directus 9.16.1 → 9.17.0

package/dist/app.js

@@ -135,6 +135,13 @@ async function createApp() {
     await emitter_1.default.emitInit('app.before', { app });
     await emitter_1.default.emitInit('middlewares.before', { app });
     app.use(logger_1.expressLogger);
+    app.use((_req, res, next) => {
+        res.setHeader('X-Powered-By', 'Directus');
+        next();
+    });
+    if (env_1.default.CORS_ENABLED === true) {
+        app.use(cors_1.default);
+    }
     app.use((req, res, next) => {
         express_1.default.json({
             limit: env_1.default.MAX_PAYLOAD_SIZE,
@@ -147,13 +154,6 @@ async function createApp() {
     });
     app.use((0, cookie_parser_1.default)());
     app.use(extract_token_1.default);
-    app.use((_req, res, next) => {
-        res.setHeader('X-Powered-By', 'Directus');
-        next();
-    });
-    if (env_1.default.CORS_ENABLED === true) {
-        app.use(cors_1.default);
-    }
     app.get('/', (_req, res, next) => {
         if (env_1.default.ROOT_REDIRECT) {
             res.redirect(env_1.default.ROOT_REDIRECT);

package/dist/auth/drivers/ldap.js

@@ -302,6 +302,7 @@ function createLDAPAuthRouter(provider) {
         const accountability = {
             ip: (0, get_ip_from_req_1.getIPFromReq)(req),
             userAgent: req.get('user-agent'),
+            origin: req.get('origin'),
             role: null,
         };
         const authenticationService = new services_1.AuthenticationService({

package/dist/auth/drivers/local.js

@@ -15,6 +15,8 @@ const env_1 = __importDefault(require("../../env"));
 const respond_1 = require("../../middleware/respond");
 const constants_1 = require("../../constants");
 const get_ip_from_req_1 = require("../../utils/get-ip-from-req");
+const perf_hooks_1 = require("perf_hooks");
+const stall_1 = require("../../utils/stall");
 class LocalAuthDriver extends auth_1.AuthDriver {
     async getUserID(payload) {
         if (!payload.email) {
@@ -50,9 +52,12 @@ function createLocalAuthRouter(provider) {
     }).unknown();
     router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
         var _a;
+        const STALL_TIME = env_1.default.LOGIN_STALL_TIME;
+        const timeStart = perf_hooks_1.performance.now();
         const accountability = {
             ip: (0, get_ip_from_req_1.getIPFromReq)(req),
             userAgent: req.get('user-agent'),
+            origin: req.get('origin'),
             role: null,
         };
         const authenticationService = new services_1.AuthenticationService({
@@ -61,6 +66,7 @@ function createLocalAuthRouter(provider) {
         });
         const { error } = userLoginSchema.validate(req.body);
         if (error) {
+            await (0, stall_1.stall)(STALL_TIME, timeStart);
             throw new exceptions_1.InvalidPayloadException(error.message);
         }
         const mode = req.body.mode || 'json';

package/dist/auth/drivers/oauth2.js

@@ -222,6 +222,7 @@ function createOAuth2AuthRouter(providerName) {
             accountability: {
                 ip: (0, get_ip_from_req_1.getIPFromReq)(req),
                 userAgent: req.get('user-agent'),
+                origin: req.get('origin'),
                 role: null,
             },
             schema: req.schema,

package/dist/auth/drivers/openid.js

@@ -241,6 +241,7 @@ function createOpenIDAuthRouter(providerName) {
             accountability: {
                 ip: (0, get_ip_from_req_1.getIPFromReq)(req),
                 userAgent: req.get('user-agent'),
+                origin: req.get('origin'),
                 role: null,
             },
             schema: req.schema,

package/dist/cli/utils/create-env/env-stub.liquid

@@ -211,6 +211,10 @@ REFRESH_TOKEN_COOKIE_NAME="directus_refresh_token"
 # Which domain to use for the refresh cookie. Useful for development mode.
 # REFRESH_TOKEN_COOKIE_DOMAIN
 
+# The duration in milliseconds that a login request will be stalled for,
+# and it should be greater than the time taken for a login request with an invalid password [500]
+# LOGIN_STALL_TIME=500
+
 # Whether or not to enable the CORS headers [false]
 CORS_ENABLED=true
 

package/dist/controllers/activity.js

@@ -75,6 +75,7 @@ router.post('/comment', (0, async_handler_1.default)(async (req, res, next) => {
         user: (_a = req.accountability) === null || _a === void 0 ? void 0 : _a.user,
         ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         user_agent: req.get('user-agent'),
+        origin: req.get('origin'),
     });
     try {
         const record = await service.readOne(primaryKey, req.sanitizedQuery);

package/dist/controllers/auth.js

@@ -4,7 +4,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
-const ms_1 = __importDefault(require("ms"));
 const env_1 = __importDefault(require("../env"));
 const exceptions_1 = require("../exceptions");
 const respond_1 = require("../middleware/respond");
@@ -15,6 +14,7 @@ const logger_1 = __importDefault(require("../logger"));
 const drivers_1 = require("../auth/drivers");
 const constants_1 = require("../constants");
 const get_ip_from_req_1 = require("../utils/get-ip-from-req");
+const constants_2 = require("../constants");
 const router = (0, express_1.Router)();
 const authProviders = (0, get_auth_providers_1.getAuthProviders)();
 for (const authProvider of authProviders) {
@@ -43,10 +43,10 @@ if (!env_1.default.AUTH_DISABLE_DEFAULT) {
     router.use('/login', (0, drivers_1.createLocalAuthRouter)(constants_1.DEFAULT_AUTH_PROVIDER));
 }
 router.post('/refresh', (0, async_handler_1.default)(async (req, res, next) => {
-    var _a;
     const accountability = {
         ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         userAgent: req.get('user-agent'),
+        origin: req.get('origin'),
         role: null,
     };
     const authenticationService = new services_1.AuthenticationService({
@@ -66,13 +66,7 @@ router.post('/refresh', (0, async_handler_1.default)(async (req, res, next) => {
         payload.data.refresh_token = refreshToken;
     }
     if (mode === 'cookie') {
-        res.cookie(env_1.default.REFRESH_TOKEN_COOKIE_NAME, refreshToken, {
-            httpOnly: true,
-            domain: env_1.default.REFRESH_TOKEN_COOKIE_DOMAIN,
-            maxAge: (0, ms_1.default)(env_1.default.REFRESH_TOKEN_TTL),
-            secure: (_a = env_1.default.REFRESH_TOKEN_COOKIE_SECURE) !== null && _a !== void 0 ? _a : false,
-            sameSite: env_1.default.REFRESH_TOKEN_COOKIE_SAME_SITE || 'strict',
-        });
+        res.cookie(env_1.default.REFRESH_TOKEN_COOKIE_NAME, refreshToken, constants_2.COOKIE_OPTIONS);
     }
     res.locals.payload = payload;
     return next();
@@ -82,6 +76,7 @@ router.post('/logout', (0, async_handler_1.default)(async (req, res, next) => {
     const accountability = {
         ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         userAgent: req.get('user-agent'),
+        origin: req.get('origin'),
         role: null,
     };
     const authenticationService = new services_1.AuthenticationService({
@@ -110,6 +105,7 @@ router.post('/password/request', (0, async_handler_1.default)(async (req, res, n
     const accountability = {
         ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         userAgent: req.get('user-agent'),
+        origin: req.get('origin'),
         role: null,
     };
     const service = new services_1.UsersService({ accountability, schema: req.schema });
@@ -137,6 +133,7 @@ router.post('/password/reset', (0, async_handler_1.default)(async (req, res, nex
     const accountability = {
         ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         userAgent: req.get('user-agent'),
+        origin: req.get('origin'),
         role: null,
     };
     const service = new services_1.UsersService({ accountability, schema: req.schema });

package/dist/database/migrations/20220826A-add-origin-to-accountability.d.ts

@@ -0,0 +1,3 @@
+import { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20220826A-add-origin-to-accountability.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.down = exports.up = void 0;
+async function up(knex) {
+    await knex.schema.alterTable('directus_activity', (table) => {
+        table.string('origin').nullable();
+    });
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.string('origin').nullable();
+    });
+}
+exports.up = up;
+async function down(knex) {
+    await knex.schema.alterTable('directus_activity', (table) => {
+        table.dropColumn('origin');
+    });
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.dropColumn('origin');
+    });
+}
+exports.down = down;

package/dist/database/system-data/fields/activity.yaml

@@ -60,6 +60,12 @@ fields:
       font: monospace
     width: half
 
+  - field: origin
+    display: formatted-value
+    display_options:
+      font: monospace
+    width: half
+
   - field: ip
     display: formatted-value
     display_options:

package/dist/database/system-data/fields/sessions.yaml

@@ -11,4 +11,6 @@ fields:
     width: half
   - field: user_agent
     width: half
+  - field: origin
+    width: half
   - field: share

package/dist/env.js

@@ -42,6 +42,7 @@ const allowedEnvironmentVars = [
     'REFRESH_TOKEN_COOKIE_SECURE',
     'REFRESH_TOKEN_COOKIE_SAME_SITE',
     'REFRESH_TOKEN_COOKIE_NAME',
+    'LOGIN_STALL_TIME',
     'PASSWORD_RESET_URL_ALLOW_LIST',
     'USER_INVITE_URL_ALLOW_LIST',
     'IP_TRUST_PROXY',
@@ -79,6 +80,7 @@ const allowedEnvironmentVars = [
     'CACHE_REDIS_PASSWORD',
     'CACHE_MEMCACHE',
     'CACHE_VALUE_MAX_SIZE',
+    'CACHE_HEALTHCHECK_THRESHOLD',
     // storage
     'STORAGE_LOCATIONS',
     'STORAGE_.+_DRIVER',
@@ -95,6 +97,7 @@ const allowedEnvironmentVars = [
     'STORAGE_.+_ENDPOINT',
     'STORAGE_.+_KEY_FILENAME',
     'STORAGE_.+_BUCKET',
+    'STORAGE_.+_HEALTHCHECK_THRESHOLD',
     // metadata
     'FILE_METADATA_ALLOW_LIST',
     // assets
@@ -151,6 +154,7 @@ const allowedEnvironmentVars = [
     'EMAIL_VERIFY_SETUP',
     'EMAIL_SENDMAIL_NEW_LINE',
     'EMAIL_SENDMAIL_PATH',
+    'EMAIL_SMTP_NAME',
     'EMAIL_SMTP_HOST',
     'EMAIL_SMTP_PORT',
     'EMAIL_SMTP_USER',
@@ -172,6 +176,8 @@ const allowedEnvironmentVars = [
     // limits & optimization
     'RELATIONAL_BATCH_SIZE',
     'EXPORT_BATCH_SIZE',
+    // flows
+    'FLOWS_EXEC_ALLOWED_MODULES',
 ].map((name) => new RegExp(`^${name}$`));
 const acceptedEnvTypes = ['string', 'number', 'regex', 'array', 'json'];
 const defaults = {
@@ -194,6 +200,7 @@ const defaults = {
     REFRESH_TOKEN_COOKIE_SECURE: false,
     REFRESH_TOKEN_COOKIE_SAME_SITE: 'lax',
     REFRESH_TOKEN_COOKIE_NAME: 'directus_refresh_token',
+    LOGIN_STALL_TIME: 500,
     ROOT_REDIRECT: './admin',
     CORS_ENABLED: false,
     CORS_ORIGIN: false,

package/dist/extensions.d.ts

@@ -24,6 +24,7 @@ declare class ExtensionManager {
     private load;
     private unload;
     private initializeWatcher;
+    private closeWatcher;
     private updateWatchedExtensions;
     private getExtensions;
     private generateExtensionBundles;

package/dist/extensions.js

@@ -78,19 +78,27 @@ class ExtensionManager {
         this.reloadQueue = new job_queue_1.JobQueue();
     }
     async initialize(options = {}) {
+        const prevOptions = this.options;
         this.options = {
             ...defaultOptions,
             ...options,
         };
-        this.initializeWatcher();
+        if (!prevOptions.watch && this.options.watch) {
+            this.initializeWatcher();
+        }
+        else if (prevOptions.watch && !this.options.watch) {
+            await this.closeWatcher();
+        }
         if (!this.isLoaded) {
             await this.load();
-            this.updateWatchedExtensions(this.extensions);
             const loadedExtensions = this.getExtensionsList();
             if (loadedExtensions.length > 0) {
                 logger_1.default.info(`Loaded extensions: ${loadedExtensions.join(', ')}`);
             }
         }
+        if (!prevOptions.watch && this.options.watch) {
+            this.updateWatchedExtensions(this.extensions);
+        }
     }
     reload() {
         this.reloadQueue.enqueue(async () => {
@@ -158,7 +166,7 @@ class ExtensionManager {
         this.isLoaded = false;
     }
     initializeWatcher() {
-        if (this.options.watch && !this.watcher) {
+        if (!this.watcher) {
             logger_1.default.info('Watching extensions for changes...');
             const localExtensionPaths = (env_1.default.SERVE_APP ? constants_1.EXTENSION_TYPES : constants_1.API_OR_HYBRID_EXTENSION_TYPES).flatMap((type) => {
                 const typeDir = path_1.default.posix.join(path_1.default.relative('.', env_1.default.EXTENSIONS_PATH).split(path_1.default.sep).join(path_1.default.posix.sep), (0, utils_1.pluralize)(type));
@@ -175,6 +183,11 @@ class ExtensionManager {
                 .on('unlink', () => this.reload());
         }
     }
+    async closeWatcher() {
+        if (this.watcher) {
+            await this.watcher.close();
+        }
+    }
     updateWatchedExtensions(added, removed = []) {
         if (this.watcher) {
             const toPackageExtensionPaths = (extensions) => extensions

package/dist/flows.js

@@ -119,7 +119,7 @@ class FlowManager {
         return handler(data, context);
     }
     async load() {
-        var _a, _b, _c, _d, _e, _f, _g;
+        var _a, _b, _c, _d;
         const flowsService = new services_1.FlowsService({ knex: (0, database_1.default)(), schema: await (0, get_schema_1.getSchema)() });
         const flows = await flowsService.readByQuery({
             filter: { status: { _eq: 'active' } },
@@ -129,19 +129,23 @@ class FlowManager {
         const flowTrees = flows.map((flow) => (0, construct_flow_tree_1.constructFlowTree)(flow));
         for (const flow of flowTrees) {
             if (flow.trigger === 'event') {
-                const events = (_d = (_c = (_b = (0, utils_1.toArray)((_a = flow.options) === null || _a === void 0 ? void 0 : _a.scope)) === null || _b === void 0 ? void 0 : _b.map((scope) => {
-                    var _a, _b, _c;
-                    if (['items.create', 'items.update', 'items.delete'].includes(scope)) {
-                        return ((_c = (_b = (_a = flow.options) === null || _a === void 0 ? void 0 : _a.collections) === null || _b === void 0 ? void 0 : _b.map((collection) => {
-                            if (collection.startsWith('directus_')) {
-                                const action = scope.split('.')[1];
-                                return collection.substring(9) + '.' + action;
-                            }
-                            return `${collection}.${scope}`;
-                        })) !== null && _c !== void 0 ? _c : []);
-                    }
-                    return scope;
-                })) === null || _c === void 0 ? void 0 : _c.flat()) !== null && _d !== void 0 ? _d : [];
+                const events = ((_a = flow.options) === null || _a === void 0 ? void 0 : _a.scope)
+                    ? (0, utils_1.toArray)(flow.options.scope)
+                        .map((scope) => {
+                        var _a, _b, _c;
+                        if (['items.create', 'items.update', 'items.delete'].includes(scope)) {
+                            return ((_c = (_b = (_a = flow.options) === null || _a === void 0 ? void 0 : _a.collections) === null || _b === void 0 ? void 0 : _b.map((collection) => {
+                                if (collection.startsWith('directus_')) {
+                                    const action = scope.split('.')[1];
+                                    return collection.substring(9) + '.' + action;
+                                }
+                                return `${collection}.${scope}`;
+                            })) !== null && _c !== void 0 ? _c : []);
+                        }
+                        return scope;
+                    })
+                        .flat()
+                    : [];
                 if (flow.options.type === 'filter') {
                     const handler = (payload, meta, context) => this.executeFlow(flow, { payload, ...meta }, {
                         accountability: context.accountability,
@@ -196,9 +200,9 @@ class FlowManager {
                         return this.executeFlow(flow, data, context);
                     }
                 };
-                const method = (_f = (_e = flow.options) === null || _e === void 0 ? void 0 : _e.method) !== null && _f !== void 0 ? _f : 'GET';
+                const method = (_c = (_b = flow.options) === null || _b === void 0 ? void 0 : _b.method) !== null && _c !== void 0 ? _c : 'GET';
                 // Default return to $last for webhooks
-                flow.options.return = (_g = flow.options.return) !== null && _g !== void 0 ? _g : '$last';
+                flow.options.return = (_d = flow.options.return) !== null && _d !== void 0 ? _d : '$last';
                 this.webhookFlowHandlers[`${method}-${flow.id}`] = handler;
             }
             else if (flow.trigger === 'manual') {
@@ -254,7 +258,7 @@ class FlowManager {
         this.isLoaded = false;
     }
     async executeFlow(flow, data = null, context = {}) {
-        var _a, _b, _c, _d, _e, _f;
+        var _a, _b, _c, _d, _e, _f, _g;
         const database = (_a = context.database) !== null && _a !== void 0 ? _a : (0, database_1.default)();
         const schema = (_b = context.schema) !== null && _b !== void 0 ? _b : (await (0, get_schema_1.getSchema)({ database }));
         const keyedData = {
@@ -263,11 +267,13 @@ class FlowManager {
             [ACCOUNTABILITY_KEY]: (_c = context === null || context === void 0 ? void 0 : context.accountability) !== null && _c !== void 0 ? _c : null,
         };
         let nextOperation = flow.operation;
+        let lastOperationStatus = 'unknown';
         const steps = [];
         while (nextOperation !== null) {
             const { successor, data, status, options } = await this.executeOperation(nextOperation, keyedData, context);
             keyedData[nextOperation.key] = data;
             keyedData[LAST_KEY] = data;
+            lastOperationStatus = status;
             steps.push({ operation: nextOperation.id, key: nextOperation.key, status, options });
             nextOperation = successor;
         }
@@ -283,6 +289,7 @@ class FlowManager {
                 collection: 'directus_flows',
                 ip: (_e = accountability === null || accountability === void 0 ? void 0 : accountability.ip) !== null && _e !== void 0 ? _e : null,
                 user_agent: (_f = accountability === null || accountability === void 0 ? void 0 : accountability.userAgent) !== null && _f !== void 0 ? _f : null,
+                origin: (_g = accountability === null || accountability === void 0 ? void 0 : accountability.origin) !== null && _g !== void 0 ? _g : null,
                 item: flow.id,
             });
             if (flow.accountability === 'all') {
@@ -301,6 +308,9 @@ class FlowManager {
                 });
             }
         }
+        if (flow.trigger === 'event' && flow.options.type === 'filter' && lastOperationStatus === 'reject') {
+            throw keyedData[LAST_KEY];
+        }
         if (flow.options.return === '$all') {
             return keyedData;
         }

package/dist/mailer.js

@@ -37,6 +37,7 @@ function getMailer() {
         }
         const tls = (0, get_config_from_env_1.getConfigFromEnv)('EMAIL_SMTP_TLS_');
         transporter = nodemailer_1.default.createTransport({
+            name: env_1.default.EMAIL_SMTP_NAME,
             pool: env_1.default.EMAIL_SMTP_POOL,
             host: env_1.default.EMAIL_SMTP_HOST,
             port: env_1.default.EMAIL_SMTP_PORT,

package/dist/middleware/authenticate.d.ts

@@ -3,5 +3,5 @@ import { NextFunction, Request, Response } from 'express';
  * Verify the passed JWT and assign the user ID and role to `req`
  */
 export declare const handler: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-declare const _default: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
+declare const _default: (req: Request<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
 export default _default;

package/dist/middleware/authenticate.js

@@ -24,6 +24,7 @@ const handler = async (req, res, next) => {
         app: false,
         ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         userAgent: req.get('user-agent'),
+        origin: req.get('origin'),
     };
     const database = (0, database_1.default)();
     const customAccountability = await emitter_1.default.emitFilter('authenticate', defaultAccountability, {

package/dist/middleware/authenticate.test.js

@@ -34,7 +34,16 @@ test('Short-circuits when authenticate filter is used', async () => {
 test('Uses default public accountability when no token is given', async () => {
     const req = {
         ip: '127.0.0.1',
-        get: jest.fn((string) => (string === 'user-agent' ? 'fake-user-agent' : null)),
+        get: jest.fn((string) => {
+            switch (string) {
+                case 'user-agent':
+                    return 'fake-user-agent';
+                case 'origin':
+                    return 'fake-origin';
+                default:
+                    return null;
+            }
+        }),
     };
     const res = {};
     const next = jest.fn();
@@ -47,6 +56,7 @@ test('Uses default public accountability when no token is given', async () => {
         app: false,
         ip: '127.0.0.1',
         userAgent: 'fake-user-agent',
+        origin: 'fake-origin',
     });
     expect(next).toHaveBeenCalledTimes(1);
 });
@@ -70,7 +80,16 @@ test('Sets accountability to payload contents if valid token is passed', async (
     }, env_1.default.SECRET, { issuer: 'directus' });
     const req = {
         ip: '127.0.0.1',
-        get: jest.fn((string) => (string === 'user-agent' ? 'fake-user-agent' : null)),
+        get: jest.fn((string) => {
+            switch (string) {
+                case 'user-agent':
+                    return 'fake-user-agent';
+                case 'origin':
+                    return 'fake-origin';
+                default:
+                    return null;
+            }
+        }),
         token,
     };
     const res = {};
@@ -85,6 +104,7 @@ test('Sets accountability to payload contents if valid token is passed', async (
         share_scope: shareScope,
         ip: '127.0.0.1',
         userAgent: 'fake-user-agent',
+        origin: 'fake-origin',
     });
     expect(next).toHaveBeenCalledTimes(1);
     // Test with 1/0 instead or true/false
@@ -107,6 +127,7 @@ test('Sets accountability to payload contents if valid token is passed', async (
         share_scope: shareScope,
         ip: '127.0.0.1',
         userAgent: 'fake-user-agent',
+        origin: 'fake-origin',
     });
     expect(next).toHaveBeenCalledTimes(1);
 });
@@ -120,7 +141,16 @@ test('Throws InvalidCredentialsException when static token is used, but user doe
     });
     const req = {
         ip: '127.0.0.1',
-        get: jest.fn((string) => (string === 'user-agent' ? 'fake-user-agent' : null)),
+        get: jest.fn((string) => {
+            switch (string) {
+                case 'user-agent':
+                    return 'fake-user-agent';
+                case 'origin':
+                    return 'fake-origin';
+                default:
+                    return null;
+            }
+        }),
         token: 'static-token',
     };
     const res = {};
@@ -131,7 +161,16 @@ test('Throws InvalidCredentialsException when static token is used, but user doe
 test('Sets accountability to user information when static token is used', async () => {
     const req = {
         ip: '127.0.0.1',
-        get: jest.fn((string) => (string === 'user-agent' ? 'fake-user-agent' : null)),
+        get: jest.fn((string) => {
+            switch (string) {
+                case 'user-agent':
+                    return 'fake-user-agent';
+                case 'origin':
+                    return 'fake-origin';
+                default:
+                    return null;
+            }
+        }),
         token: 'static-token',
     };
     const res = {};
@@ -144,6 +183,7 @@ test('Sets accountability to user information when static token is used', async
         admin: testUser.admin_access,
         ip: '127.0.0.1',
         userAgent: 'fake-user-agent',
+        origin: 'fake-origin',
     };
     jest.mocked(database_1.default).mockReturnValue({
         select: jest.fn().mockReturnThis(),

package/dist/middleware/validate-batch.d.ts

@@ -1,2 +1 @@
-import { RequestHandler } from 'express';
-export declare const validateBatch: (scope: 'read' | 'update' | 'delete') => RequestHandler;
+export declare const validateBatch: (scope: 'read' | 'update' | 'delete') => (req: import("express").Request<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>, res: import("express").Response<any, Record<string, any>>, next: import("express").NextFunction) => Promise<void>;

package/dist/middleware/validate-batch.js

@@ -14,39 +14,36 @@ const validateBatch = (scope) => (0, async_handler_1.default)(async (req, res, n
         req.body = {};
         return next();
     }
+    if (req.method.toLowerCase() !== 'search' && scope !== 'read' && req.singleton) {
+        return next();
+    }
     if (!req.body)
         throw new exceptions_1.InvalidPayloadException('Payload in body is required');
-    if (req.singleton)
+    if (['update', 'delete'].includes(scope) && Array.isArray(req.body)) {
         return next();
+    }
+    // In reads, the query in the body should override the query params for searching
+    if (scope === 'read' && req.body.query) {
+        req.sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+    }
     // Every cRUD action has either keys or query
     let batchSchema = joi_1.default.object().keys({
         keys: joi_1.default.array().items(joi_1.default.alternatives(joi_1.default.string(), joi_1.default.number())),
         query: joi_1.default.object().unknown(),
     });
-    // In reads, you can't combine the two, and 1 of the two at  least is required
-    if (scope !== 'read') {
+    if (['update', 'delete'].includes(scope)) {
         batchSchema = batchSchema.xor('query', 'keys');
     }
     // In updates, we add a required `data` that holds the update payload if an array isn't used
     if (scope === 'update') {
-        if (Array.isArray(req.body))
-            return next();
         batchSchema = batchSchema.keys({
             data: joi_1.default.object().unknown().required(),
         });
     }
-    // In deletes, we want to keep supporting an array of just primary keys
-    if (scope === 'delete' && Array.isArray(req.body)) {
-        return next();
-    }
     const { error } = batchSchema.validate(req.body);
     if (error) {
         throw new exceptions_2.FailedValidationException(error.details[0]);
     }
-    // In reads, the query in the body should override the query params for searching
-    if (scope === 'read' && req.body.query) {
-        req.sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
-    }
     return next();
 });
 exports.validateBatch = validateBatch;

package/dist/middleware/validate-batch.test.d.ts

@@ -0,0 +1 @@
+import '../../src/types/express.d.ts';

package/dist/middleware/validate-batch.test.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const validate_batch_1 = require("./validate-batch");
+require("../../src/types/express.d.ts");
+const exceptions_1 = require("../exceptions");
+const exceptions_2 = require("@directus/shared/exceptions");
+let mockRequest;
+let mockResponse;
+const nextFunction = jest.fn();
+beforeEach(() => {
+    mockRequest = {};
+    mockResponse = {};
+    jest.clearAllMocks();
+});
+test('Sets body to empty, calls next on GET requests', async () => {
+    mockRequest.method = 'GET';
+    await (0, validate_batch_1.validateBatch)('read')(mockRequest, mockResponse, nextFunction);
+    expect(mockRequest.body).toEqual({});
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+});
+test(`Short circuits on singletons that aren't queried through SEARCH`, async () => {
+    mockRequest.method = 'PATCH';
+    mockRequest.singleton = true;
+    mockRequest.body = { title: 'test' };
+    await (0, validate_batch_1.validateBatch)('update')(mockRequest, mockResponse, nextFunction);
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+});
+test('Throws InvalidPayloadException on missing body', async () => {
+    mockRequest.method = 'SEARCH';
+    await (0, validate_batch_1.validateBatch)('read')(mockRequest, mockResponse, nextFunction);
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+    expect(jest.mocked(nextFunction).mock.calls[0][0]).toBeInstanceOf(exceptions_1.InvalidPayloadException);
+});
+test(`Short circuits on Array body in update/delete use`, async () => {
+    mockRequest.method = 'PATCH';
+    mockRequest.body = [1, 2, 3];
+    await (0, validate_batch_1.validateBatch)('update')(mockRequest, mockResponse, nextFunction);
+    expect(mockRequest.sanitizedQuery).toBe(undefined);
+    expect(nextFunction).toHaveBeenCalled();
+});
+test(`Sets sanitizedQuery based on body.query in read operations`, async () => {
+    mockRequest.method = 'SEARCH';
+    mockRequest.body = {
+        query: {
+            sort: 'id',
+        },
+    };
+    await (0, validate_batch_1.validateBatch)('read')(mockRequest, mockResponse, nextFunction);
+    expect(mockRequest.sanitizedQuery).toEqual({
+        sort: ['id'],
+    });
+});
+test(`Doesn't allow both query and keys in a batch delete`, async () => {
+    mockRequest.method = 'DELETE';
+    mockRequest.body = {
+        keys: [1, 2, 3],
+        query: { filter: {} },
+    };
+    await (0, validate_batch_1.validateBatch)('delete')(mockRequest, mockResponse, nextFunction);
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+    expect(jest.mocked(nextFunction).mock.calls[0][0]).toBeInstanceOf(exceptions_2.FailedValidationException);
+});
+test(`Requires 'data' on batch update`, async () => {
+    mockRequest.method = 'PATCH';
+    mockRequest.body = {
+        keys: [1, 2, 3],
+        query: { filter: {} },
+    };
+    await (0, validate_batch_1.validateBatch)('update')(mockRequest, mockResponse, nextFunction);
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+    expect(jest.mocked(nextFunction).mock.calls[0][0]).toBeInstanceOf(exceptions_2.FailedValidationException);
+});
+test(`Calls next when all is well`, async () => {
+    mockRequest.method = 'PATCH';
+    mockRequest.body = {
+        query: { filter: {} },
+        data: {},
+    };
+    await (0, validate_batch_1.validateBatch)('update')(mockRequest, mockResponse, nextFunction);
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+    expect(jest.mocked(nextFunction).mock.calls[0][0]).toBeUndefined();
+});

package/dist/operations/request/index.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const utils_1 = require("@directus/shared/utils");
 const axios_1 = __importDefault(require("axios"));
+const encodeurl_1 = __importDefault(require("encodeurl"));
 exports.default = (0, utils_1.defineOperationApi)({
     id: 'request',
     handler: async ({ url, method, body, headers }) => {
@@ -16,9 +17,8 @@ exports.default = (0, utils_1.defineOperationApi)({
         if (!customHeaders['Content-Type'] && isValidJSON(body)) {
             customHeaders['Content-Type'] = 'application/json';
         }
-        const shouldEncode = decodeURI(url) === url;
         const result = await (0, axios_1.default)({
-            url: shouldEncode ? encodeURI(url) : url,
+            url: (0, encodeurl_1.default)(url),
             method,
             data: body,
             headers: customHeaders,

package/dist/operations/transform/index.d.ts

@@ -1,5 +1,5 @@
 declare type Options = {
-    json: string;
+    json: string | Record<string, any>;
 };
 declare const _default: import("@directus/shared/types").OperationApiConfig<Options>;
 export default _default;

package/dist/operations/transform/index.js

@@ -4,6 +4,6 @@ const utils_1 = require("@directus/shared/utils");
 exports.default = (0, utils_1.defineOperationApi)({
     id: 'transform',
     handler: ({ json }) => {
-        return (0, utils_1.parseJSON)(json);
+        return (0, utils_1.optionToObject)(json);
     },
 });

package/dist/services/authentication.js

@@ -36,15 +36,23 @@ class AuthenticationService {
      * to handle password existence checks elsewhere
      */
     async login(providerName = constants_1.DEFAULT_AUTH_PROVIDER, payload, otp) {
-        var _a, _b;
-        const STALL_TIME = 100;
+        var _a, _b, _c;
+        const STALL_TIME = env_1.default.LOGIN_STALL_TIME;
         const timeStart = perf_hooks_1.performance.now();
         const provider = (0, auth_1.getAuthProvider)(providerName);
+        let userId;
+        try {
+            userId = await provider.getUserID((0, lodash_1.cloneDeep)(payload));
+        }
+        catch (err) {
+            await (0, stall_1.stall)(STALL_TIME, timeStart);
+            throw err;
+        }
         const user = await this.knex
             .select('u.id', 'u.first_name', 'u.last_name', 'u.email', 'u.password', 'u.status', 'u.role', 'r.admin_access', 'r.app_access', 'u.tfa_secret', 'u.provider', 'u.external_identifier', 'u.auth_data')
             .from('directus_users as u')
             .leftJoin('directus_roles as r', 'u.role', 'r.id')
-            .where('u.id', await provider.getUserID((0, lodash_1.cloneDeep)(payload)))
+            .where('u.id', userId)
             .first();
         const updatedPayload = await emitter_1.default.emitFilter('auth.login', payload, {
             status: 'pending',
@@ -151,6 +159,7 @@ class AuthenticationService {
             expires: refreshTokenExpiration,
             ip: (_a = this.accountability) === null || _a === void 0 ? void 0 : _a.ip,
             user_agent: (_b = this.accountability) === null || _b === void 0 ? void 0 : _b.userAgent,
+            origin: (_c = this.accountability) === null || _c === void 0 ? void 0 : _c.origin,
         });
         await this.knex('directus_sessions').delete().where('expires', '<', new Date());
         if (this.accountability) {
@@ -159,6 +168,7 @@ class AuthenticationService {
                 user: user.id,
                 ip: this.accountability.ip,
                 user_agent: this.accountability.userAgent,
+                origin: this.accountability.origin,
                 collection: 'directus_users',
                 item: user.id,
             });

package/dist/services/files.js

@@ -46,6 +46,7 @@ const utils_1 = require("@directus/shared/utils");
 const items_1 = require("./items");
 const net_1 = __importDefault(require("net"));
 const os_1 = __importDefault(require("os"));
+const encodeurl_1 = __importDefault(require("encodeurl"));
 const lookupDNS = (0, util_1.promisify)(dns_1.lookup);
 class FilesService extends items_1.ItemsService {
     constructor(options) {
@@ -229,8 +230,7 @@ class FilesService extends items_1.ItemsService {
         }
         let fileResponse;
         try {
-            const shouldEncode = decodeURI(importURL) === importURL;
-            fileResponse = await axios_1.default.get(shouldEncode ? encodeURI(importURL) : importURL, {
+            fileResponse = await axios_1.default.get((0, encodeurl_1.default)(importURL), {
                 responseType: 'stream',
             });
         }

package/dist/services/graphql/index.js

@@ -293,41 +293,43 @@ class GraphQLService {
                                 return obj[field.field];
                             },
                         };
-                        if (field.type === 'date') {
-                            acc[`${field.field}_func`] = {
-                                type: DateFunctions,
-                                resolve: (obj) => {
-                                    const funcFields = Object.keys(DateFunctions.getFields()).map((key) => `${field.field}_${key}`);
-                                    return (0, lodash_1.mapKeys)((0, lodash_1.pick)(obj, funcFields), (_value, key) => key.substring(field.field.length + 1));
-                                },
-                            };
-                        }
-                        if (field.type === 'time') {
-                            acc[`${field.field}_func`] = {
-                                type: TimeFunctions,
-                                resolve: (obj) => {
-                                    const funcFields = Object.keys(TimeFunctions.getFields()).map((key) => `${field.field}_${key}`);
-                                    return (0, lodash_1.mapKeys)((0, lodash_1.pick)(obj, funcFields), (_value, key) => key.substring(field.field.length + 1));
-                                },
-                            };
-                        }
-                        if (field.type === 'dateTime' || field.type === 'timestamp') {
-                            acc[`${field.field}_func`] = {
-                                type: DateTimeFunctions,
-                                resolve: (obj) => {
-                                    const funcFields = Object.keys(DateTimeFunctions.getFields()).map((key) => `${field.field}_${key}`);
-                                    return (0, lodash_1.mapKeys)((0, lodash_1.pick)(obj, funcFields), (_value, key) => key.substring(field.field.length + 1));
-                                },
-                            };
-                        }
-                        if (field.type === 'json' || field.type === 'alias') {
-                            acc[`${field.field}_func`] = {
-                                type: CountFunctions,
-                                resolve: (obj) => {
-                                    const funcFields = Object.keys(CountFunctions.getFields()).map((key) => `${field.field}_${key}`);
-                                    return (0, lodash_1.mapKeys)((0, lodash_1.pick)(obj, funcFields), (_value, key) => key.substring(field.field.length + 1));
-                                },
-                            };
+                        if (action === 'read') {
+                            if (field.type === 'date') {
+                                acc[`${field.field}_func`] = {
+                                    type: DateFunctions,
+                                    resolve: (obj) => {
+                                        const funcFields = Object.keys(DateFunctions.getFields()).map((key) => `${field.field}_${key}`);
+                                        return (0, lodash_1.mapKeys)((0, lodash_1.pick)(obj, funcFields), (_value, key) => key.substring(field.field.length + 1));
+                                    },
+                                };
+                            }
+                            if (field.type === 'time') {
+                                acc[`${field.field}_func`] = {
+                                    type: TimeFunctions,
+                                    resolve: (obj) => {
+                                        const funcFields = Object.keys(TimeFunctions.getFields()).map((key) => `${field.field}_${key}`);
+                                        return (0, lodash_1.mapKeys)((0, lodash_1.pick)(obj, funcFields), (_value, key) => key.substring(field.field.length + 1));
+                                    },
+                                };
+                            }
+                            if (field.type === 'dateTime' || field.type === 'timestamp') {
+                                acc[`${field.field}_func`] = {
+                                    type: DateTimeFunctions,
+                                    resolve: (obj) => {
+                                        const funcFields = Object.keys(DateTimeFunctions.getFields()).map((key) => `${field.field}_${key}`);
+                                        return (0, lodash_1.mapKeys)((0, lodash_1.pick)(obj, funcFields), (_value, key) => key.substring(field.field.length + 1));
+                                    },
+                                };
+                            }
+                            if (field.type === 'json' || field.type === 'alias') {
+                                acc[`${field.field}_func`] = {
+                                    type: CountFunctions,
+                                    resolve: (obj) => {
+                                        const funcFields = Object.keys(CountFunctions.getFields()).map((key) => `${field.field}_${key}`);
+                                        return (0, lodash_1.mapKeys)((0, lodash_1.pick)(obj, funcFields), (_value, key) => key.substring(field.field.length + 1));
+                                    },
+                                };
+                            }
                         }
                         return acc;
                     }, {}),
@@ -1615,6 +1617,7 @@ class GraphQLService {
                     const accountability = {
                         ip: req === null || req === void 0 ? void 0 : req.ip,
                         userAgent: req === null || req === void 0 ? void 0 : req.get('user-agent'),
+                        origin: req === null || req === void 0 ? void 0 : req.get('origin'),
                         role: null,
                     };
                     const authenticationService = new authentication_1.AuthenticationService({
@@ -1649,6 +1652,7 @@ class GraphQLService {
                     const accountability = {
                         ip: req === null || req === void 0 ? void 0 : req.ip,
                         userAgent: req === null || req === void 0 ? void 0 : req.get('user-agent'),
+                        origin: req === null || req === void 0 ? void 0 : req.get('origin'),
                         role: null,
                     };
                     const authenticationService = new authentication_1.AuthenticationService({
@@ -1685,6 +1689,7 @@ class GraphQLService {
                     const accountability = {
                         ip: req === null || req === void 0 ? void 0 : req.ip,
                         userAgent: req === null || req === void 0 ? void 0 : req.get('user-agent'),
+                        origin: req === null || req === void 0 ? void 0 : req.get('origin'),
                         role: null,
                     };
                     const authenticationService = new authentication_1.AuthenticationService({
@@ -1709,6 +1714,7 @@ class GraphQLService {
                     const accountability = {
                         ip: req === null || req === void 0 ? void 0 : req.ip,
                         userAgent: req === null || req === void 0 ? void 0 : req.get('user-agent'),
+                        origin: req === null || req === void 0 ? void 0 : req.get('origin'),
                         role: null,
                     };
                     const service = new users_1.UsersService({ accountability, schema: this.schema });
@@ -1733,6 +1739,7 @@ class GraphQLService {
                     const accountability = {
                         ip: req === null || req === void 0 ? void 0 : req.ip,
                         userAgent: req === null || req === void 0 ? void 0 : req.get('user-agent'),
+                        origin: req === null || req === void 0 ? void 0 : req.get('origin'),
                         role: null,
                     };
                     const service = new users_1.UsersService({ accountability, schema: this.schema });
@@ -2303,7 +2310,7 @@ class GraphQLService {
                         comment: (0, graphql_1.GraphQLNonNull)(graphql_1.GraphQLString),
                     },
                     resolve: async (_, args, __, info) => {
-                        var _a, _b, _c, _d, _e;
+                        var _a, _b, _c, _d, _e, _f;
                         const service = new activity_1.ActivityService({
                             accountability: this.accountability,
                             schema: this.schema,
@@ -2314,9 +2321,10 @@ class GraphQLService {
                             user: (_a = this.accountability) === null || _a === void 0 ? void 0 : _a.user,
                             ip: (_b = this.accountability) === null || _b === void 0 ? void 0 : _b.ip,
                             user_agent: (_c = this.accountability) === null || _c === void 0 ? void 0 : _c.userAgent,
+                            origin: (_d = this.accountability) === null || _d === void 0 ? void 0 : _d.origin,
                         });
                         if ('directus_activity' in ReadCollectionTypes) {
-                            const selections = this.replaceFragmentsInSelections((_e = (_d = info.fieldNodes[0]) === null || _d === void 0 ? void 0 : _d.selectionSet) === null || _e === void 0 ? void 0 : _e.selections, info.fragments);
+                            const selections = this.replaceFragmentsInSelections((_f = (_e = info.fieldNodes[0]) === null || _e === void 0 ? void 0 : _e.selectionSet) === null || _f === void 0 ? void 0 : _f.selections, info.fragments);
                             const query = this.getQuery(args, selections || [], info.variableValues);
                             return await service.readOne(primaryKey, query);
                         }

package/dist/services/items.js

@@ -130,6 +130,7 @@ class ItemsService {
                     collection: this.collection,
                     ip: this.accountability.ip,
                     user_agent: this.accountability.userAgent,
+                    origin: this.accountability.origin,
                     item: primaryKey,
                 });
                 // If revisions are tracked, create revisions record
@@ -214,7 +215,16 @@ class ItemsService {
      * Get items by query
      */
     async readByQuery(query, opts) {
-        let ast = await (0, get_ast_from_query_1.default)(this.collection, query, this.schema, {
+        const updatedQuery = (opts === null || opts === void 0 ? void 0 : opts.emitEvents) !== false
+            ? await emitter_1.default.emitFilter(`${this.eventScope}.query`, query, {
+                collection: this.collection,
+            }, {
+                database: this.knex,
+                schema: this.schema,
+                accountability: this.accountability,
+            })
+            : query;
+        let ast = await (0, get_ast_from_query_1.default)(this.collection, updatedQuery, this.schema, {
             accountability: this.accountability,
             // By setting the permissions action, you can read items using the permissions for another
             // operation's permissions. This is used to dynamically check if you have update/delete
@@ -240,7 +250,7 @@ class ItemsService {
         }
         const filteredRecords = (opts === null || opts === void 0 ? void 0 : opts.emitEvents) !== false
             ? await emitter_1.default.emitFilter(this.eventScope === 'items' ? ['items.read', `${this.collection}.items.read`] : `${this.eventScope}.read`, records, {
-                query,
+                query: updatedQuery,
                 collection: this.collection,
             }, {
                 database: this.knex,
@@ -251,7 +261,7 @@ class ItemsService {
         if ((opts === null || opts === void 0 ? void 0 : opts.emitEvents) !== false) {
             emitter_1.default.emitAction(this.eventScope === 'items' ? ['items.read', `${this.collection}.items.read`] : `${this.eventScope}.read`, {
                 payload: filteredRecords,
-                query,
+                query: updatedQuery,
                 collection: this.collection,
             }, {
                 database: this.knex || (0, database_1.default)(),
@@ -406,6 +416,7 @@ class ItemsService {
                     collection: this.collection,
                     ip: this.accountability.ip,
                     user_agent: this.accountability.userAgent,
+                    origin: this.accountability.origin,
                     item: key,
                 })));
                 if (this.schema.collections[this.collection].accountability === 'all') {
@@ -573,6 +584,7 @@ class ItemsService {
                     collection: this.collection,
                     ip: this.accountability.ip,
                     user_agent: this.accountability.userAgent,
+                    origin: this.accountability.origin,
                     item: key,
                 })));
             }

package/dist/services/payload.js

@@ -538,10 +538,34 @@ class PayloadService {
                 if (error)
                     throw new exceptions_1.InvalidPayloadException(`Invalid one-to-many update structure: ${error.message}`);
                 if (alterations.create) {
-                    await itemsService.createMany(alterations.create.map((item) => ({
-                        ...item,
-                        [relation.field]: parent || payload[currentPrimaryKeyField],
-                    })), {
+                    const sortField = relation.meta.sort_field;
+                    let createPayload;
+                    if (sortField !== null) {
+                        const highestOrderNumber = await this.knex
+                            .from(relation.collection)
+                            .where({ [relation.field]: parent })
+                            .whereNotNull(sortField)
+                            .max(sortField)
+                            .first();
+                        createPayload = alterations.create.map((item, index) => {
+                            const record = (0, lodash_1.cloneDeep)(item);
+                            // add sort field value if it is not supplied in the item
+                            if (parent !== null && record[sortField] === undefined) {
+                                record[sortField] = (highestOrderNumber === null || highestOrderNumber === void 0 ? void 0 : highestOrderNumber.max) ? highestOrderNumber.max + index + 1 : index + 1;
+                            }
+                            return {
+                                ...record,
+                                [relation.field]: parent || payload[currentPrimaryKeyField],
+                            };
+                        });
+                    }
+                    else {
+                        createPayload = alterations.create.map((item) => ({
+                            ...item,
+                            [relation.field]: parent || payload[currentPrimaryKeyField],
+                        }));
+                    }
+                    await itemsService.createMany(createPayload, {
                         onRevisionCreate: (pk) => revisions.push(pk),
                         bypassEmitAction: (params) => nestedActionEvents.push(params),
                         emitEvents: opts === null || opts === void 0 ? void 0 : opts.emitEvents,

package/dist/services/server.js

@@ -143,7 +143,7 @@ class ServerService {
                     componentType: 'datastore',
                     observedUnit: 'ms',
                     observedValue: 0,
-                    threshold: 150,
+                    threshold: env_1.default.DB_HEALTHCHECK_THRESHOLD ? +env_1.default.DB_HEALTHCHECK_THRESHOLD : 150,
                 },
             ];
             const startTime = perf_hooks_1.performance.now();
@@ -188,7 +188,7 @@ class ServerService {
                         componentType: 'cache',
                         observedValue: 0,
                         observedUnit: 'ms',
-                        threshold: 150,
+                        threshold: env_1.default.CACHE_HEALTHCHECK_THRESHOLD ? +env_1.default.CACHE_HEALTHCHECK_THRESHOLD : 150,
                     },
                 ],
             };
@@ -222,7 +222,7 @@ class ServerService {
                         componentType: 'ratelimiter',
                         observedValue: 0,
                         observedUnit: 'ms',
-                        threshold: 150,
+                        threshold: env_1.default.RATE_LIMITER_HEALTHCHECK_THRESHOLD ? +env_1.default.RATE_LIMITER_HEALTHCHECK_THRESHOLD : 150,
                     },
                 ],
             };
@@ -249,13 +249,14 @@ class ServerService {
             const checks = {};
             for (const location of (0, utils_1.toArray)(env_1.default.STORAGE_LOCATIONS)) {
                 const disk = storage_1.default.disk(location);
+                const envThresholdKey = `STORAGE_${location}_HEALTHCHECK_THRESHOLD`.toUpperCase();
                 checks[`storage:${location}:responseTime`] = [
                     {
                         status: 'ok',
                         componentType: 'objectstore',
                         observedValue: 0,
                         observedUnit: 'ms',
-                        threshold: 750,
+                        threshold: env_1.default[envThresholdKey] ? +env_1.default[envThresholdKey] : 750,
                     },
                 ];
                 const startTime = perf_hooks_1.performance.now();

package/dist/services/shares.js

@@ -31,7 +31,7 @@ class SharesService extends items_1.ItemsService {
         return super.createOne(data, opts);
     }
     async login(payload) {
-        var _a, _b;
+        var _a, _b, _c;
         const record = await this.knex
             .select({
             share_id: 'id',
@@ -86,6 +86,7 @@ class SharesService extends items_1.ItemsService {
             expires: refreshTokenExpiration,
             ip: (_a = this.accountability) === null || _a === void 0 ? void 0 : _a.ip,
             user_agent: (_b = this.accountability) === null || _b === void 0 ? void 0 : _b.userAgent,
+            origin: (_c = this.accountability) === null || _c === void 0 ? void 0 : _c.origin,
             share: record.share_id,
         });
         await this.knex('directus_sessions').delete().where('expires', '<', new Date());

package/dist/utils/async-handler.d.ts

@@ -1,7 +1,3 @@
-import { ErrorRequestHandler, RequestHandler } from 'express';
-/**
- * Handles promises in routes.
- */
-declare function asyncHandler(handler: RequestHandler): RequestHandler;
-declare function asyncHandler(handler: ErrorRequestHandler): ErrorRequestHandler;
+import type { RequestHandler, Request, Response, NextFunction } from 'express';
+declare const asyncHandler: (fn: RequestHandler) => (req: Request, res: Response, next: NextFunction) => Promise<void>;
 export default asyncHandler;

package/dist/utils/async-handler.js

@@ -1,16 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-function asyncHandler(handler) {
-    if (handler.length === 2 || handler.length === 3) {
-        const scoped = (req, res, next) => Promise.resolve(handler(req, res, next)).catch(next);
-        return scoped;
-    }
-    else if (handler.length === 4) {
-        const scoped = (err, req, res, next) => Promise.resolve(handler(err, req, res, next)).catch(next);
-        return scoped;
-    }
-    else {
-        throw new Error(`Failed to asyncHandle() function "${handler.name}"`);
-    }
-}
+const asyncHandler = (fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
 exports.default = asyncHandler;

package/dist/utils/async-handler.test.d.ts

@@ -0,0 +1 @@
+import '../../src/types/express.d.ts';

package/dist/utils/async-handler.test.js

@@ -0,0 +1,18 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("../../src/types/express.d.ts");
+const async_handler_1 = __importDefault(require("./async-handler"));
+let mockRequest;
+let mockResponse;
+const nextFunction = jest.fn();
+test('Wraps async middleware in Promise resolve that will catch rejects and pass them to the nextFn', async () => {
+    const err = new Error('testing');
+    const middleware = async (_req, _res, _next) => {
+        throw err;
+    };
+    await (0, async_handler_1.default)(middleware)(mockRequest, mockResponse, nextFunction);
+    expect(nextFunction).toHaveBeenCalledWith(err);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "directus",
-  "version": "9.16.1",
+  "version": "9.17.0",
   "license": "GPL-3.0-only",
   "homepage": "https://github.com/directus/directus#readme",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content.",
@@ -66,16 +66,16 @@
   ],
   "dependencies": {
     "@aws-sdk/client-ses": "^3.107.0",
-    "@directus/app": "9.16.1",
-    "@directus/drive": "9.16.1",
-    "@directus/drive-azure": "9.16.1",
-    "@directus/drive-gcs": "9.16.1",
-    "@directus/drive-s3": "9.16.1",
+    "@directus/app": "9.17.0",
+    "@directus/drive": "9.17.0",
+    "@directus/drive-azure": "9.17.0",
+    "@directus/drive-gcs": "9.17.0",
+    "@directus/drive-s3": "9.17.0",
     "@directus/extensions-sdk": "^9.14.1",
     "@directus/format-title": "^9.15.0",
-    "@directus/schema": "9.16.1",
-    "@directus/shared": "9.16.1",
-    "@directus/specs": "9.16.1",
+    "@directus/schema": "9.17.0",
+    "@directus/shared": "9.17.0",
+    "@directus/specs": "9.17.0",
     "@godaddy/terminus": "^4.10.2",
     "@rollup/plugin-alias": "^3.1.9",
     "@rollup/plugin-virtual": "^2.1.0",
@@ -97,6 +97,7 @@
     "deep-map": "^2.0.0",
     "destroy": "^1.2.0",
     "dotenv": "^10.0.0",
+    "encodeurl": "^1.0.2",
     "eventemitter2": "^6.4.5",
     "execa": "^5.1.1",
     "exifr": "^7.1.3",
@@ -126,7 +127,7 @@
     "mime-types": "^2.1.35",
     "ms": "^2.1.3",
     "nanoid": "^3.1.23",
-    "node-cron": "^3.0.1",
+    "node-cron": "^3.0.2",
     "node-machine-id": "^1.1.12",
     "nodemailer": "^6.7.5",
     "object-hash": "^2.2.0",
@@ -175,6 +176,7 @@
     "@types/cors": "2.8.12",
     "@types/deep-diff": "1.0.1",
     "@types/destroy": "1.0.0",
+    "@types/encodeurl": "^1.0.0",
     "@types/express": "4.17.13",
     "@types/express-pino-logger": "4.0.3",
     "@types/express-serve-static-core": "^4.17.29",