@wbce-d9/api 12.0.6 → 12.2.0

package/dist/app.js

@@ -83,7 +83,11 @@ export default async function createApp() {
     const app = express();
     app.disable('x-powered-by');
     app.set('trust proxy', env['IP_TRUST_PROXY']);
-    app.set('query parser', (str) => qs.parse(str, { depth: 10 }));
+    app.set('query parser', (str) => qs.parse(str, {
+        depth: 10,
+        arrayLimit: env['QS_ARRAY_LIMIT'],
+        parameterLimit: env['QS_PARAMETER_LIMIT'],
+    }));
     app.use(helmet.contentSecurityPolicy(merge({
         useDefaults: true,
         directives: {

package/dist/database/migrations/20251204A-add-collections-check-filter.d.ts

@@ -0,0 +1,3 @@
+import type { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20251204A-add-collections-check-filter.js

@@ -0,0 +1,10 @@
+export async function up(knex) {
+    await knex.schema.alterTable('directus_collections', (table) => {
+        table.json('check_filter').nullable();
+    });
+}
+export async function down(knex) {
+    await knex.schema.alterTable('directus_collections', (table) => {
+        table.dropColumn('check_filter');
+    });
+}

package/dist/database/system-data/fields/collections.yaml

@@ -212,3 +212,25 @@ fields:
 
   - field: collapse
     hidden: true
+
+  - field: check_filter_divider
+    special:
+      - alias
+      - no-data
+    interface: presentation-divider
+    options:
+      icon: rule
+      title: $t:field_options.directus_collections.check_filter_divider
+    width: full
+
+  - field: check_filter
+    special:
+      - cast-json
+    interface: system-filter
+    options:
+      collectionField: collection
+      collectionRequired: true
+      allowFieldComparison: true
+      includeRelations: false
+      relationalFieldSelectable: false
+    width: full

package/dist/env.js

@@ -26,6 +26,11 @@ const allowedEnvironmentVars = [
     'MAX_BATCH_MUTATION',
     'LOGGER_.+',
     'ROBOTS_TXT',
+    'MAX_RELATIONAL_DEPTH',
+    'MAX_ITEMS_PER_QUERY',
+    // query parser
+    'QS_ARRAY_LIMIT',
+    'QS_PARAMETER_LIMIT',
     // server
     'SERVER_.+',
     // database
@@ -204,6 +209,9 @@ const defaults = {
     PUBLIC_URL: '/',
     MAX_PAYLOAD_SIZE: '1mb',
     MAX_RELATIONAL_DEPTH: 10,
+    MAX_ITEMS_PER_QUERY: -1,
+    QS_ARRAY_LIMIT: 100,
+    QS_PARAMETER_LIMIT: 1000,
     MAX_BATCH_MUTATION: Infinity,
     ROBOTS_TXT: 'User-agent: *\nDisallow: /',
     DB_EXCLUDE_TABLES: 'spatial_ref_sys,sysdiagrams',
@@ -294,6 +302,9 @@ const typeMap = {
     GRAPHQL_INTROSPECTION: 'boolean',
     MAX_BATCH_MUTATION: 'number',
     SERVER_SHUTDOWN_TIMEOUT: 'number',
+    MAX_ITEMS_PER_QUERY: 'number',
+    QS_ARRAY_LIMIT: 'number',
+    QS_PARAMETER_LIMIT: 'number',
 };
 let env = {
     ...defaults,

package/dist/services/collections.js

@@ -4,7 +4,7 @@ import { chunk, omit } from 'lodash-es';
 import { clearSystemCache, getCache } from '../cache.js';
 import { ALIAS_TYPES } from '../constants.js';
 import { getHelpers } from '../database/helpers/index.js';
-import getDatabase, { getSchemaInspector } from '../database/index.js';
+import getDatabase, { getDatabaseClient, getSchemaInspector } from '../database/index.js';
 import { systemCollectionRows } from '../database/system-data/collections/index.js';
 import emitter from '../emitter.js';
 import env from '../env.js';
@@ -12,6 +12,8 @@ import { ForbiddenException, InvalidPayloadException } from '../exceptions/index
 import { FieldsService } from '../services/fields.js';
 import { ItemsService } from '../services/items.js';
 import { getSchema } from '../utils/get-schema.js';
+import { applyCollectionCheckConstraint } from '../utils/check-constraints.js';
+import logger from '../logger.js';
 export class CollectionsService {
     knex;
     helpers;
@@ -300,9 +302,21 @@ export class CollectionsService {
                 .where({ collection: collectionKey })
                 .first());
             if (exists) {
-                await collectionItemsService.updateOne(collectionKey, payload.meta, {
-                    ...opts,
-                    bypassEmitAction: (params) => opts?.bypassEmitAction ? opts.bypassEmitAction(params) : nestedActionEvents.push(params),
+                await collectionItemsService.knex.transaction(async (tsx) => {
+                    collectionItemsService.knex = tsx;
+                    if (payload.meta?.check_filter !== undefined) {
+                        const client = getDatabaseClient();
+                        if (client === 'postgres') {
+                            await applyCollectionCheckConstraint(tsx, collectionKey, payload.meta?.check_filter, this.schema);
+                        }
+                        else {
+                            logger.warn(`Check constraints are only enforced for postgres database.`);
+                        }
+                    }
+                    await collectionItemsService.updateOne(collectionKey, payload.meta, {
+                        ...opts,
+                        bypassEmitAction: (params) => opts?.bypassEmitAction ? opts.bypassEmitAction(params) : nestedActionEvents.push(params),
+                    });
                 });
             }
             else {

package/dist/types/collection.d.ts

@@ -10,6 +10,7 @@ export type CollectionMeta = {
     item_duplication_fields: string[] | null;
     accountability: 'all' | 'accountability' | null;
     group: string | null;
+    check_filter?: Record<string, any> | null;
 };
 export type Collection = {
     collection: string;

package/dist/utils/apply-query.d.ts

@@ -30,5 +30,6 @@ export declare function applyFilter(knex: Knex, schema: SchemaOverview, rootQuer
     query: Knex.QueryBuilder<any, any>;
     hasMultiRelationalFilter: boolean;
 };
+export declare function addWhereClauses(knex: Knex, schema: SchemaOverview, dbQuery: Knex.QueryBuilder, filter: Filter, collection: string, aliasMap: AliasMap, logical?: 'and' | 'or'): void;
 export declare function applySearch(schema: SchemaOverview, dbQuery: Knex.QueryBuilder, searchQuery: string, collection: string): Promise<void>;
 export declare function applyAggregate(dbQuery: Knex.QueryBuilder, aggregate: Aggregate, collection: string): void;

package/dist/utils/apply-query.js

@@ -177,11 +177,10 @@ export function applyOffset(knex, rootQuery, offset) {
     }
 }
 export function applyFilter(knex, schema, rootQuery, rootFilter, collection, aliasMap) {
-    const helpers = getHelpers(knex);
     const relations = schema.relations;
     let hasMultiRelationalFilter = false;
     addJoins(rootQuery, rootFilter, collection);
-    addWhereClauses(knex, rootQuery, rootFilter, collection);
+    addWhereClauses(knex, schema, rootQuery, rootFilter, collection, aliasMap);
     return { query: rootQuery, hasMultiRelationalFilter };
     function addJoins(dbQuery, filter, collection) {
         for (const [key, value] of Object.entries(filter)) {
@@ -213,265 +212,267 @@ export function applyFilter(knex, schema, rootQuery, rootFilter, collection, ali
             }
         }
     }
-    function addWhereClauses(knex, dbQuery, filter, collection, logical = 'and') {
-        for (const [key, value] of Object.entries(filter)) {
-            if (key === '_or' || key === '_and') {
-                // If the _or array contains an empty object (full permissions), we should short-circuit and ignore all other
-                // permission checks, as {} already matches full permissions.
-                if (key === '_or' && value.some((subFilter) => Object.keys(subFilter).length === 0)) {
-                    continue;
-                }
-                /** @NOTE this callback function isn't called until Knex runs the query */
-                dbQuery[logical].where((subQuery) => {
-                    value.forEach((subFilter) => {
-                        addWhereClauses(knex, subQuery, subFilter, collection, key === '_and' ? 'and' : 'or');
-                    });
-                });
+}
+export function addWhereClauses(knex, schema, dbQuery, filter, collection, aliasMap, logical = 'and') {
+    const helpers = getHelpers(knex);
+    const relations = schema.relations;
+    for (const [key, value] of Object.entries(filter)) {
+        if (key === '_or' || key === '_and') {
+            // If the _or array contains an empty object (full permissions), we should short-circuit and ignore all other
+            // permission checks, as {} already matches full permissions.
+            if (key === '_or' && value.some((subFilter) => Object.keys(subFilter).length === 0)) {
                 continue;
             }
-            const filterPath = getFilterPath(key, value);
-            /**
-             * For A2M fields, the path can contain an optional collection scope <field>:<scope>
-             */
-            const pathRoot = filterPath[0].split(':')[0];
-            const { relation, relationType } = getRelationInfo(relations, collection, pathRoot);
-            const { operator: filterOperator, value: filterValue } = getOperation(key, value);
-            if (filterPath.length > 1 ||
-                (!(key.includes('(') && key.includes(')')) && schema.collections[collection].fields[key].type === 'alias')) {
-                if (!relation)
-                    continue;
-                if (relationType === 'o2m' || relationType === 'o2a') {
-                    let pkField = `${collection}.${schema.collections[relation.related_collection].primary}`;
-                    if (relationType === 'o2a') {
-                        pkField = knex.raw(getHelpers(knex).schema.castA2oPrimaryKey(), [pkField]);
-                    }
-                    const subQueryBuilder = (filter) => (subQueryKnex) => {
-                        const field = relation.field;
-                        const collection = relation.collection;
-                        const column = `${collection}.${field}`;
-                        subQueryKnex
-                            .select({ [field]: column })
-                            .from(collection)
-                            .whereNotNull(column);
-                        applyQuery(knex, relation.collection, subQueryKnex, { filter }, schema);
-                    };
-                    const childKey = Object.keys(value)?.[0];
-                    if (childKey === '_none') {
-                        dbQuery[logical].whereNotIn(pkField, subQueryBuilder(Object.values(value)[0]));
-                        continue;
-                    }
-                    else if (childKey === '_some') {
-                        dbQuery[logical].whereIn(pkField, subQueryBuilder(Object.values(value)[0]));
-                        continue;
-                    }
-                }
-                if (filterPath.includes('_none') || filterPath.includes('_some')) {
-                    throw new InvalidQueryException(`"${filterPath.includes('_none') ? '_none' : '_some'}" can only be used with top level relational alias field`);
-                }
-                const { columnPath, targetCollection, addNestedPkField } = getColumnPath({
-                    path: filterPath,
-                    collection,
-                    relations,
-                    aliasMap,
-                    schema,
+            /** @NOTE this callback function isn't called until Knex runs the query */
+            dbQuery[logical].where((subQuery) => {
+                value.forEach((subFilter) => {
+                    addWhereClauses(knex, schema, subQuery, subFilter, collection, aliasMap, key === '_and' ? 'and' : 'or');
                 });
-                if (addNestedPkField) {
-                    filterPath.push(addNestedPkField);
+            });
+            continue;
+        }
+        const filterPath = getFilterPath(key, value);
+        /**
+         * For A2M fields, the path can contain an optional collection scope <field>:<scope>
+         */
+        const pathRoot = filterPath[0].split(':')[0];
+        const { relation, relationType } = getRelationInfo(relations, collection, pathRoot);
+        const { operator: filterOperator, value: filterValue } = getOperation(key, value);
+        if (filterPath.length > 1 ||
+            (!(key.includes('(') && key.includes(')')) && schema.collections[collection].fields[key].type === 'alias')) {
+            if (!relation)
+                continue;
+            if (relationType === 'o2m' || relationType === 'o2a') {
+                let pkField = `${collection}.${schema.collections[relation.related_collection].primary}`;
+                if (relationType === 'o2a') {
+                    pkField = knex.raw(getHelpers(knex).schema.castA2oPrimaryKey(), [pkField]);
+                }
+                const subQueryBuilder = (filter) => (subQueryKnex) => {
+                    const field = relation.field;
+                    const collection = relation.collection;
+                    const column = `${collection}.${field}`;
+                    subQueryKnex
+                        .select({ [field]: column })
+                        .from(collection)
+                        .whereNotNull(column);
+                    applyQuery(knex, relation.collection, subQueryKnex, { filter }, schema);
+                };
+                const childKey = Object.keys(value)?.[0];
+                if (childKey === '_none') {
+                    dbQuery[logical].whereNotIn(pkField, subQueryBuilder(Object.values(value)[0]));
+                    continue;
                 }
-                if (!columnPath)
+                else if (childKey === '_some') {
+                    dbQuery[logical].whereIn(pkField, subQueryBuilder(Object.values(value)[0]));
                     continue;
-                const { type, special } = validateFilterField(schema.collections[targetCollection].fields, stripFunction(filterPath[filterPath.length - 1]), targetCollection);
-                validateFilterOperator(type, filterOperator, special);
-                applyFilterToQuery(columnPath, filterOperator, filterValue, logical, targetCollection);
+                }
             }
-            else {
-                const { type, special } = validateFilterField(schema.collections[collection].fields, stripFunction(filterPath[0]), collection);
-                validateFilterOperator(type, filterOperator, special);
-                applyFilterToQuery(`${collection}.${filterPath[0]}`, filterOperator, filterValue, logical);
+            if (filterPath.includes('_none') || filterPath.includes('_some')) {
+                throw new InvalidQueryException(`"${filterPath.includes('_none') ? '_none' : '_some'}" can only be used with top level relational alias field`);
             }
-        }
-        function validateFilterField(fields, key, collection = 'unknown') {
-            if (fields[key] === undefined) {
-                throw new InvalidQueryException(`Invalid filter key "${key}" on "${collection}"`);
+            const { columnPath, targetCollection, addNestedPkField } = getColumnPath({
+                path: filterPath,
+                collection,
+                relations,
+                aliasMap,
+                schema,
+            });
+            if (addNestedPkField) {
+                filterPath.push(addNestedPkField);
             }
-            return fields[key];
+            if (!columnPath)
+                continue;
+            const { type, special } = validateFilterField(schema.collections[targetCollection].fields, stripFunction(filterPath[filterPath.length - 1]), targetCollection);
+            validateFilterOperator(type, filterOperator, special);
+            applyFilterToQuery(columnPath, filterOperator, filterValue, logical, targetCollection);
         }
-        function validateFilterOperator(type, filterOperator, special) {
-            if (filterOperator.startsWith('_')) {
-                filterOperator = filterOperator.slice(1);
-            }
-            if (!getFilterOperatorsForType(type).includes(filterOperator)) {
-                throw new InvalidQueryException(`"${type}" field type does not contain the "_${filterOperator}" filter operator`);
-            }
-            if (special.includes('conceal') &&
-                !getFilterOperatorsForType('hash').includes(filterOperator)) {
-                throw new InvalidQueryException(`Field with "conceal" special does not allow the "_${filterOperator}" filter operator`);
-            }
+        else {
+            const { type, special } = validateFilterField(schema.collections[collection].fields, stripFunction(filterPath[0]), collection);
+            validateFilterOperator(type, filterOperator, special);
+            applyFilterToQuery(`${collection}.${filterPath[0]}`, filterOperator, filterValue, logical);
         }
-        function applyFilterToQuery(key, operator, compareValue, logical = 'and', originalCollectionName) {
-            const [table, column] = key.split('.');
-            // Is processed through Knex.Raw, so should be safe to string-inject into these where queries
-            const selectionRaw = getColumn(knex, table, column, false, schema, { originalCollectionName });
-            // Knex supports "raw" in the columnName parameter, but isn't typed as such. Too bad..
-            // See https://github.com/knex/knex/issues/4518 @TODO remove as any once knex is updated
-            // These operators don't rely on a value, and can thus be used without one (eg `?filter[field][_null]`)
-            if (operator === '_null' || (operator === '_nnull' && compareValue === false)) {
-                dbQuery[logical].whereNull(selectionRaw);
-            }
-            if (operator === '_nnull' || (operator === '_null' && compareValue === false)) {
-                dbQuery[logical].whereNotNull(selectionRaw);
-            }
-            if (operator === '_empty' || (operator === '_nempty' && compareValue === false)) {
-                dbQuery[logical].andWhere((query) => {
-                    query.whereNull(key).orWhere(key, '=', '');
-                });
-            }
-            if (operator === '_nempty' || (operator === '_empty' && compareValue === false)) {
-                dbQuery[logical].andWhere((query) => {
-                    query.whereNotNull(key).andWhere(key, '!=', '');
-                });
-            }
-            // The following fields however, require a value to be run. If no value is passed, we
-            // ignore them. This allows easier use in GraphQL, where you wouldn't be able to
-            // conditionally build out your filter structure (#4471)
-            if (compareValue === undefined)
-                return;
-            if (Array.isArray(compareValue)) {
-                // Tip: when using a `[Type]` type in GraphQL, but don't provide the variable, it'll be
-                // reported as [undefined].
-                // We need to remove any undefined values, as they are useless
-                compareValue = compareValue.filter((val) => val !== undefined);
+    }
+    function validateFilterField(fields, key, collection = 'unknown') {
+        if (fields[key] === undefined) {
+            throw new InvalidQueryException(`Invalid filter key "${key}" on "${collection}"`);
+        }
+        return fields[key];
+    }
+    function validateFilterOperator(type, filterOperator, special) {
+        if (filterOperator.startsWith('_')) {
+            filterOperator = filterOperator.slice(1);
+        }
+        if (!getFilterOperatorsForType(type).includes(filterOperator)) {
+            throw new InvalidQueryException(`"${type}" field type does not contain the "_${filterOperator}" filter operator`);
+        }
+        if (special.includes('conceal') &&
+            !getFilterOperatorsForType('hash').includes(filterOperator)) {
+            throw new InvalidQueryException(`Field with "conceal" special does not allow the "_${filterOperator}" filter operator`);
+        }
+    }
+    function applyFilterToQuery(key, operator, compareValue, logical = 'and', originalCollectionName) {
+        const [table, column] = key.split('.');
+        // Is processed through Knex.Raw, so should be safe to string-inject into these where queries
+        const selectionRaw = getColumn(knex, table, column, false, schema, { originalCollectionName });
+        // Knex supports "raw" in the columnName parameter, but isn't typed as such. Too bad..
+        // See https://github.com/knex/knex/issues/4518 @TODO remove as any once knex is updated
+        // These operators don't rely on a value, and can thus be used without one (eg `?filter[field][_null]`)
+        if (operator === '_null' || (operator === '_nnull' && compareValue === false)) {
+            dbQuery[logical].whereNull(selectionRaw);
+        }
+        if (operator === '_nnull' || (operator === '_null' && compareValue === false)) {
+            dbQuery[logical].whereNotNull(selectionRaw);
+        }
+        if (operator === '_empty' || (operator === '_nempty' && compareValue === false)) {
+            dbQuery[logical].andWhere((query) => {
+                query.whereNull(key).orWhere(key, '=', '');
+            });
+        }
+        if (operator === '_nempty' || (operator === '_empty' && compareValue === false)) {
+            dbQuery[logical].andWhere((query) => {
+                query.whereNotNull(key).andWhere(key, '!=', '');
+            });
+        }
+        // The following fields however, require a value to be run. If no value is passed, we
+        // ignore them. This allows easier use in GraphQL, where you wouldn't be able to
+        // conditionally build out your filter structure (#4471)
+        if (compareValue === undefined)
+            return;
+        if (Array.isArray(compareValue)) {
+            // Tip: when using a `[Type]` type in GraphQL, but don't provide the variable, it'll be
+            // reported as [undefined].
+            // We need to remove any undefined values, as they are useless
+            compareValue = compareValue.filter((val) => val !== undefined);
+        }
+        // Cast filter value (compareValue) based on function used
+        if (column.includes('(') && column.includes(')')) {
+            const functionName = column.split('(')[0];
+            const type = getOutputTypeForFunction(functionName);
+            if (['bigInteger', 'integer', 'float', 'decimal'].includes(type)) {
+                compareValue = Number(compareValue);
             }
-            // Cast filter value (compareValue) based on function used
-            if (column.includes('(') && column.includes(')')) {
-                const functionName = column.split('(')[0];
-                const type = getOutputTypeForFunction(functionName);
-                if (['bigInteger', 'integer', 'float', 'decimal'].includes(type)) {
-                    compareValue = Number(compareValue);
+        }
+        // Cast filter value (compareValue) based on type of field being filtered against
+        const [collection, field] = key.split('.');
+        const mappedCollection = (originalCollectionName || collection);
+        if (mappedCollection in schema.collections && field in schema.collections[mappedCollection].fields) {
+            const type = schema.collections[mappedCollection].fields[field].type;
+            if (['date', 'dateTime', 'time', 'timestamp'].includes(type)) {
+                if (Array.isArray(compareValue)) {
+                    compareValue = compareValue.map((val) => helpers.date.parse(val));
+                }
+                else {
+                    compareValue = helpers.date.parse(compareValue);
                 }
             }
-            // Cast filter value (compareValue) based on type of field being filtered against
-            const [collection, field] = key.split('.');
-            const mappedCollection = (originalCollectionName || collection);
-            if (mappedCollection in schema.collections && field in schema.collections[mappedCollection].fields) {
-                const type = schema.collections[mappedCollection].fields[field].type;
-                if (['date', 'dateTime', 'time', 'timestamp'].includes(type)) {
-                    if (Array.isArray(compareValue)) {
-                        compareValue = compareValue.map((val) => helpers.date.parse(val));
-                    }
-                    else {
-                        compareValue = helpers.date.parse(compareValue);
-                    }
+            if (['bigInteger', 'integer', 'float', 'decimal'].includes(type)) {
+                if (Array.isArray(compareValue)) {
+                    compareValue = compareValue.map((val) => Number(val));
                 }
-                if (['bigInteger', 'integer', 'float', 'decimal'].includes(type)) {
-                    if (Array.isArray(compareValue)) {
-                        compareValue = compareValue.map((val) => Number(val));
-                    }
-                    else {
-                        compareValue = Number(compareValue);
-                    }
+                else {
+                    compareValue = Number(compareValue);
                 }
             }
-            if (operator === '_eq') {
-                dbQuery[logical].where(selectionRaw, '=', compareValue);
-            }
-            if (operator === '_neq') {
-                dbQuery[logical].whereNot(selectionRaw, compareValue);
-            }
-            if (operator === '_ieq') {
-                dbQuery[logical].whereRaw(`LOWER(??) = ?`, [selectionRaw, `${compareValue.toLowerCase()}`]);
-            }
-            if (operator === '_nieq') {
-                dbQuery[logical].whereRaw(`LOWER(??) <> ?`, [selectionRaw, `${compareValue.toLowerCase()}`]);
-            }
-            if (operator === '_contains') {
-                dbQuery[logical].where(selectionRaw, 'like', `%${compareValue}%`);
-            }
-            if (operator === '_ncontains') {
-                dbQuery[logical].whereNot(selectionRaw, 'like', `%${compareValue}%`);
-            }
-            if (operator === '_icontains') {
-                dbQuery[logical].whereRaw(`LOWER(??) LIKE ?`, [selectionRaw, `%${compareValue.toLowerCase()}%`]);
-            }
-            if (operator === '_nicontains') {
-                dbQuery[logical].whereRaw(`LOWER(??) NOT LIKE ?`, [selectionRaw, `%${compareValue.toLowerCase()}%`]);
-            }
-            if (operator === '_starts_with') {
-                dbQuery[logical].where(key, 'like', `${compareValue}%`);
-            }
-            if (operator === '_nstarts_with') {
-                dbQuery[logical].whereNot(key, 'like', `${compareValue}%`);
-            }
-            if (operator === '_istarts_with') {
-                dbQuery[logical].whereRaw(`LOWER(??) LIKE ?`, [selectionRaw, `${compareValue.toLowerCase()}%`]);
-            }
-            if (operator === '_nistarts_with') {
-                dbQuery[logical].whereRaw(`LOWER(??) NOT LIKE ?`, [selectionRaw, `${compareValue.toLowerCase()}%`]);
-            }
-            if (operator === '_ends_with') {
-                dbQuery[logical].where(key, 'like', `%${compareValue}`);
-            }
-            if (operator === '_nends_with') {
-                dbQuery[logical].whereNot(key, 'like', `%${compareValue}`);
-            }
-            if (operator === '_iends_with') {
-                dbQuery[logical].whereRaw(`LOWER(??) LIKE ?`, [selectionRaw, `%${compareValue.toLowerCase()}`]);
-            }
-            if (operator === '_niends_with') {
-                dbQuery[logical].whereRaw(`LOWER(??) NOT LIKE ?`, [selectionRaw, `%${compareValue.toLowerCase()}`]);
-            }
-            if (operator === '_gt') {
-                dbQuery[logical].where(selectionRaw, '>', compareValue);
-            }
-            if (operator === '_gte') {
-                dbQuery[logical].where(selectionRaw, '>=', compareValue);
-            }
-            if (operator === '_lt') {
-                dbQuery[logical].where(selectionRaw, '<', compareValue);
-            }
-            if (operator === '_lte') {
-                dbQuery[logical].where(selectionRaw, '<=', compareValue);
-            }
-            if (operator === '_in') {
-                let value = compareValue;
-                if (typeof value === 'string')
-                    value = value.split(',');
-                dbQuery[logical].whereIn(selectionRaw, value);
-            }
-            if (operator === '_nin') {
-                let value = compareValue;
-                if (typeof value === 'string')
-                    value = value.split(',');
-                dbQuery[logical].whereNotIn(selectionRaw, value);
-            }
-            if (operator === '_between') {
-                if (compareValue.length !== 2)
-                    return;
-                let value = compareValue;
-                if (typeof value === 'string')
-                    value = value.split(',');
-                dbQuery[logical].whereBetween(selectionRaw, value);
-            }
-            if (operator === '_nbetween') {
-                if (compareValue.length !== 2)
-                    return;
-                let value = compareValue;
-                if (typeof value === 'string')
-                    value = value.split(',');
-                dbQuery[logical].whereNotBetween(selectionRaw, value);
-            }
-            if (operator == '_intersects') {
-                dbQuery[logical].whereRaw(helpers.st.intersects(key, compareValue));
-            }
-            if (operator == '_nintersects') {
-                dbQuery[logical].whereRaw(helpers.st.nintersects(key, compareValue));
-            }
-            if (operator == '_intersects_bbox') {
-                dbQuery[logical].whereRaw(helpers.st.intersects_bbox(key, compareValue));
-            }
-            if (operator == '_nintersects_bbox') {
-                dbQuery[logical].whereRaw(helpers.st.nintersects_bbox(key, compareValue));
-            }
+        }
+        if (operator === '_eq') {
+            dbQuery[logical].where(selectionRaw, '=', compareValue);
+        }
+        if (operator === '_neq') {
+            dbQuery[logical].whereNot(selectionRaw, compareValue);
+        }
+        if (operator === '_ieq') {
+            dbQuery[logical].whereRaw(`LOWER(??) = ?`, [selectionRaw, `${compareValue.toLowerCase()}`]);
+        }
+        if (operator === '_nieq') {
+            dbQuery[logical].whereRaw(`LOWER(??) <> ?`, [selectionRaw, `${compareValue.toLowerCase()}`]);
+        }
+        if (operator === '_contains') {
+            dbQuery[logical].where(selectionRaw, 'like', `%${compareValue}%`);
+        }
+        if (operator === '_ncontains') {
+            dbQuery[logical].whereNot(selectionRaw, 'like', `%${compareValue}%`);
+        }
+        if (operator === '_icontains') {
+            dbQuery[logical].whereRaw(`LOWER(??) LIKE ?`, [selectionRaw, `%${compareValue.toLowerCase()}%`]);
+        }
+        if (operator === '_nicontains') {
+            dbQuery[logical].whereRaw(`LOWER(??) NOT LIKE ?`, [selectionRaw, `%${compareValue.toLowerCase()}%`]);
+        }
+        if (operator === '_starts_with') {
+            dbQuery[logical].where(key, 'like', `${compareValue}%`);
+        }
+        if (operator === '_nstarts_with') {
+            dbQuery[logical].whereNot(key, 'like', `${compareValue}%`);
+        }
+        if (operator === '_istarts_with') {
+            dbQuery[logical].whereRaw(`LOWER(??) LIKE ?`, [selectionRaw, `${compareValue.toLowerCase()}%`]);
+        }
+        if (operator === '_nistarts_with') {
+            dbQuery[logical].whereRaw(`LOWER(??) NOT LIKE ?`, [selectionRaw, `${compareValue.toLowerCase()}%`]);
+        }
+        if (operator === '_ends_with') {
+            dbQuery[logical].where(key, 'like', `%${compareValue}`);
+        }
+        if (operator === '_nends_with') {
+            dbQuery[logical].whereNot(key, 'like', `%${compareValue}`);
+        }
+        if (operator === '_iends_with') {
+            dbQuery[logical].whereRaw(`LOWER(??) LIKE ?`, [selectionRaw, `%${compareValue.toLowerCase()}`]);
+        }
+        if (operator === '_niends_with') {
+            dbQuery[logical].whereRaw(`LOWER(??) NOT LIKE ?`, [selectionRaw, `%${compareValue.toLowerCase()}`]);
+        }
+        if (operator === '_gt') {
+            dbQuery[logical].where(selectionRaw, '>', compareValue);
+        }
+        if (operator === '_gte') {
+            dbQuery[logical].where(selectionRaw, '>=', compareValue);
+        }
+        if (operator === '_lt') {
+            dbQuery[logical].where(selectionRaw, '<', compareValue);
+        }
+        if (operator === '_lte') {
+            dbQuery[logical].where(selectionRaw, '<=', compareValue);
+        }
+        if (operator === '_in') {
+            let value = compareValue;
+            if (typeof value === 'string')
+                value = value.split(',');
+            dbQuery[logical].whereIn(selectionRaw, value);
+        }
+        if (operator === '_nin') {
+            let value = compareValue;
+            if (typeof value === 'string')
+                value = value.split(',');
+            dbQuery[logical].whereNotIn(selectionRaw, value);
+        }
+        if (operator === '_between') {
+            if (compareValue.length !== 2)
+                return;
+            let value = compareValue;
+            if (typeof value === 'string')
+                value = value.split(',');
+            dbQuery[logical].whereBetween(selectionRaw, value);
+        }
+        if (operator === '_nbetween') {
+            if (compareValue.length !== 2)
+                return;
+            let value = compareValue;
+            if (typeof value === 'string')
+                value = value.split(',');
+            dbQuery[logical].whereNotBetween(selectionRaw, value);
+        }
+        if (operator == '_intersects') {
+            dbQuery[logical].whereRaw(helpers.st.intersects(key, compareValue));
+        }
+        if (operator == '_nintersects') {
+            dbQuery[logical].whereRaw(helpers.st.nintersects(key, compareValue));
+        }
+        if (operator == '_intersects_bbox') {
+            dbQuery[logical].whereRaw(helpers.st.intersects_bbox(key, compareValue));
+        }
+        if (operator == '_nintersects_bbox') {
+            dbQuery[logical].whereRaw(helpers.st.nintersects_bbox(key, compareValue));
         }
     }
 }

package/dist/utils/check-constraints.d.ts

@@ -0,0 +1,4 @@
+import type { Filter, SchemaOverview } from '@wbce-d9/types';
+import type { Knex } from 'knex';
+export declare function formulateCheckClause(knex: Knex, collection: string, filter: Filter, schema: SchemaOverview): Promise<void>;
+export declare function applyCollectionCheckConstraint(knex: Knex, collection: string, filter: Filter | null, schema: SchemaOverview): Promise<void>;

package/dist/utils/check-constraints.js

@@ -0,0 +1,49 @@
+import { addWhereClauses } from './apply-query.js';
+import { cloneDeep } from 'lodash-es';
+export async function formulateCheckClause(knex, collection, filter, schema) {
+    /**
+     * Strategy :
+     * With filter, we are able to formulate a where statement but not a check statement.
+     * So we formulate the where statement that we will then place in a check statement.
+     * Also, with filter, right assignment of operator are always values (simple ?) in the final query
+     * With the comparaison syntax of check constraint, we want to be able to have right assignent of field
+     * e.g. : filter = {date_end : {_gt : "$FIELD(date_start)" }} should transform into "?? > ??"
+     * To ensure this :
+     *      - we formulate the where clause
+     *      - we change every simple ? to a double ?? when the "?" is for a binding of form $FIELD(...)
+     */
+    const cloneFilter = cloneDeep(filter);
+    const queryBuilder = knex.queryBuilder();
+    addWhereClauses(knex, schema, queryBuilder, cloneFilter, collection, Object.create(null));
+    const sqlQuery = queryBuilder.toSQL();
+    let bindIndex = 0;
+    const checkBindings = [];
+    const whereClause = sqlQuery.sql.replace(/\?+/g, function (value) {
+        const bind = sqlQuery.bindings[bindIndex];
+        const fieldConstraint = bind?.toString().match(/^\$FIELD\((.*)\)$/i)?.[1];
+        let result;
+        if (fieldConstraint !== undefined) {
+            result = '??';
+            checkBindings.push(fieldConstraint);
+        }
+        else {
+            result = value;
+            checkBindings.push(bind);
+        }
+        bindIndex++;
+        return result;
+    });
+    const whereString = knex.raw(whereClause, checkBindings).toQuery();
+    let checkClause = whereString.match(/where\s+(.+)/i)[1];
+    checkClause = checkClause.replaceAll('?', '\\?');
+    await knex.schema.table(collection, (table) => {
+        table.check(checkClause, undefined, 'directus_constraint');
+    });
+}
+export async function applyCollectionCheckConstraint(knex, collection, filter, schema) {
+    await knex.raw(`ALTER TABLE ?? DROP CONSTRAINT IF EXISTS "directus_constraint"`, [collection]);
+    if (!filter || Object.keys(filter).length === 0) {
+        return;
+    }
+    await formulateCheckClause(knex, collection, filter, schema);
+}

package/dist/utils/get-schema.js

@@ -49,7 +49,7 @@ async function getDatabaseSchema(database, schemaInspector) {
     const schemaOverview = await schemaInspector.overview();
     const collections = [
         ...(await database
-            .select('collection', 'singleton', 'note', 'sort_field', 'accountability')
+            .select('collection', 'singleton', 'note', 'sort_field', 'accountability', 'check_filter')
             .from('directus_collections')),
         ...systemCollectionRows,
     ];
@@ -74,6 +74,7 @@ async function getDatabaseSchema(database, schemaInspector) {
             note: collectionMeta?.note || null,
             sortField: collectionMeta?.sort_field || null,
             accountability: collectionMeta ? collectionMeta.accountability : 'all',
+            check_filter: collectionMeta?.check_filter || null,
             fields: mapValues(schemaOverview[collection]?.columns, (column) => {
                 return {
                     field: column.column_name,

package/dist/utils/sanitize-query.js

@@ -1,12 +1,17 @@
 import { parseFilter, parseJSON } from '@wbce-d9/utils';
 import { flatten, get, isPlainObject, merge, set } from 'lodash-es';
+import env from '../env.js';
 import logger from '../logger.js';
 import { Meta } from '../types/index.js';
 export function sanitizeQuery(rawQuery, accountability) {
     const query = {};
     if (rawQuery['limit'] !== undefined) {
-        const limit = sanitizeLimit(rawQuery['limit']);
+        let limit = sanitizeLimit(rawQuery['limit']);
         if (typeof limit === 'number') {
+            const maxItemsPerQuery = env['MAX_ITEMS_PER_QUERY'];
+            if (maxItemsPerQuery !== -1 && limit === -1) {
+                limit = maxItemsPerQuery;
+            }
             query.limit = limit;
         }
     }

package/dist/utils/validate-query.js

@@ -27,6 +27,9 @@ export function validateQuery(query) {
     if (query.alias) {
         validateAlias(query.alias);
     }
+    if (query.limit) {
+        validateLimit(query.limit);
+    }
     validateRelationalDepth(query);
     if (error) {
         throw new InvalidQueryException(error.message);
@@ -196,3 +199,9 @@ function validateRelationalDepth(query) {
         }
     }
 }
+function validateLimit(limit) {
+    const maxItemsPerQuery = env['MAX_ITEMS_PER_QUERY'];
+    if (maxItemsPerQuery !== -1 && limit > maxItemsPerQuery) {
+        throw new InvalidQueryException(`"Limit" can't exceed ${maxItemsPerQuery}`);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.0.6",
+  "version": "12.2.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -111,7 +111,7 @@
     "knex": "3.1.0",
     "ldapjs": "2.3.3",
     "liquidjs": "10.7.0",
-    "lodash-es": "4.17.21",
+    "lodash-es": "4.17.23",
     "marked": "4.3.0",
     "micromustache": "8.0.3",
     "mime-types": "2.1.35",
@@ -129,7 +129,7 @@
     "pino-http": "8.3.3",
     "pino-http-print": "3.1.0",
     "pino-pretty": "10.0.0",
-    "qs": "6.11.1",
+    "qs": "6.14.1",
     "rate-limiter-flexible": "2.4.1",
     "rollup": "3.29.5",
     "samlify": "2.10.0",
@@ -143,20 +143,20 @@
     "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
     "wellknown": "0.5.0",
-    "@wbce-d9/app": "9.34.0",
     "@wbce-d9/constants": "10.0.0",
+    "@wbce-d9/app": "9.35.1",
     "@wbce-d9/exceptions": "10.0.0",
-    "@wbce-d9/extensions-sdk": "10.0.0",
-    "@wbce-d9/schema": "10.0.0",
-    "@wbce-d9/storage": "10.0.0",
-    "@wbce-d9/storage-driver-azure": "10.0.0",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.0",
+    "@wbce-d9/extensions-sdk": "10.0.2",
     "@wbce-d9/specs": "9.26.5",
-    "@wbce-d9/storage-driver-gcs": "10.0.0",
-    "@wbce-d9/storage-driver-local": "10.0.0",
-    "@wbce-d9/storage-driver-s3": "10.0.0",
-    "@wbce-d9/update-check": "10.0.0",
-    "@wbce-d9/utils": "10.0.0"
+    "@wbce-d9/storage": "10.0.0",
+    "@wbce-d9/storage-driver-azure": "10.0.1",
+    "@wbce-d9/schema": "10.0.0",
+    "@wbce-d9/storage-driver-cloudinary": "10.0.1",
+    "@wbce-d9/storage-driver-local": "10.0.1",
+    "@wbce-d9/storage-driver-s3": "10.0.1",
+    "@wbce-d9/storage-driver-gcs": "10.0.1",
+    "@wbce-d9/update-check": "10.0.1",
+    "@wbce-d9/utils": "10.0.1"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
@@ -204,7 +204,7 @@
     "supertest": "6.3.3",
     "typescript": "5.0.4",
     "vitest": "0.30.1",
-    "@wbce-d9/types": "10.0.0"
+    "@wbce-d9/types": "10.1.0"
   },
   "optionalDependencies": {
     "@keyv/redis": "2.5.7",