@wbce-d9/api 12.7.1 → 12.7.2

package/dist/services/authorization.js

@@ -36,6 +36,7 @@ export class AuthorizationService {
         validateFields(ast);
         validateFilterPermissions(ast, this.schema, action, this.accountability);
         applyFilters(ast, this.accountability);
+        applySearch(ast, this.schema, this.accountability);
         return ast;
         /**
          * Traverses the AST and returns an array of all collections that are being fetched
@@ -332,6 +333,41 @@ export class AuthorizationService {
                     delete query.filter;
             }
         }
+        /**
+         * Sets the fields matched by the search query to the ones the role is allowed to read, so that the search can't
+         * be used to enumerate the values of the other fields
+         */
+        function applySearch(ast, schema, accountability) {
+            if (ast.type === 'field' || ast.type === 'functionField')
+                return;
+            if (ast.type === 'a2o') {
+                for (const [collection, children] of Object.entries(ast.children)) {
+                    setSearchFields(collection, ast.query[collection]);
+                    for (const child of children)
+                        applySearch(child, schema, accountability);
+                }
+            }
+            else {
+                setSearchFields(ast.name, ast.query);
+                for (const child of ast.children)
+                    applySearch(child, schema, accountability);
+            }
+            function setSearchFields(collection, query) {
+                if (!query.search)
+                    return;
+                // Searching reads the values, so the read permission applies whatever the action the AST is processed for
+                const permission = accountability?.permissions?.find((permission) => permission.collection === collection && permission.action === 'read');
+                let readableFields = [];
+                if (permission?.fields?.includes('*')) {
+                    readableFields = Object.keys(schema.collections[collection].fields);
+                }
+                else if (permission?.fields) {
+                    // Legacy permissions with an empty fields array only give access to the primary key
+                    readableFields = permission.fields.length > 0 ? permission.fields : [schema.collections[collection].primary];
+                }
+                query.search.fields = readableFields;
+            }
+        }
     }
     /**
      * Checks if the provided payload matches the configured permissions, and adds the presets to the payload.

package/dist/services/meta.d.ts

@@ -9,4 +9,8 @@ export declare class MetaService {
     getMetaForQuery(collection: string, query: any): Promise<Record<string, any> | undefined>;
     totalCount(collection: string): Promise<number>;
     filterCount(collection: string, query: Query): Promise<number>;
+    /**
+     * Go through the same authorization as the read of the items, so that the counts match the returned data
+     */
+    private getAuthorizedQuery;
 }

package/dist/services/meta.js

@@ -1,6 +1,7 @@
 import getDatabase from '../database/index.js';
-import { ForbiddenException } from '../exceptions/index.js';
 import { applyFilter, applySearch } from '../utils/apply-query.js';
+import getASTFromQuery from '../utils/get-ast-from-query.js';
+import { AuthorizationService } from './authorization.js';
 export class MetaService {
     knex;
     accountability;
@@ -30,42 +31,42 @@ export class MetaService {
     }
     async totalCount(collection) {
         const dbQuery = this.knex(collection).count('*', { as: 'count' }).first();
-        if (this.accountability?.admin !== true) {
-            const permissionsRecord = this.accountability?.permissions?.find((permission) => {
-                return permission.action === 'read' && permission.collection === collection;
-            });
-            if (!permissionsRecord)
-                throw new ForbiddenException();
-            const permissions = permissionsRecord.permissions ?? {};
-            applyFilter(this.knex, this.schema, dbQuery, permissions, collection, {});
+        // Only the permissions apply to the total count, not the filter and search of the query
+        const { filter } = await this.getAuthorizedQuery(collection, { fields: [] });
+        if (filter && Object.keys(filter).length > 0) {
+            applyFilter(this.knex, this.schema, dbQuery, filter, collection, {});
         }
         const result = await dbQuery;
         return Number(result?.count ?? 0);
     }
     async filterCount(collection, query) {
         const dbQuery = this.knex(collection).count('*', { as: 'count' });
-        let filter = query.filter || {};
-        if (this.accountability?.admin !== true) {
-            const permissionsRecord = this.accountability?.permissions?.find((permission) => {
-                return permission.action === 'read' && permission.collection === collection;
-            });
-            if (!permissionsRecord)
-                throw new ForbiddenException();
-            const permissions = permissionsRecord.permissions ?? {};
-            if (Object.keys(filter).length > 0) {
-                filter = { _and: [permissions, filter] };
-            }
-            else {
-                filter = permissions;
-            }
-        }
-        if (Object.keys(filter).length > 0) {
+        const { filter, search } = await this.getAuthorizedQuery(collection, query);
+        if (filter && Object.keys(filter).length > 0) {
             applyFilter(this.knex, this.schema, dbQuery, filter, collection, {});
         }
-        if (query.search) {
-            applySearch(this.schema, dbQuery, query.search, collection);
+        if (search) {
+            applySearch(this.schema, dbQuery, search, collection);
         }
         const records = await dbQuery;
         return Number(records[0].count);
     }
+    /**
+     * Go through the same authorization as the read of the items, so that the counts match the returned data
+     */
+    async getAuthorizedQuery(collection, query) {
+        let ast = await getASTFromQuery(collection, query, this.schema, {
+            accountability: this.accountability,
+            knex: this.knex,
+        });
+        if (this.accountability?.admin !== true) {
+            const authorizationService = new AuthorizationService({
+                accountability: this.accountability,
+                knex: this.knex,
+                schema: this.schema,
+            });
+            ast = await authorizationService.processAST(ast);
+        }
+        return ast.query;
+    }
 }

package/dist/types/ast.d.ts

@@ -1,9 +1,20 @@
 import type { Query, Relation } from '@wbce-d9/types';
+/**
+ * Search query, along with the fields it is allowed to match. For non-admin users, the fields are empty until the
+ * AuthorizationService sets the readable ones
+ */
+export type ASTSearch = {
+    fields: string[];
+    value: string;
+};
+export type ASTQuery = Omit<Query, 'search'> & {
+    search?: ASTSearch | null;
+};
 export type M2ONode = {
     type: 'm2o';
     name: string;
     children: (NestedCollectionNode | FieldNode | FunctionFieldNode)[];
-    query: Query;
+    query: ASTQuery;
     fieldKey: string;
     relation: Relation;
     parentKey: string;
@@ -16,7 +27,7 @@ export type A2MNode = {
         [collection: string]: (NestedCollectionNode | FieldNode | FunctionFieldNode)[];
     };
     query: {
-        [collection: string]: Query;
+        [collection: string]: ASTQuery;
     };
     relatedKey: {
         [collection: string]: string;
@@ -29,7 +40,7 @@ export type O2MNode = {
     type: 'o2m';
     name: string;
     children: (NestedCollectionNode | FieldNode | FunctionFieldNode)[];
-    query: Query;
+    query: ASTQuery;
     fieldKey: string;
     relation: Relation;
     parentKey: string;
@@ -52,5 +63,5 @@ export type AST = {
     type: 'root';
     name: string;
     children: (NestedCollectionNode | FieldNode | FunctionFieldNode)[];
-    query: Query;
+    query: ASTQuery;
 };

package/dist/utils/apply-query.d.ts

@@ -1,11 +1,12 @@
-import type { Aggregate, Filter, Query, SchemaOverview } from '@wbce-d9/types';
+import type { Aggregate, Filter, SchemaOverview } from '@wbce-d9/types';
 import type { Knex } from 'knex';
+import type { ASTQuery, ASTSearch } from '../types/index.js';
 import type { AliasMap } from './get-column-path.js';
 export declare const generateAlias: (size?: number | undefined) => string;
 /**
  * Apply the Query to a given Knex query builder instance
  */
-export default function applyQuery(knex: Knex, collection: string, dbQuery: Knex.QueryBuilder, query: Query, schema: SchemaOverview, options?: {
+export default function applyQuery(knex: Knex, collection: string, dbQuery: Knex.QueryBuilder, query: ASTQuery, schema: SchemaOverview, options?: {
     aliasMap?: AliasMap;
     isInnerQuery?: boolean;
     hasMultiRelationalSort?: boolean | undefined;
@@ -31,5 +32,5 @@ export declare function applyFilter(knex: Knex, schema: SchemaOverview, rootQuer
     hasMultiRelationalFilter: boolean;
 };
 export declare function addWhereClauses(knex: Knex, schema: SchemaOverview, dbQuery: Knex.QueryBuilder, filter: Filter, collection: string, aliasMap: AliasMap, logical?: 'and' | 'or'): void;
-export declare function applySearch(schema: SchemaOverview, dbQuery: Knex.QueryBuilder, searchQuery: string, collection: string): Promise<void>;
+export declare function applySearch(schema: SchemaOverview, dbQuery: Knex.QueryBuilder, search: ASTSearch, collection: string): Promise<void>;
 export declare function applyAggregate(schema: SchemaOverview, dbQuery: Knex.QueryBuilder, aggregate: Aggregate, collection: string): void;

package/dist/utils/apply-query.js

@@ -479,24 +479,33 @@ export function addWhereClauses(knex, schema, dbQuery, filter, collection, alias
         }
     }
 }
-export async function applySearch(schema, dbQuery, searchQuery, collection) {
-    const fields = Object.entries(schema.collections[collection].fields);
+export async function applySearch(schema, dbQuery, search, collection) {
+    const { fields, value: searchQuery } = search;
     dbQuery.andWhere(function () {
-        fields.forEach(([name, field]) => {
-            if (field.special.includes('conceal'))
+        let hasCondition = false;
+        fields.forEach((name) => {
+            const field = schema.collections[collection].fields[name];
+            if (!field || field.special.includes('conceal'))
                 return;
             if (['text', 'string'].includes(field.type)) {
                 this.orWhereRaw(`LOWER(??) LIKE ?`, [`${collection}.${name}`, `%${searchQuery.toLowerCase()}%`]);
+                hasCondition = true;
             }
             else if (['bigInteger', 'integer', 'decimal', 'float'].includes(field.type)) {
                 const number = Number(searchQuery);
-                if (!isNaN(number))
+                if (!isNaN(number)) {
                     this.orWhere({ [`${collection}.${name}`]: number });
+                    hasCondition = true;
+                }
             }
             else if (field.type === 'uuid' && validate(searchQuery)) {
                 this.orWhere({ [`${collection}.${name}`]: searchQuery });
+                hasCondition = true;
             }
         });
+        // No field can match the search, so no item should be returned
+        if (!hasCondition)
+            this.whereRaw('1 = 0');
     });
 }
 export function applyAggregate(schema, dbQuery, aggregate, collection) {

package/dist/utils/get-ast-from-query.js

@@ -13,12 +13,6 @@ export default async function getASTFromQuery(collection, query, schema, options
             return permission.action === action;
         }) ?? []
         : null;
-    const ast = {
-        type: 'root',
-        name: collection,
-        query: query,
-        children: [],
-    };
     let fields = ['*'];
     if (query.fields) {
         fields = query.fields;
@@ -60,7 +54,13 @@ export default async function getASTFromQuery(collection, query, schema, options
     if (query.aggregate && Object.keys(query.aggregate).length && !query.group?.[0]) {
         delete query.sort;
     }
-    ast.children = await parseFields(collection, fields, deep);
+    const children = await parseFields(collection, fields, deep);
+    const ast = {
+        type: 'root',
+        name: collection,
+        query: formatSearch(collection, query),
+        children,
+    };
     return ast;
     async function parseFields(parentCollection, fields, deep) {
         if (!fields)
@@ -170,7 +170,7 @@ export default async function getASTFromQuery(collection, query, schema, options
                 };
                 for (const relatedCollection of allowedCollections) {
                     child.children[relatedCollection] = await parseFields(relatedCollection, Array.isArray(nestedFields) ? nestedFields : nestedFields[relatedCollection] || [], deep?.[`${fieldKey}:${relatedCollection}`]);
-                    child.query[relatedCollection] = getDeepQuery(deep?.[`${fieldKey}:${relatedCollection}`] || {});
+                    child.query[relatedCollection] = formatSearch(relatedCollection, getDeepQuery(deep?.[`${fieldKey}:${relatedCollection}`] || {}));
                     child.relatedKey[relatedCollection] = schema.collections[relatedCollection].primary;
                 }
             }
@@ -189,7 +189,7 @@ export default async function getASTFromQuery(collection, query, schema, options
                     parentKey: schema.collections[parentCollection].primary,
                     relatedKey: schema.collections[relatedCollection].primary,
                     relation: relation,
-                    query: getDeepQuery(deep?.[fieldKey] || {}),
+                    query: formatSearch(relatedCollection, getDeepQuery(deep?.[fieldKey] || {})),
                     children: await parseFields(relatedCollection, nestedFields, deep?.[fieldKey] || {}),
                 };
                 if (relationType === 'o2m' && !child.query.sort) {
@@ -272,6 +272,17 @@ export default async function getASTFromQuery(collection, query, schema, options
         }
         return fields;
     }
+    /**
+     * For admins and internal calls, the search of the AST matches all the fields of the collection. For other users, it
+     * matches no field until the AuthorizationService sets the ones the role is allowed to read
+     */
+    function formatSearch(collection, query) {
+        const { search, ...rest } = query;
+        if (!search)
+            return rest;
+        const fields = !accountability || accountability.admin === true ? Object.keys(schema.collections[collection].fields) : [];
+        return { ...rest, search: { fields, value: search } };
+    }
     function getRelation(collection, field) {
         const relation = schema.relations.find((relation) => {
             return ((relation.collection === collection && relation.field === field) ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.7.1",
+  "version": "12.7.2",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -144,20 +144,20 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
-    "@wbce-d9/app": "11.3.0",
     "@wbce-d9/constants": "10.0.0",
-    "@wbce-d9/extensions-sdk": "10.1.0",
     "@wbce-d9/exceptions": "10.0.1",
-    "@wbce-d9/schema": "10.0.0",
+    "@wbce-d9/app": "11.3.0",
+    "@wbce-d9/extensions-sdk": "10.1.0",
     "@wbce-d9/storage": "10.0.0",
-    "@wbce-d9/specs": "9.26.5",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.6",
     "@wbce-d9/storage-driver-azure": "10.0.5",
+    "@wbce-d9/specs": "9.26.5",
+    "@wbce-d9/storage-driver-gcs": "10.0.5",
+    "@wbce-d9/schema": "10.0.0",
     "@wbce-d9/storage-driver-local": "10.0.5",
-    "@wbce-d9/utils": "10.0.5",
     "@wbce-d9/storage-driver-s3": "10.0.5",
+    "@wbce-d9/storage-driver-cloudinary": "10.0.6",
     "@wbce-d9/update-check": "10.0.4",
-    "@wbce-d9/storage-driver-gcs": "10.0.5"
+    "@wbce-d9/utils": "10.0.5"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",