0",
+    "sharp": "0.31.3",
+    "snappy": "7.2.2",
+    "stream-json": "1.7.5",
+    "strip-bom-stream": "4.0.0",
+    "tmp-promise": "3.0.3",
+    "tsx": "3.12.6",
+    "uuid": "9.0.0",
+    "uuid-validate": "0.0.3",
+    "vm2": "3.9.16",
+    "wellknown": "0.5.0",
+    "@directus/app": "9.25.0",
+    "@directus/constants": "9.25.0",
+    "@directus/exceptions": "9.25.0",
+    "@directus/extensions-sdk": "9.25.0",
+    "@directus/schema": "9.25.0",
+    "@directus/specs": "9.25.0",
+    "@directus/storage": "9.25.0",
+    "@directus/storage-driver-azure": "9.25.0",
+    "@directus/storage-driver-cloudinary": "9.25.0",
+    "@directus/storage-driver-gcs": "9.25.0",
+    "@directus/storage-driver-local": "9.25.0",
+    "@directus/storage-driver-s3": "9.25.0",
+    "@directus/update-check": "9.25.0",
+    "@directus/utils": "9.25.0"
+  },
+  "devDependencies": {
+    "@directus/tsconfig": "0.0.6",
+    "@ngneat/falso": "6.4.0",
+    "@types/async": "3.2.18",
+    "@types/busboy": "1.5.0",
+    "@types/bytes": "3.1.1",
+    "@types/content-disposition": "0.5.5",
+    "@types/cookie-parser": "1.4.3",
+    "@types/cors": "2.8.13",
+    "@types/deep-diff": "1.0.2",
+    "@types/destroy": "1.0.0",
+    "@types/encodeurl": "1.0.0",
+    "@types/exif-reader": "1.0.0",
+    "@types/express": "4.17.17",
+    "@types/express-serve-static-core": "4.17.33",
+    "@types/fast-redact": "3.0.2",
+    "@types/flat": "5.0.2",
+    "@types/fs-extra": "11.0.1",
+    "@types/inquirer": "8.2.6",
+    "@types/js-yaml": "4.0.5",
+    "@types/json2csv": "5.0.3",
+    "@types/jsonwebtoken": "9.0.1",
+    "@types/keyv": "3.1.4",
+    "@types/ldapjs": "2.2.5",
+    "@types/lodash-es": "4.17.7",
+    "@types/marked": "4.0.8",
+    "@types/mime-types": "2.1.1",
+    "@types/ms": "0.7.31",
+    "@types/node": "18.15.3",
+    "@types/node-cron": "3.0.7",
+    "@types/nodemailer": "6.4.7",
+    "@types/object-hash": "3.0.2",
+    "@types/qs": "6.9.7",
+    "@types/sanitize-html": "2.9.0",
+    "@types/sharp": "0.31.1",
+    "@types/stream-json": "1.7.3",
+    "@types/supertest": "2.0.12",
+    "@types/uuid": "9.0.1",
+    "@types/uuid-validate": "0.0.1",
+    "@types/wellknown": "0.5.4",
+    "@vitest/coverage-c8": "0.29.3",
+    "copyfiles": "2.4.1",
+    "form-data": "4.0.0",
+    "knex-mock-client": "2.0.0",
+    "supertest": "6.3.3",
+    "typescript": "4.9.5",
+    "vitest": "0.29.3",
+    "@directus/types": "9.25.0"
+  },
+  "optionalDependencies": {
+    "@keyv/redis": "2.5.7",
+    "keyv-memcache": "1.3.3",
+    "memcached": "2.2.2",
+    "mysql": "2.18.1",
+    "nodemailer-mailgun-transport": "2.1.5",
+    "nodemailer-sendgrid": "1.0.3",
+    "pg": "8.10.0",
+    "sqlite3": "5.1.6",
+    "tedious": "15.1.3"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsc --build && copyfiles \"src/**/*.{yaml,liquid}\" -u 1 dist",
+    "cli": "NODE_ENV=development SERVE_APP=false tsx src/cli/run.ts",
+    "dev": "NODE_ENV=development SERVE_APP=false tsx watch --clear-screen=false src/start.ts",
+    "test": "vitest --watch=false"
+  }
+}