@wbce-d9/api 12.7.1 → 12.7.3

package/dist/controllers/assets.js

@@ -133,7 +133,11 @@ asyncHandler(async (req, res) => {
             }
         }
     }
-    const { stream, file, stat } = await service.getAsset(id, transformation, range);
+    const isHead = req.method.toLowerCase() === 'head';
+    const asset = isHead
+        ? await service.getAssetInfo(id, transformation, range)
+        : await service.getAsset(id, transformation, range);
+    const { stream, file, stat } = asset;
     const filename = req.params['filename'] ?? file.filename_download;
     res.attachment(filename);
     res.setHeader('Content-Type', file.type);
@@ -170,10 +174,7 @@ asyncHandler(async (req, res) => {
     if ('download' in req.query === false) {
         res.setHeader('Content-Disposition', contentDisposition(filename, { type: 'inline' }));
     }
-    if (req.method.toLowerCase() === 'head') {
-        res.status(200);
-        res.setHeader('Accept-Ranges', 'bytes');
-        res.setHeader('Content-Length', stat.size);
+    if (!stream) {
         return res.end();
     }
     let isDataSent = false;

package/dist/flows.d.ts

@@ -23,8 +23,9 @@ declare class FlowManager {
     private unload;
     private executeFlow;
     /**
-     * Return a copy of the event data whose payload has its concealed fields masked, as they would be on read.
-     * The data is returned as is when there is nothing to conceal.
+     * Return a copy of the trigger data with its secrets masked: the concealed fields of an event payload, as they
+     * would be on read, and the credentials (authorization header, cookies, access_token query parameter) of a
+     * webhook or manual request. The data is returned as is when there is nothing to conceal.
      */
     private concealEventPayload;
     /**

package/dist/flows.js

@@ -27,6 +27,11 @@ const redactLogs = fastRedact({
     paths: ['*.headers.authorization', '*.access_token', '*.headers.cookie'],
     serialize: false,
 });
+const redactRequestCredentials = fastRedact({
+    censor: '--redacted--',
+    paths: ['headers.authorization', 'headers.cookie', 'query.access_token'],
+    serialize: false,
+});
 export function getFlowManager() {
     if (flowManager) {
         return flowManager;
@@ -337,10 +342,13 @@ class FlowManager {
         return undefined;
     }
     /**
-     * Return a copy of the event data whose payload has its concealed fields masked, as they would be on read.
-     * The data is returned as is when there is nothing to conceal.
+     * Return a copy of the trigger data with its secrets masked: the concealed fields of an event payload, as they
+     * would be on read, and the credentials (authorization header, cookies, access_token query parameter) of a
+     * webhook or manual request. The data is returned as is when there is nothing to conceal.
      */
     async concealEventPayload(flow, data, knex, schema) {
+        if (flow.trigger === 'webhook' || flow.trigger === 'manual')
+            return redactRequestCredentials(cloneDeep(data));
         if (flow.trigger !== 'event')
             return data;
         const { collection, payload } = data;

package/dist/middleware/graphql.js

@@ -2,6 +2,8 @@ import { parseJSON } from '@wbce-d9/utils';
 import { getOperationAST, parse, Source } from 'graphql';
 import { InvalidPayloadException, InvalidQueryException, MethodNotAllowedException } from '../exceptions/index.js';
 import asyncHandler from '../utils/async-handler.js';
+import { getGraphQLQueryCost } from '../utils/get-graphql-query-cost.js';
+import { consumeRateLimit } from './rate-limiter-ip.js';
 export const parseGraphQL = asyncHandler(async (req, res, next) => {
     if (req.method !== 'GET' && req.method !== 'POST') {
         throw new MethodNotAllowedException('GraphQL only supports GET and POST requests.', { allow: ['GET', 'POST'] });
@@ -52,6 +54,12 @@ export const parseGraphQL = asyncHandler(async (req, res, next) => {
     if (operationAST?.operation === 'mutation') {
         res.locals['cache'] = false;
     }
+    // A GraphQL request costs one rate limit point per root field. The request itself already consumed one point,
+    // so only the remaining cost is consumed here. Does nothing when the rate limiter is disabled.
+    const cost = getGraphQLQueryCost(document, operationAST);
+    if (cost > 1) {
+        await consumeRateLimit(req, res, cost - 1);
+    }
     res.locals['graphqlParams'] = {
         document,
         query,

package/dist/middleware/graphql.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/middleware/rate-limiter-ip.d.ts

@@ -1,5 +1,13 @@
-import type { RequestHandler } from 'express';
-import type { RateLimiterMemcache, RateLimiterMemory, RateLimiterRedis } from 'rate-limiter-flexible';
+import type { Request, RequestHandler, Response } from 'express';
+import type { RateLimiterAbstract, RateLimiterMemcache, RateLimiterMemory, RateLimiterRedis } from 'rate-limiter-flexible';
 declare let checkRateLimit: RequestHandler;
 export declare let rateLimiter: RateLimiterRedis | RateLimiterMemcache | RateLimiterMemory;
+/**
+ * Consume rate limit points for the client IP of the request. A request can consume more than one
+ * point when its cost is higher than a regular request, so expensive operations (like a GraphQL
+ * document selecting many root fields) are accounted for in the same budget.
+ * Does nothing when the rate limiter is disabled.
+ */
+export declare function createRateLimitConsumer(limiter: RateLimiterAbstract | undefined): (req: Request, res: Response, points?: number) => Promise<void>;
+export declare const consumeRateLimit: (req: Request, res: Response, points?: number) => Promise<void>;
 export default checkRateLimit;

package/dist/middleware/rate-limiter-ip.js

@@ -11,8 +11,22 @@ if (env['RATE_LIMITER_ENABLED'] === true) {
     validateEnv(['RATE_LIMITER_STORE', 'RATE_LIMITER_DURATION', 'RATE_LIMITER_POINTS']);
     rateLimiter = createRateLimiter('RATE_LIMITER');
     checkRateLimit = asyncHandler(async (req, res, next) => {
+        await consumeRateLimit(req, res, 1);
+        next();
+    });
+}
+/**
+ * Consume rate limit points for the client IP of the request. A request can consume more than one
+ * point when its cost is higher than a regular request, so expensive operations (like a GraphQL
+ * document selecting many root fields) are accounted for in the same budget.
+ * Does nothing when the rate limiter is disabled.
+ */
+export function createRateLimitConsumer(limiter) {
+    return async function consumeRateLimit(req, res, points = 1) {
+        if (!limiter)
+            return;
         try {
-            await rateLimiter.consume(getIPFromReq(req), 1);
+            await limiter.consume(getIPFromReq(req), points);
         }
         catch (rateLimiterRes) {
             if (rateLimiterRes instanceof Error)
@@ -23,7 +37,7 @@ if (env['RATE_LIMITER_ENABLED'] === true) {
                 reset: new Date(Date.now() + rateLimiterRes.msBeforeNext),
             });
         }
-        next();
-    });
+    };
 }
+export const consumeRateLimit = createRateLimitConsumer(rateLimiter);
 export default checkRateLimit;

package/dist/middleware/rate-limiter-ip.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/assets.d.ts

@@ -15,4 +15,10 @@ export declare class AssetsService {
         file: any;
         stat: Stat;
     }>;
+    getAssetInfo(id: string, transformation: TransformationParams, range?: Range): Promise<{
+        file: any;
+        stat: Stat;
+        stream?: never;
+    }>;
+    private resolveAsset;
 }

package/dist/services/assets.js

@@ -27,6 +27,19 @@ export class AssetsService {
     }
     async getAsset(id, transformation, range) {
         const storage = await getStorage();
+        const { file, filename, stat } = await this.resolveAsset(storage, id, transformation, range);
+        return {
+            stream: await storage.location(file.storage).read(filename, range),
+            file,
+            stat,
+        };
+    }
+    async getAssetInfo(id, transformation, range) {
+        const storage = await getStorage();
+        const { file, stat } = await this.resolveAsset(storage, id, transformation, range);
+        return { file, stat };
+    }
+    async resolveAsset(storage, id, transformation, range) {
         const publicSettings = await this.knex
             .select('project_logo', 'public_background', 'public_foreground')
             .from('directus_settings')
@@ -93,7 +106,7 @@ export class AssetsService {
             }
             if (exists) {
                 return {
-                    stream: await storage.location(file.storage).read(assetFilename, range),
+                    filename: assetFilename,
                     file,
                     stat: await storage.location(file.storage).stat(assetFilename),
                 };
@@ -114,7 +127,6 @@ export class AssetsService {
                     service: 'files',
                 });
             }
-            const readStream = await storage.location(file.storage).read(file.filename_disk, range);
             const transformer = sharp({
                 limitInputPixels: Math.pow(env['ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION'], 2),
                 sequentialRead: true,
@@ -126,21 +138,28 @@ export class AssetsService {
             if (transforms.find((transform) => transform[0] === 'rotate') === undefined)
                 transformer.rotate();
             transforms.forEach(([method, ...args]) => transformer[method].apply(transformer, args));
+            // Sharp validates synchronously: only open the stream once the request is known to be valid
+            const readStream = await storage.location(file.storage).read(file.filename_disk, range);
             readStream.on('error', (e) => {
                 logger.error(e, `Couldn't transform file ${file.id}`);
                 readStream.unpipe(transformer);
             });
-            await storage.location(file.storage).write(assetFilename, readStream.pipe(transformer), type);
+            try {
+                await storage.location(file.storage).write(assetFilename, readStream.pipe(transformer), type);
+            }
+            catch (error) {
+                readStream.destroy();
+                throw error;
+            }
             return {
-                stream: await storage.location(file.storage).read(assetFilename, range),
+                filename: assetFilename,
                 stat: await storage.location(file.storage).stat(assetFilename),
                 file,
             };
         }
         else {
-            const readStream = await storage.location(file.storage).read(file.filename_disk, range);
             const stat = await storage.location(file.storage).stat(file.filename_disk);
-            return { stream: readStream, file, stat };
+            return { filename: file.filename_disk, file, stat };
         }
     }
 }

package/dist/services/assets.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/authorization.js

@@ -36,6 +36,7 @@ export class AuthorizationService {
         validateFields(ast);
         validateFilterPermissions(ast, this.schema, action, this.accountability);
         applyFilters(ast, this.accountability);
+        applySearch(ast, this.schema, this.accountability);
         return ast;
         /**
          * Traverses the AST and returns an array of all collections that are being fetched
@@ -332,6 +333,41 @@ export class AuthorizationService {
                     delete query.filter;
             }
         }
+        /**
+         * Sets the fields matched by the search query to the ones the role is allowed to read, so that the search can't
+         * be used to enumerate the values of the other fields
+         */
+        function applySearch(ast, schema, accountability) {
+            if (ast.type === 'field' || ast.type === 'functionField')
+                return;
+            if (ast.type === 'a2o') {
+                for (const [collection, children] of Object.entries(ast.children)) {
+                    setSearchFields(collection, ast.query[collection]);
+                    for (const child of children)
+                        applySearch(child, schema, accountability);
+                }
+            }
+            else {
+                setSearchFields(ast.name, ast.query);
+                for (const child of ast.children)
+                    applySearch(child, schema, accountability);
+            }
+            function setSearchFields(collection, query) {
+                if (!query.search)
+                    return;
+                // Searching reads the values, so the read permission applies whatever the action the AST is processed for
+                const permission = accountability?.permissions?.find((permission) => permission.collection === collection && permission.action === 'read');
+                let readableFields = [];
+                if (permission?.fields?.includes('*')) {
+                    readableFields = Object.keys(schema.collections[collection].fields);
+                }
+                else if (permission?.fields) {
+                    // Legacy permissions with an empty fields array only give access to the primary key
+                    readableFields = permission.fields.length > 0 ? permission.fields : [schema.collections[collection].primary];
+                }
+                query.search.fields = readableFields;
+            }
+        }
     }
     /**
      * Checks if the provided payload matches the configured permissions, and adds the presets to the payload.

package/dist/services/graphql/index.js

@@ -45,6 +45,7 @@ import { GraphQLHash } from './types/hash.js';
 import { GraphQLStringOrFloat } from './types/string-or-float.js';
 import { GraphQLVoid } from './types/void.js';
 import { addPathToValidationError } from './utils/add-path-to-validation-error.js';
+import { dedupeQueryResolvers } from './utils/dedupe-query-resolvers.js';
 import processError from './utils/process-error.js';
 const validationRules = Array.from(specifiedRules);
 if (env['GRAPHQL_INTROSPECTION'] === false) {
@@ -212,7 +213,9 @@ export class GraphQLService {
         if (type === 'sdl') {
             return schemaComposer.toSDL();
         }
-        return schemaComposer.buildSchema();
+        const builtSchema = schemaComposer.buildSchema();
+        dedupeQueryResolvers(builtSchema);
+        return builtSchema;
         /**
          * Construct an object of types for every collection, using the permitted fields per action type
          * as it's fields.

package/dist/services/graphql/utils/dedupe-query-resolvers.d.ts

@@ -0,0 +1,9 @@
+import type { GraphQLSchema } from 'graphql';
+/**
+ * Make root query fields that are repeated under several aliases with the same arguments resolve
+ * only once per execution, so a single request can't multiply expensive resolvers (eg. server_health).
+ * Only fields returning a leaf type are concerned: as they have no selection, their result only
+ * depends on their arguments.
+ * Results are cached on the schema, which must therefore be built for a single execution.
+ */
+export declare function dedupeQueryResolvers(schema: GraphQLSchema): void;

package/dist/services/graphql/utils/dedupe-query-resolvers.js

@@ -0,0 +1,24 @@
+import { getNamedType, isLeafType } from 'graphql';
+import hash from 'object-hash';
+/**
+ * Make root query fields that are repeated under several aliases with the same arguments resolve
+ * only once per execution, so a single request can't multiply expensive resolvers (eg. server_health).
+ * Only fields returning a leaf type are concerned: as they have no selection, their result only
+ * depends on their arguments.
+ * Results are cached on the schema, which must therefore be built for a single execution.
+ */
+export function dedupeQueryResolvers(schema) {
+    const fields = schema.getQueryType()?.getFields() ?? {};
+    const results = new Map();
+    for (const field of Object.values(fields)) {
+        const resolve = field.resolve;
+        if (!resolve || !isLeafType(getNamedType(field.type)))
+            continue;
+        field.resolve = (source, args, context, info) => {
+            const key = hash({ field: info.fieldName, args });
+            if (!results.has(key))
+                results.set(key, resolve(source, args, context, info));
+            return results.get(key);
+        };
+    }
+}

package/dist/services/graphql/utils/dedupe-query-resolvers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/meta.d.ts

@@ -9,4 +9,8 @@ export declare class MetaService {
     getMetaForQuery(collection: string, query: any): Promise<Record<string, any> | undefined>;
     totalCount(collection: string): Promise<number>;
     filterCount(collection: string, query: Query): Promise<number>;
+    /**
+     * Go through the same authorization as the read of the items, so that the counts match the returned data
+     */
+    private getAuthorizedQuery;
 }

package/dist/services/meta.js

@@ -1,6 +1,7 @@
 import getDatabase from '../database/index.js';
-import { ForbiddenException } from '../exceptions/index.js';
 import { applyFilter, applySearch } from '../utils/apply-query.js';
+import getASTFromQuery from '../utils/get-ast-from-query.js';
+import { AuthorizationService } from './authorization.js';
 export class MetaService {
     knex;
     accountability;
@@ -30,42 +31,42 @@ export class MetaService {
     }
     async totalCount(collection) {
         const dbQuery = this.knex(collection).count('*', { as: 'count' }).first();
-        if (this.accountability?.admin !== true) {
-            const permissionsRecord = this.accountability?.permissions?.find((permission) => {
-                return permission.action === 'read' && permission.collection === collection;
-            });
-            if (!permissionsRecord)
-                throw new ForbiddenException();
-            const permissions = permissionsRecord.permissions ?? {};
-            applyFilter(this.knex, this.schema, dbQuery, permissions, collection, {});
+        // Only the permissions apply to the total count, not the filter and search of the query
+        const { filter } = await this.getAuthorizedQuery(collection, { fields: [] });
+        if (filter && Object.keys(filter).length > 0) {
+            applyFilter(this.knex, this.schema, dbQuery, filter, collection, {});
         }
         const result = await dbQuery;
         return Number(result?.count ?? 0);
     }
     async filterCount(collection, query) {
         const dbQuery = this.knex(collection).count('*', { as: 'count' });
-        let filter = query.filter || {};
-        if (this.accountability?.admin !== true) {
-            const permissionsRecord = this.accountability?.permissions?.find((permission) => {
-                return permission.action === 'read' && permission.collection === collection;
-            });
-            if (!permissionsRecord)
-                throw new ForbiddenException();
-            const permissions = permissionsRecord.permissions ?? {};
-            if (Object.keys(filter).length > 0) {
-                filter = { _and: [permissions, filter] };
-            }
-            else {
-                filter = permissions;
-            }
-        }
-        if (Object.keys(filter).length > 0) {
+        const { filter, search } = await this.getAuthorizedQuery(collection, query);
+        if (filter && Object.keys(filter).length > 0) {
             applyFilter(this.knex, this.schema, dbQuery, filter, collection, {});
         }
-        if (query.search) {
-            applySearch(this.schema, dbQuery, query.search, collection);
+        if (search) {
+            applySearch(this.schema, dbQuery, search, collection);
         }
         const records = await dbQuery;
         return Number(records[0].count);
     }
+    /**
+     * Go through the same authorization as the read of the items, so that the counts match the returned data
+     */
+    async getAuthorizedQuery(collection, query) {
+        let ast = await getASTFromQuery(collection, query, this.schema, {
+            accountability: this.accountability,
+            knex: this.knex,
+        });
+        if (this.accountability?.admin !== true) {
+            const authorizationService = new AuthorizationService({
+                accountability: this.accountability,
+                knex: this.knex,
+                schema: this.schema,
+            });
+            ast = await authorizationService.processAST(ast);
+        }
+        return ast.query;
+    }
 }

package/dist/types/ast.d.ts

@@ -1,9 +1,20 @@
 import type { Query, Relation } from '@wbce-d9/types';
+/**
+ * Search query, along with the fields it is allowed to match. For non-admin users, the fields are empty until the
+ * AuthorizationService sets the readable ones
+ */
+export type ASTSearch = {
+    fields: string[];
+    value: string;
+};
+export type ASTQuery = Omit<Query, 'search'> & {
+    search?: ASTSearch | null;
+};
 export type M2ONode = {
     type: 'm2o';
     name: string;
     children: (NestedCollectionNode | FieldNode | FunctionFieldNode)[];
-    query: Query;
+    query: ASTQuery;
     fieldKey: string;
     relation: Relation;
     parentKey: string;
@@ -16,7 +27,7 @@ export type A2MNode = {
         [collection: string]: (NestedCollectionNode | FieldNode | FunctionFieldNode)[];
     };
     query: {
-        [collection: string]: Query;
+        [collection: string]: ASTQuery;
     };
     relatedKey: {
         [collection: string]: string;
@@ -29,7 +40,7 @@ export type O2MNode = {
     type: 'o2m';
     name: string;
     children: (NestedCollectionNode | FieldNode | FunctionFieldNode)[];
-    query: Query;
+    query: ASTQuery;
     fieldKey: string;
     relation: Relation;
     parentKey: string;
@@ -52,5 +63,5 @@ export type AST = {
     type: 'root';
     name: string;
     children: (NestedCollectionNode | FieldNode | FunctionFieldNode)[];
-    query: Query;
+    query: ASTQuery;
 };

package/dist/utils/apply-query.d.ts

@@ -1,11 +1,12 @@
-import type { Aggregate, Filter, Query, SchemaOverview } from '@wbce-d9/types';
+import type { Aggregate, Filter, SchemaOverview } from '@wbce-d9/types';
 import type { Knex } from 'knex';
+import type { ASTQuery, ASTSearch } from '../types/index.js';
 import type { AliasMap } from './get-column-path.js';
 export declare const generateAlias: (size?: number | undefined) => string;
 /**
  * Apply the Query to a given Knex query builder instance
  */
-export default function applyQuery(knex: Knex, collection: string, dbQuery: Knex.QueryBuilder, query: Query, schema: SchemaOverview, options?: {
+export default function applyQuery(knex: Knex, collection: string, dbQuery: Knex.QueryBuilder, query: ASTQuery, schema: SchemaOverview, options?: {
     aliasMap?: AliasMap;
     isInnerQuery?: boolean;
     hasMultiRelationalSort?: boolean | undefined;
@@ -31,5 +32,5 @@ export declare function applyFilter(knex: Knex, schema: SchemaOverview, rootQuer
     hasMultiRelationalFilter: boolean;
 };
 export declare function addWhereClauses(knex: Knex, schema: SchemaOverview, dbQuery: Knex.QueryBuilder, filter: Filter, collection: string, aliasMap: AliasMap, logical?: 'and' | 'or'): void;
-export declare function applySearch(schema: SchemaOverview, dbQuery: Knex.QueryBuilder, searchQuery: string, collection: string): Promise<void>;
+export declare function applySearch(schema: SchemaOverview, dbQuery: Knex.QueryBuilder, search: ASTSearch, collection: string): Promise<void>;
 export declare function applyAggregate(schema: SchemaOverview, dbQuery: Knex.QueryBuilder, aggregate: Aggregate, collection: string): void;

package/dist/utils/apply-query.js

@@ -479,24 +479,33 @@ export function addWhereClauses(knex, schema, dbQuery, filter, collection, alias
         }
     }
 }
-export async function applySearch(schema, dbQuery, searchQuery, collection) {
-    const fields = Object.entries(schema.collections[collection].fields);
+export async function applySearch(schema, dbQuery, search, collection) {
+    const { fields, value: searchQuery } = search;
     dbQuery.andWhere(function () {
-        fields.forEach(([name, field]) => {
-            if (field.special.includes('conceal'))
+        let hasCondition = false;
+        fields.forEach((name) => {
+            const field = schema.collections[collection].fields[name];
+            if (!field || field.special.includes('conceal'))
                 return;
             if (['text', 'string'].includes(field.type)) {
                 this.orWhereRaw(`LOWER(??) LIKE ?`, [`${collection}.${name}`, `%${searchQuery.toLowerCase()}%`]);
+                hasCondition = true;
             }
             else if (['bigInteger', 'integer', 'decimal', 'float'].includes(field.type)) {
                 const number = Number(searchQuery);
-                if (!isNaN(number))
+                if (!isNaN(number)) {
                     this.orWhere({ [`${collection}.${name}`]: number });
+                    hasCondition = true;
+                }
             }
             else if (field.type === 'uuid' && validate(searchQuery)) {
                 this.orWhere({ [`${collection}.${name}`]: searchQuery });
+                hasCondition = true;
             }
         });
+        // No field can match the search, so no item should be returned
+        if (!hasCondition)
+            this.whereRaw('1 = 0');
     });
 }
 export function applyAggregate(schema, dbQuery, aggregate, collection) {

package/dist/utils/get-ast-from-query.js

@@ -13,12 +13,6 @@ export default async function getASTFromQuery(collection, query, schema, options
             return permission.action === action;
         }) ?? []
         : null;
-    const ast = {
-        type: 'root',
-        name: collection,
-        query: query,
-        children: [],
-    };
     let fields = ['*'];
     if (query.fields) {
         fields = query.fields;
@@ -60,7 +54,13 @@ export default async function getASTFromQuery(collection, query, schema, options
     if (query.aggregate && Object.keys(query.aggregate).length && !query.group?.[0]) {
         delete query.sort;
     }
-    ast.children = await parseFields(collection, fields, deep);
+    const children = await parseFields(collection, fields, deep);
+    const ast = {
+        type: 'root',
+        name: collection,
+        query: formatSearch(collection, query),
+        children,
+    };
     return ast;
     async function parseFields(parentCollection, fields, deep) {
         if (!fields)
@@ -170,7 +170,7 @@ export default async function getASTFromQuery(collection, query, schema, options
                 };
                 for (const relatedCollection of allowedCollections) {
                     child.children[relatedCollection] = await parseFields(relatedCollection, Array.isArray(nestedFields) ? nestedFields : nestedFields[relatedCollection] || [], deep?.[`${fieldKey}:${relatedCollection}`]);
-                    child.query[relatedCollection] = getDeepQuery(deep?.[`${fieldKey}:${relatedCollection}`] || {});
+                    child.query[relatedCollection] = formatSearch(relatedCollection, getDeepQuery(deep?.[`${fieldKey}:${relatedCollection}`] || {}));
                     child.relatedKey[relatedCollection] = schema.collections[relatedCollection].primary;
                 }
             }
@@ -189,7 +189,7 @@ export default async function getASTFromQuery(collection, query, schema, options
                     parentKey: schema.collections[parentCollection].primary,
                     relatedKey: schema.collections[relatedCollection].primary,
                     relation: relation,
-                    query: getDeepQuery(deep?.[fieldKey] || {}),
+                    query: formatSearch(relatedCollection, getDeepQuery(deep?.[fieldKey] || {})),
                     children: await parseFields(relatedCollection, nestedFields, deep?.[fieldKey] || {}),
                 };
                 if (relationType === 'o2m' && !child.query.sort) {
@@ -272,6 +272,17 @@ export default async function getASTFromQuery(collection, query, schema, options
         }
         return fields;
     }
+    /**
+     * For admins and internal calls, the search of the AST matches all the fields of the collection. For other users, it
+     * matches no field until the AuthorizationService sets the ones the role is allowed to read
+     */
+    function formatSearch(collection, query) {
+        const { search, ...rest } = query;
+        if (!search)
+            return rest;
+        const fields = !accountability || accountability.admin === true ? Object.keys(schema.collections[collection].fields) : [];
+        return { ...rest, search: { fields, value: search } };
+    }
     function getRelation(collection, field) {
         const relation = schema.relations.find((relation) => {
             return ((relation.collection === collection && relation.field === field) ||

package/dist/utils/get-graphql-query-cost.d.ts

@@ -0,0 +1,12 @@
+import type { DocumentNode, OperationDefinitionNode } from 'graphql';
+/**
+ * Cost of a GraphQL document in rate limit points: one point per root field of the executed
+ * operation. Every root field is resolved on its own, so it is one unit of work (a collection read,
+ * a mutation, ...) whatever its arguments: repeating fields under aliases with different arguments
+ * consumes points instead of being free. Nested fields are not counted, as they are resolved from
+ * the root field.
+ * The operation is resolved by the caller (getOperationAST); when there is none (invalid document or
+ * missing operation name), the cost is 0: validation rejects those, and the request still costs its
+ * base point.
+ */
+export declare function getGraphQLQueryCost(document: DocumentNode, operation: OperationDefinitionNode | null | undefined): number;

package/dist/utils/get-graphql-query-cost.js

@@ -0,0 +1,45 @@
+import { Kind } from 'graphql';
+/**
+ * Cost of a GraphQL document in rate limit points: one point per root field of the executed
+ * operation. Every root field is resolved on its own, so it is one unit of work (a collection read,
+ * a mutation, ...) whatever its arguments: repeating fields under aliases with different arguments
+ * consumes points instead of being free. Nested fields are not counted, as they are resolved from
+ * the root field.
+ * The operation is resolved by the caller (getOperationAST); when there is none (invalid document or
+ * missing operation name), the cost is 0: validation rejects those, and the request still costs its
+ * base point.
+ */
+export function getGraphQLQueryCost(document, operation) {
+    if (!operation)
+        return 0;
+    const fragments = new Map();
+    for (const definition of document.definitions) {
+        if (definition.kind === Kind.FRAGMENT_DEFINITION)
+            fragments.set(definition.name.value, definition);
+    }
+    return countRootFields(operation.selectionSet, fragments, new Set());
+}
+function countRootFields(selectionSet, fragments, visited) {
+    let fields = 0;
+    for (const selection of selectionSet.selections) {
+        if (selection.kind === Kind.FIELD) {
+            // A pointer resolved by the GraphQL engine, not by one of our resolvers
+            if (selection.name.value === '__typename')
+                continue;
+            fields++;
+        }
+        else if (selection.kind === Kind.INLINE_FRAGMENT) {
+            fields += countRootFields(selection.selectionSet, fragments, visited);
+        }
+        else if (selection.kind === Kind.FRAGMENT_SPREAD) {
+            if (visited.has(selection.name.value))
+                continue;
+            const fragment = fragments.get(selection.name.value);
+            if (fragment) {
+                visited.add(selection.name.value);
+                fields += countRootFields(fragment.selectionSet, fragments, visited);
+            }
+        }
+    }
+    return fields;
+}

package/dist/utils/get-graphql-query-cost.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.7.1",
+  "version": "12.7.3",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -126,7 +126,7 @@
     "ms": "2.1.3",
     "node-cron": "3.0.2",
     "node-machine-id": "1.1.12",
-    "nodemailer": "10.0.12",
+    "nodemailer": "10.2.1",
     "object-hash": "3.0.0",
     "openid-client": "6.8.2",
     "otplib": "12.0.1",
@@ -136,7 +136,7 @@
     "qs": "6.16.0",
     "rate-limiter-flexible": "2.4.1",
     "samlify": "2.13.1",
-    "sanitize-html": "2.17.7",
+    "sanitize-html": "2.18.1",
     "sharp": "0.35.5",
     "snappy": "7.2.2",
     "stream-json": "3.7.0",
@@ -144,20 +144,20 @@
     "tmp-promise": "3.0.3",
     "tsx": "3.12.6",
     "uuid-validate": "0.0.3",
-    "@wbce-d9/app": "11.3.0",
+    "@wbce-d9/app": "11.3.1",
     "@wbce-d9/constants": "10.0.0",
-    "@wbce-d9/extensions-sdk": "10.1.0",
     "@wbce-d9/exceptions": "10.0.1",
+    "@wbce-d9/extensions-sdk": "10.1.0",
     "@wbce-d9/schema": "10.0.0",
-    "@wbce-d9/storage": "10.0.0",
     "@wbce-d9/specs": "9.26.5",
-    "@wbce-d9/storage-driver-cloudinary": "10.0.6",
+    "@wbce-d9/storage-driver-cloudinary": "10.0.7",
+    "@wbce-d9/storage": "10.0.0",
     "@wbce-d9/storage-driver-azure": "10.0.5",
-    "@wbce-d9/storage-driver-local": "10.0.5",
+    "@wbce-d9/storage-driver-gcs": "10.0.5",
+    "@wbce-d9/storage-driver-s3": "10.0.6",
     "@wbce-d9/utils": "10.0.5",
-    "@wbce-d9/storage-driver-s3": "10.0.5",
-    "@wbce-d9/update-check": "10.0.4",
-    "@wbce-d9/storage-driver-gcs": "10.0.5"
+    "@wbce-d9/update-check": "10.0.5",
+    "@wbce-d9/storage-driver-local": "10.0.5"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
@@ -171,11 +171,11 @@
     "@types/supertest": "2.0.12",
     "@types/uuid": "9.0.1",
     "@types/wellknown": "0.5.4",
-    "@vitest/coverage-v8": "4.1.11",
+    "@vitest/coverage-v8": "4.1.12",
     "@wbce-d9/tsconfig": "2.0.0",
     "supertest": "6.3.3",
     "typescript": "5.0.4",
-    "vitest": "4.1.11",
+    "vitest": "4.1.12",
     "@types/async": "3.2.19",
     "@types/busboy": "1.5.0",
     "@types/bytes": "3.1.1",