@wbce-d9/api 12.6.0 → 12.6.1

package/dist/flows.d.ts

@@ -15,6 +15,11 @@ declare class FlowManager {
     runOperationFlow(id: string, data: unknown, context: Record<string, unknown>): Promise<unknown>;
     runWebhookFlow(id: string, data: unknown, context: Record<string, unknown>): Promise<unknown>;
     private load;
+    /**
+     * Manual flows act on behalf of the triggering user: make sure that user can see the flow itself
+     * and read the collection / items passed in the payload before running it.
+     */
+    private checkManualTriggerAccess;
     private unload;
     private executeFlow;
     private executeOperation;

package/dist/flows.js

@@ -197,13 +197,16 @@ class FlowManager {
                         logger.warn(`Specified collection must be one of: ${enabledCollections.join(', ')}.`);
                         throw new exceptions.ForbiddenException();
                     }
-                    if (flow.options['async']) {
-                        this.executeFlow(flow, data, context);
-                        return undefined;
-                    }
-                    else {
-                        return this.executeFlow(flow, data, context);
-                    }
+                    const run = () => {
+                        if (flow.options['async']) {
+                            this.executeFlow(flow, data, context);
+                            return undefined;
+                        }
+                        else {
+                            return this.executeFlow(flow, data, context);
+                        }
+                    };
+                    return this.checkManualTriggerAccess(flow, targetCollection, data, context).then(run);
                 };
                 // Default return to $last for manual
                 flow.options['return'] = '$last';
@@ -212,6 +215,34 @@ class FlowManager {
         }
         this.isLoaded = true;
     }
+    /**
+     * Manual flows act on behalf of the triggering user: make sure that user can see the flow itself
+     * and read the collection / items passed in the payload before running it.
+     */
+    async checkManualTriggerAccess(flow, collection, data, context) {
+        const accountability = context['accountability'];
+        if (!accountability)
+            throw new exceptions.ForbiddenException();
+        if (accountability.admin)
+            return;
+        const database = context['database'] ?? getDatabase();
+        const schema = context['schema'] ?? (await getSchema({ database }));
+        const flowsService = new FlowsService({ accountability, knex: database, schema });
+        await flowsService.readOne(flow.id, { fields: ['id'] });
+        const keys = data?.['body']?.keys;
+        if (keys === null || keys === undefined || (Array.isArray(keys) && keys.length === 0)) {
+            if (flow.options?.['requireSelection'] !== false)
+                throw new exceptions.ForbiddenException();
+            const canReadCollection = accountability.permissions?.some((permission) => permission.collection === collection && permission.action === 'read');
+            if (!canReadCollection)
+                throw new exceptions.ForbiddenException();
+            return;
+        }
+        if (!Array.isArray(keys))
+            throw new exceptions.ForbiddenException();
+        const authorizationService = new services.AuthorizationService({ accountability, knex: database, schema });
+        await authorizationService.checkAccess('read', collection, keys);
+    }
     async unload() {
         for (const trigger of this.triggerHandlers) {
             trigger.events.forEach((event) => {

package/dist/services/fields.js

@@ -458,6 +458,18 @@ export class FieldsService {
                 if (Object.keys(collectionMetaUpdates).length > 0) {
                     await trx('directus_collections').update(collectionMetaUpdates).where({ collection });
                 }
+                const permissions = await trx('directus_permissions')
+                    .select('id', 'fields')
+                    .where({ collection });
+                for (const permission of permissions) {
+                    const permittedFields = permission.fields?.split(',') ?? [];
+                    if (permittedFields.includes(field) === false)
+                        continue;
+                    const remainingFields = permittedFields.filter((permittedField) => permittedField !== field);
+                    await trx('directus_permissions')
+                        .update({ fields: remainingFields.length > 0 ? remainingFields.join(',') : null })
+                        .where({ id: permission.id });
+                }
                 // Cleanup directus_fields
                 const metaRow = await trx
                     .select('collection', 'field')

package/dist/services/payload.js

@@ -35,6 +35,9 @@ export class PayloadService {
             if (action === 'create' || action === 'update') {
                 return await generateHash(String(value));
             }
+            // Same as conceal
+            if (action === 'read')
+                return '**********';
             return value;
         },
         async uuid({ action, value }) {

package/dist/services/specifications.js

@@ -62,7 +62,8 @@ class OASSpecsService {
             info: {
                 title: 'Dynamic API Specification',
                 description: 'This is a dynamically generated API specification for all endpoints existing on the current project.',
-                version: version,
+                // Only admins see the real version, as on /server/info
+                version: this.accountability?.admin ? version : '0.0.0-hidden',
             },
             servers: [
                 {

package/dist/utils/apply-query.d.ts

@@ -32,4 +32,4 @@ export declare function applyFilter(knex: Knex, schema: SchemaOverview, rootQuer
 };
 export declare function addWhereClauses(knex: Knex, schema: SchemaOverview, dbQuery: Knex.QueryBuilder, filter: Filter, collection: string, aliasMap: AliasMap, logical?: 'and' | 'or'): void;
 export declare function applySearch(schema: SchemaOverview, dbQuery: Knex.QueryBuilder, searchQuery: string, collection: string): Promise<void>;
-export declare function applyAggregate(dbQuery: Knex.QueryBuilder, aggregate: Aggregate, collection: string): void;
+export declare function applyAggregate(schema: SchemaOverview, dbQuery: Knex.QueryBuilder, aggregate: Aggregate, collection: string): void;

package/dist/utils/apply-query.js

@@ -33,7 +33,7 @@ export default function applyQuery(knex, collection, dbQuery, query, schema, opt
         dbQuery.groupBy(query.group.map((column) => getColumn(knex, collection, column, false, schema)));
     }
     if (query.aggregate) {
-        applyAggregate(dbQuery, query.aggregate, collection);
+        applyAggregate(schema, dbQuery, query.aggregate, collection);
     }
     if (query.filter) {
         hasMultiRelationalFilter = applyFilter(knex, schema, dbQuery, query.filter, collection, aliasMap).hasMultiRelationalFilter;
@@ -166,6 +166,9 @@ export function applySort(knex, schema, rootQuery, rootSort, collection, aliasMa
     rootQuery.orderBy(sortRecords);
     return undefined;
 }
+function isConcealedField(schema, collection, field) {
+    return schema.collections[collection]?.fields[stripFunction(field)]?.special.includes('conceal') ?? false;
+}
 export function applyLimit(knex, rootQuery, limit) {
     if (typeof limit === 'number') {
         getHelpers(knex).schema.applyLimit(rootQuery, limit);
@@ -480,6 +483,8 @@ export async function applySearch(schema, dbQuery, searchQuery, collection) {
     const fields = Object.entries(schema.collections[collection].fields);
     dbQuery.andWhere(function () {
         fields.forEach(([name, field]) => {
+            if (field.special.includes('conceal'))
+                return;
             if (['text', 'string'].includes(field.type)) {
                 this.orWhereRaw(`LOWER(??) LIKE ?`, [`${collection}.${name}`, `%${searchQuery.toLowerCase()}%`]);
             }
@@ -494,11 +499,14 @@ export async function applySearch(schema, dbQuery, searchQuery, collection) {
         });
     });
 }
-export function applyAggregate(dbQuery, aggregate, collection) {
+export function applyAggregate(schema, dbQuery, aggregate, collection) {
     for (const [operation, fields] of Object.entries(aggregate)) {
         if (!fields)
             continue;
         for (const field of fields) {
+            if (!operation.startsWith('count') && isConcealedField(schema, collection, field)) {
+                throw new InvalidQueryException(`Field with "conceal" special does not allow the "${operation}" aggregate function`);
+            }
             if (operation === 'avg') {
                 dbQuery.avg(`${collection}.${field}`, { as: `avg->${field}` });
             }

package/dist/utils/package.d.ts

@@ -1,3 +1,3 @@
 declare const name: string, version: string;
-declare const mainVersion: any;
+declare const mainVersion: string;
 export { name, version, mainVersion };

package/dist/utils/package.js

@@ -4,6 +4,18 @@ import { fileURLToPath } from 'node:url';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const apiPkgPath = resolve(__dirname, '../../package.json');
 const { name, version } = JSON.parse(readFileSync(apiPkgPath, 'utf8'));
-const mainPkgPath = resolve(dirname(apiPkgPath), '../../../../../../package.json');
-const mainVersion = existsSync(mainPkgPath) ? JSON.parse(readFileSync(mainPkgPath, 'utf8')).version : null;
+function pkgVersion(path) {
+    try {
+        return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')).version ?? null : null;
+    }
+    catch {
+        return null;
+    }
+}
+// d9 release version (the bundle, matching the Docker image tag): dev-checkout root, then the
+// installed bundle (published/projen image), then the api version as a last resort.
+const mainVersion = pkgVersion(resolve(dirname(apiPkgPath), '../../../../../../package.json')) ??
+    pkgVersion(resolve(process.cwd(), 'node_modules/@wbce-d9/directus9/package.json')) ??
+    pkgVersion(resolve(process.cwd(), 'node_modules/directus9/package.json')) ??
+    version;
 export { name, version, mainVersion };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.6.0",
+  "version": "12.6.1",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -144,20 +144,20 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
-    "@wbce-d9/app": "11.0.1",
-    "@wbce-d9/exceptions": "10.0.1",
-    "@wbce-d9/extensions-sdk": "10.0.5",
-    "@wbce-d9/specs": "9.26.5",
+    "@wbce-d9/app": "11.1.0",
     "@wbce-d9/constants": "10.0.0",
+    "@wbce-d9/exceptions": "10.0.1",
     "@wbce-d9/schema": "10.0.0",
-    "@wbce-d9/storage-driver-azure": "10.0.4",
     "@wbce-d9/storage": "10.0.0",
+    "@wbce-d9/specs": "9.26.5",
+    "@wbce-d9/storage-driver-azure": "10.0.4",
     "@wbce-d9/storage-driver-cloudinary": "10.0.5",
+    "@wbce-d9/extensions-sdk": "10.0.5",
+    "@wbce-d9/storage-driver-local": "10.0.4",
     "@wbce-d9/storage-driver-gcs": "10.0.4",
     "@wbce-d9/storage-driver-s3": "10.0.4",
     "@wbce-d9/update-check": "10.0.4",
-    "@wbce-d9/utils": "10.0.4",
-    "@wbce-d9/storage-driver-local": "10.0.4"
+    "@wbce-d9/utils": "10.0.4"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",