directus 9.3.0 → 9.4.0

package/dist/database/migrations/20211211A-add-shares.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.down = exports.up = void 0;
+async function up(knex) {
+    await knex.schema.createTable('directus_shares', (table) => {
+        table.uuid('id').primary();
+        table.string('name');
+        table.string('collection', 64).references('collection').inTable('directus_collections').onDelete('CASCADE');
+        table.string('item');
+        table.uuid('role').references('id').inTable('directus_roles').onDelete('CASCADE');
+        table.string('password');
+        table.uuid('user_created').references('id').inTable('directus_users').onDelete('SET NULL');
+        table.timestamp('date_created').defaultTo(knex.fn.now());
+        table.timestamp('date_start');
+        table.timestamp('date_end');
+        table.integer('times_used').defaultTo(0);
+        table.integer('max_uses');
+    });
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.dropColumn('data');
+    });
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.uuid('user').nullable().alter();
+        table.uuid('share').references('id').inTable('directus_shares').onDelete('CASCADE');
+    });
+}
+exports.up = up;
+async function down(knex) {
+    await knex.schema.alterTable('directus_sessions', (table) => {
+        table.uuid('user').notNullable().alter();
+        table.json('data');
+        table.dropForeign('share');
+        table.dropColumn('share');
+    });
+    await knex.schema.dropTable('directus_shares');
+}
+exports.down = down;

package/dist/database/run-ast.js

@@ -18,7 +18,7 @@ const helpers_1 = require("../database/helpers");
 async function runAST(originalAST, schema, options) {
     const ast = (0, lodash_1.cloneDeep)(originalAST);
     const knex = (options === null || options === void 0 ? void 0 : options.knex) || (0, _1.default)();
-    if (ast.type === 'm2a') {
+    if (ast.type === 'a2o') {
         const results = {};
         for (const collection of ast.names) {
             results[collection] = await run(collection, ast.children[collection], ast.query[collection]);
@@ -85,7 +85,7 @@ async function parseCurrentLevel(schema, collection, children, query) {
         if (child.type === 'm2o') {
             columnsToSelectInternal.push(child.fieldKey);
         }
-        if (child.type === 'm2a') {
+        if (child.type === 'a2o') {
             columnsToSelectInternal.push(child.relation.field);
             columnsToSelectInternal.push(child.relation.meta.one_collection_field);
         }
@@ -182,7 +182,7 @@ function applyParentFilters(schema, nestedCollectionNodes, parentItem) {
                 nestedNode.query.union = [foreignField, foreignIds];
             }
         }
-        else if (nestedNode.type === 'm2a') {
+        else if (nestedNode.type === 'a2o') {
             const keysPerCollection = {};
             for (const parentItem of parentItems) {
                 const collection = parentItem[nestedNode.relation.meta.one_collection_field];
@@ -256,7 +256,7 @@ function mergeWithParentItems(schema, nestedItem, parentItem, nestedNode) {
             parentItem[nestedNode.fieldKey] = itemChildren.length > 0 ? itemChildren : [];
         }
     }
-    else if (nestedNode.type === 'm2a') {
+    else if (nestedNode.type === 'a2o') {
         for (const parentItem of parentItems) {
             if (!((_a = nestedNode.relation.meta) === null || _a === void 0 ? void 0 : _a.one_collection_field)) {
                 parentItem[nestedNode.fieldKey] = null;
@@ -279,7 +279,7 @@ function removeTemporaryFields(schema, rawItem, ast, primaryKeyField, parentItem
     var _a;
     const rawItems = (0, lodash_1.cloneDeep)((0, utils_1.toArray)(rawItem));
     const items = [];
-    if (ast.type === 'm2a') {
+    if (ast.type === 'a2o') {
         const fields = {};
         const nestedCollectionNodes = {};
         for (const relatedCollection of ast.names) {

package/dist/database/system-data/app-access-permissions/app-access-permissions.yaml

@@ -13,18 +13,6 @@
     comment:
       _nnull: true
 
-- collection: directus_collections
-  action: read
-
-- collection: directus_fields
-  action: read
-
-- collection: directus_permissions
-  action: read
-  permissions:
-    role:
-      _eq: $CURRENT_ROLE
-
 - collection: directus_presets
   action: read
   permissions:
@@ -60,9 +48,6 @@
     user:
       _eq: $CURRENT_USER
 
-- collection: directus_relations
-  action: read
-
 - collection: directus_roles
   action: read
   permissions:

package/dist/database/system-data/app-access-permissions/index.d.ts

@@ -1,2 +1,3 @@
 import { Permission } from '@directus/shared/types';
+export declare const schemaPermissions: Permission[];
 export declare const appAccessMinimalPermissions: Permission[];

package/dist/database/system-data/app-access-permissions/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.appAccessMinimalPermissions = void 0;
+exports.appAccessMinimalPermissions = exports.schemaPermissions = void 0;
 const lodash_1 = require("lodash");
 const require_yaml_1 = require("../../../utils/require-yaml");
 const defaults = {
@@ -11,5 +11,7 @@ const defaults = {
     fields: ['*'],
     system: true,
 };
+const schemaPermissionsRaw = (0, require_yaml_1.requireYAML)(require.resolve('./schema-access-permissions.yaml'));
 const permissions = (0, require_yaml_1.requireYAML)(require.resolve('./app-access-permissions.yaml'));
-exports.appAccessMinimalPermissions = permissions.map((row) => (0, lodash_1.merge)({}, defaults, row));
+exports.schemaPermissions = schemaPermissionsRaw.map((row) => (0, lodash_1.merge)({}, defaults, row));
+exports.appAccessMinimalPermissions = [...exports.schemaPermissions, ...permissions].map((row) => (0, lodash_1.merge)({}, defaults, row));

package/dist/database/system-data/app-access-permissions/schema-access-permissions.yaml

@@ -0,0 +1,17 @@
+# NOTE: Activity/collections/fields/presets/relations/revisions will have an extra hardcoded filter
+# to filter out collections you don't have read access
+
+- collection: directus_collections
+  action: read
+
+- collection: directus_fields
+  action: read
+
+- collection: directus_permissions
+  action: read
+  permissions:
+    role:
+      _eq: $CURRENT_ROLE
+
+- collection: directus_relations
+  action: read

package/dist/database/system-data/collections/collections.yaml

@@ -65,3 +65,6 @@ data:
     note: $t:directus_collection.directus_panels
   - collection: directus_notifications
     note: $t:directus_collection.directus_notifications
+  - collection: directus_shares
+    icon: share
+    note: $t:directus_collection.directus_shares

package/dist/database/system-data/fields/sessions.yaml

@@ -11,4 +11,4 @@ fields:
     width: half
   - field: user_agent
     width: half
-  - field: data
+  - field: share

package/dist/database/system-data/fields/shares.yaml

@@ -0,0 +1,73 @@
+table: directus_shares
+
+fields:
+  - field: id
+    special: uuid
+    readonly: true
+    hidden: true
+
+  - field: name
+
+  - field: collection
+    width: half
+    hidden: true
+
+  - field: item
+    width: half
+    hidden: true
+
+  - field: role
+    interface: select-dropdown-m2o
+    width: half
+    options:
+      template: '{{name}}'
+      filter:
+        admin_access:
+          _eq: false
+
+  - field: password
+    special: hash,conceal
+    interface: input-hash
+    options:
+      iconRight: lock
+      masked: true
+    width: half
+
+  - field: date_start
+    width: half
+
+  - field: date_end
+    width: half
+
+  - field: max_uses
+    width: half
+
+  - field: times_used
+    width: half
+    readonly: true
+
+  - field: date_created
+    special: date-created
+    width: half
+    readonly: true
+    conditions:
+      - name: notCreatedYet
+        rule:
+          id:
+            _null: true
+        hidden: true
+
+  - field: user_created
+    special: user-created
+    interface: select-dropdown-m2o
+    width: half
+    display: user
+    options:
+      template: '{{avatar.$thumbnail}} {{first_name}} {{last_name}}'
+    readonly: true
+    conditions:
+      - name: notCreatedYet
+        rule:
+          id:
+            _null: true
+        hidden: true

package/dist/database/system-data/fields/users.yaml

@@ -100,7 +100,7 @@ fields:
     options:
       icon: verified_user
       title: $t:fields.directus_users.admin_options
-      color: '#E35169'
+      color: 'var(--danger)'
     special:
       - alias
       - no-data

package/dist/database/system-data/relations/relations.yaml

@@ -12,6 +12,9 @@ defaults:
   sort_field: null
 
 data:
+  - many_collection: directus_collections
+    many_field: group
+    one_collection: directus_collections
   - many_collection: directus_users
     many_field: role
     one_collection: directus_roles
@@ -73,6 +76,9 @@ data:
   - many_collection: directus_sessions
     many_field: user
     one_collection: directus_users
+  - many_collection: directus_sessions
+    many_field: share
+    one_collection: directus_shares
   - many_collection: directus_settings
     many_field: storage_default_folder
     one_collection: directus_folders
@@ -88,3 +94,12 @@ data:
   - many_collection: directus_notifications
     many_field: sender
     one_collection: directus_users
+  - many_collection: directus_shares
+    many_field: role
+    one_collection: directus_roles
+  - many_collection: directus_shares
+    many_field: collection
+    one_collection: directus_collections
+  - many_collection: directus_shares
+    many_field: user_created
+    one_collection: directus_users

package/dist/extensions.js

@@ -44,6 +44,7 @@ const plugin_virtual_1 = __importDefault(require("@rollup/plugin-virtual"));
 const plugin_alias_1 = __importDefault(require("@rollup/plugin-alias"));
 const url_1 = require("./utils/url");
 const get_module_default_1 = __importDefault(require("./utils/get-module-default"));
+const lodash_1 = require("lodash");
 let extensionManager;
 function getExtensionManager() {
     if (extensionManager) {
@@ -141,12 +142,13 @@ class ExtensionManager {
         return bundles;
     }
     async getSharedDepsMapping(deps) {
-        const appDir = await fs_extra_1.default.readdir(path_1.default.join((0, node_1.resolvePackage)('@directus/app'), 'dist'));
+        const appDir = await fs_extra_1.default.readdir(path_1.default.join((0, node_1.resolvePackage)('@directus/app'), 'dist', 'assets'));
         const depsMapping = {};
         for (const dep of deps) {
-            const depName = appDir.find((file) => dep.replace(/\//g, '_') === file.substring(0, file.indexOf('.')));
+            const depRegex = new RegExp(`${(0, lodash_1.escapeRegExp)(dep.replace(/\//g, '_'))}\\.[0-9a-f]{8}\\.entry\\.js`);
+            const depName = appDir.find((file) => depRegex.test(file));
             if (depName) {
-                const depUrl = new url_1.Url(env_1.default.PUBLIC_URL).addPath('admin', depName);
+                const depUrl = new url_1.Url(env_1.default.PUBLIC_URL).addPath('admin', 'assets', depName);
                 depsMapping[dep] = depUrl.toString({ rootRelative: true });
             }
             else {

package/dist/middleware/authenticate.js

@@ -58,22 +58,12 @@ const authenticate = (0, async_handler_1.default)(async (req, res, next) => {
                     throw err;
                 }
             }
-            const user = await database
-                .select('directus_users.role', 'directus_roles.admin_access', 'directus_roles.app_access')
-                .from('directus_users')
-                .leftJoin('directus_roles', 'directus_users.role', 'directus_roles.id')
-                .where({
-                'directus_users.id': payload.id,
-                status: 'active',
-            })
-                .first();
-            if (!user) {
-                throw new exceptions_1.InvalidCredentialsException();
-            }
+            req.accountability.share = payload.share;
+            req.accountability.share_scope = payload.share_scope;
             req.accountability.user = payload.id;
-            req.accountability.role = user.role;
-            req.accountability.admin = user.admin_access === true || user.admin_access == 1;
-            req.accountability.app = user.app_access === true || user.app_access == 1;
+            req.accountability.role = payload.role;
+            req.accountability.admin = payload.admin_access === true || payload.admin_access == 1;
+            req.accountability.app = payload.app_access === true || payload.app_access == 1;
         }
         else {
             // Try finding the user with the provided token

package/dist/middleware/check-ip.js

@@ -7,13 +7,16 @@ exports.checkIP = void 0;
 const database_1 = __importDefault(require("../database"));
 const exceptions_1 = require("../exceptions");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
-exports.checkIP = (0, async_handler_1.default)(async (req, res, next) => {
+exports.checkIP = (0, async_handler_1.default)(async (req, _res, next) => {
     const database = (0, database_1.default)();
-    const role = await database
-        .select('ip_access')
-        .from('directus_roles')
-        .where({ id: req.accountability.role })
-        .first();
+    const query = database.select('ip_access').from('directus_roles');
+    if (req.accountability.role) {
+        query.where({ id: req.accountability.role });
+    }
+    else {
+        query.whereNull('id');
+    }
+    const role = await query.first();
     const ipAllowlist = ((role === null || role === void 0 ? void 0 : role.ip_access) || '').split(',').filter((ip) => ip);
     if (ipAllowlist.length > 0 && ipAllowlist.includes(req.accountability.ip) === false)
         throw new exceptions_1.InvalidIPException();

package/dist/middleware/respond.js

@@ -77,9 +77,12 @@ exports.respond = (0, async_handler_1.default)(async (req, res) => {
     if (Buffer.isBuffer(res.locals.payload)) {
         return res.end(res.locals.payload);
     }
-    else {
+    else if (res.locals.payload) {
         return res.json(res.locals.payload);
     }
+    else {
+        return res.status(204).end();
+    }
 });
 function getDateFormatted() {
     const date = new Date();

package/dist/services/activity.d.ts

@@ -1,5 +1,6 @@
 import { AbstractServiceOptions, PrimaryKey, Item } from '../types';
-import { ItemsService, MutationOptions } from './index';
+import { ItemsService } from './items';
+import { MutationOptions } from '../types';
 import { NotificationsService } from './notifications';
 import { UsersService } from './users';
 export declare class ActivityService extends ItemsService {

package/dist/services/activity.js

@@ -5,7 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ActivityService = void 0;
 const types_1 = require("../types");
-const index_1 = require("./index");
+const items_1 = require("./items");
 const notifications_1 = require("./notifications");
 const users_1 = require("./users");
 const authorization_1 = require("./authorization");
@@ -16,7 +16,7 @@ const user_name_1 = require("../utils/user-name");
 const lodash_1 = require("lodash");
 const env_1 = __importDefault(require("../env"));
 const uuid_validate_1 = __importDefault(require("uuid-validate"));
-class ActivityService extends index_1.ItemsService {
+class ActivityService extends items_1.ItemsService {
     constructor(options) {
         super('directus_activity', options);
         this.notificationsService = new notifications_1.NotificationsService({ schema: this.schema });

package/dist/services/authentication.d.ts

@@ -1,6 +1,6 @@
 import { Knex } from 'knex';
 import { ActivityService } from './activity';
-import { AbstractServiceOptions, SchemaOverview } from '../types';
+import { AbstractServiceOptions, SchemaOverview, LoginResult } from '../types';
 import { Accountability } from '@directus/shared/types';
 export declare class AuthenticationService {
     knex: Knex;
@@ -14,12 +14,7 @@ export declare class AuthenticationService {
      * Password is optional to allow usage of this function within the SSO flow and extensions. Make sure
      * to handle password existence checks elsewhere
      */
-    login(providerName: string | undefined, payload: Record<string, any>, otp?: string): Promise<{
-        accessToken: any;
-        refreshToken: any;
-        expires: any;
-        id?: any;
-    }>;
+    login(providerName: string | undefined, payload: Record<string, any>, otp?: string): Promise<LoginResult>;
     refresh(refreshToken: string): Promise<Record<string, any>>;
     logout(refreshToken: string): Promise<void>;
     verifyPassword(userID: string, password: string): Promise<void>;

package/dist/services/authentication.js

@@ -21,7 +21,6 @@ const settings_1 = require("./settings");
 const lodash_1 = require("lodash");
 const perf_hooks_1 = require("perf_hooks");
 const stall_1 = require("../utils/stall");
-const logger_1 = __importDefault(require("../logger"));
 const loginAttemptsLimiter = (0, rate_limiter_1.createRateLimiter)({ duration: 0 });
 class AuthenticationService {
     constructor(options) {
@@ -42,10 +41,11 @@ class AuthenticationService {
         const timeStart = perf_hooks_1.performance.now();
         const provider = (0, auth_1.getAuthProvider)(providerName);
         const user = await this.knex
-            .select('id', 'first_name', 'last_name', 'email', 'password', 'status', 'role', 'tfa_secret', 'provider', 'external_identifier', 'auth_data')
-            .from('directus_users')
-            .where('id', await provider.getUserID((0, lodash_1.cloneDeep)(payload)))
-            .andWhere('provider', providerName)
+            .select('u.id', 'u.first_name', 'u.last_name', 'u.email', 'u.password', 'u.status', 'u.role', 'r.admin_access', 'r.app_access', 'u.tfa_secret', 'u.provider', 'u.external_identifier', 'u.auth_data')
+            .from('directus_users as u')
+            .innerJoin('directus_roles as r', 'u.role', 'r.id')
+            .where('u.id', await provider.getUserID((0, lodash_1.cloneDeep)(payload)))
+            .andWhere('u.provider', providerName)
             .first();
         const updatedPayload = await emitter_1.default.emitFilter('auth.login', payload, {
             status: 'pending',
@@ -98,9 +98,8 @@ class AuthenticationService {
                 await loginAttemptsLimiter.set(user.id, 0, 0);
             }
         }
-        let sessionData = null;
         try {
-            sessionData = await provider.login((0, lodash_1.clone)(user), (0, lodash_1.cloneDeep)(updatedPayload));
+            await provider.login((0, lodash_1.clone)(user), (0, lodash_1.cloneDeep)(updatedPayload));
         }
         catch (e) {
             emitStatus('fail');
@@ -123,6 +122,9 @@ class AuthenticationService {
         }
         const tokenPayload = {
             id: user.id,
+            role: user.role,
+            app_access: user.app_access,
+            admin_access: user.admin_access,
         };
         const customClaims = await emitter_1.default.emitFilter('auth.jwt', tokenPayload, {
             status: 'pending',
@@ -146,7 +148,6 @@ class AuthenticationService {
             expires: refreshTokenExpiration,
             ip: (_a = this.accountability) === null || _a === void 0 ? void 0 : _a.ip,
             user_agent: (_b = this.accountability) === null || _b === void 0 ? void 0 : _b.userAgent,
-            data: sessionData && JSON.stringify(sessionData),
         });
         await this.knex('directus_sessions').delete().where('expires', '<', new Date());
         if (this.accountability) {
@@ -177,33 +178,80 @@ class AuthenticationService {
             throw new exceptions_1.InvalidCredentialsException();
         }
         const record = await this.knex
-            .select('s.expires', 's.data', 'u.id', 'u.first_name', 'u.last_name', 'u.email', 'u.password', 'u.status', 'u.role', 'u.provider', 'u.external_identifier', 'u.auth_data')
-            .from('directus_sessions as s')
-            .innerJoin('directus_users as u', 's.user', 'u.id')
+            .select({
+            session_expires: 's.expires',
+            user_id: 'u.id',
+            user_first_name: 'u.first_name',
+            user_last_name: 'u.last_name',
+            user_email: 'u.email',
+            user_password: 'u.password',
+            user_status: 'u.status',
+            user_provider: 'u.provider',
+            user_external_identifier: 'u.external_identifier',
+            user_auth_data: 'u.auth_data',
+            role_id: 'r.id',
+            role_admin_access: 'r.admin_access',
+            role_app_access: 'r.app_access',
+            share_id: 'd.id',
+            share_item: 'd.item',
+            share_role: 'd.role',
+            share_collection: 'd.collection',
+            share_start: 'd.date_start',
+            share_end: 'd.date_end',
+            share_times_used: 'd.times_used',
+            share_max_uses: 'd.max_uses',
+        })
+            .from('directus_sessions AS s')
+            .leftJoin('directus_users AS u', 's.user', 'u.id')
+            .leftJoin('directus_shares AS d', 's.share', 'd.id')
+            .joinRaw('LEFT JOIN directus_roles AS r ON r.id IN (u.role, d.role)')
             .where('s.token', refreshToken)
+            .andWhere('s.expires', '>=', this.knex.fn.now())
+            .andWhere((subQuery) => {
+            subQuery.whereNull('d.date_end').orWhere('d.date_end', '>=', this.knex.fn.now());
+        })
+            .andWhere((subQuery) => {
+            subQuery.whereNull('d.date_start').orWhere('d.date_start', '<=', this.knex.fn.now());
+        })
             .first();
-        if (!record || record.expires < new Date()) {
+        if (!record || (!record.share_id && !record.user_id)) {
             throw new exceptions_1.InvalidCredentialsException();
         }
-        let { data: sessionData } = record;
-        const user = (0, lodash_1.omit)(record, 'data');
-        if (typeof sessionData === 'string') {
-            try {
-                sessionData = JSON.parse(sessionData);
-            }
-            catch {
-                logger_1.default.warn(`Session data isn't valid JSON: ${sessionData}`);
-            }
+        if (record.user_id) {
+            const provider = (0, auth_1.getAuthProvider)(record.user_provider);
+            await provider.refresh({
+                id: record.user_id,
+                first_name: record.user_first_name,
+                last_name: record.user_last_name,
+                email: record.user_email,
+                password: record.user_password,
+                status: record.user_status,
+                provider: record.user_provider,
+                external_identifier: record.user_external_identifier,
+                auth_data: record.user_auth_data,
+                role: record.role_id,
+                app_access: record.role_app_access,
+                admin_access: record.role_admin_access,
+            });
         }
-        const provider = (0, auth_1.getAuthProvider)(user.provider);
-        const newSessionData = await provider.refresh((0, lodash_1.clone)(user), sessionData);
         const tokenPayload = {
-            id: user.id,
+            id: record.user_id,
+            role: record.role_id,
+            app_access: record.role_app_access,
+            admin_access: record.role_admin_access,
         };
+        if (record.share_id) {
+            tokenPayload.share = record.share_id;
+            tokenPayload.role = record.share_role;
+            tokenPayload.share_scope = {
+                collection: record.share_collection,
+                item: record.share_item,
+            };
+        }
         const customClaims = await emitter_1.default.emitFilter('auth.jwt', tokenPayload, {
             status: 'pending',
-            user: user === null || user === void 0 ? void 0 : user.id,
-            provider: user.provider,
+            user: record.user_id,
+            provider: record.user_provider,
             type: 'refresh',
         }, {
             database: this.knex,
@@ -220,37 +268,29 @@ class AuthenticationService {
             .update({
             token: newRefreshToken,
             expires: refreshTokenExpiration,
-            data: newSessionData && JSON.stringify(newSessionData),
         })
             .where({ token: refreshToken });
-        await this.knex('directus_users').update({ last_access: new Date() }).where({ id: user.id });
+        if (record.user_id) {
+            await this.knex('directus_users').update({ last_access: new Date() }).where({ id: record.user_id });
+        }
         return {
             accessToken,
             refreshToken: newRefreshToken,
             expires: (0, ms_1.default)(env_1.default.ACCESS_TOKEN_TTL),
-            id: user.id,
+            id: record.user_id,
         };
     }
     async logout(refreshToken) {
         const record = await this.knex
-            .select('u.id', 'u.first_name', 'u.last_name', 'u.email', 'u.password', 'u.status', 'u.role', 'u.provider', 'u.external_identifier', 'u.auth_data', 's.data')
+            .select('u.id', 'u.first_name', 'u.last_name', 'u.email', 'u.password', 'u.status', 'u.role', 'u.provider', 'u.external_identifier', 'u.auth_data')
             .from('directus_sessions as s')
             .innerJoin('directus_users as u', 's.user', 'u.id')
             .where('s.token', refreshToken)
             .first();
         if (record) {
-            let { data: sessionData } = record;
-            const user = (0, lodash_1.omit)(record, 'data');
-            if (typeof sessionData === 'string') {
-                try {
-                    sessionData = JSON.parse(sessionData);
-                }
-                catch {
-                    logger_1.default.warn(`Session data isn't valid JSON: ${sessionData}`);
-                }
-            }
+            const user = record;
             const provider = (0, auth_1.getAuthProvider)(user.provider);
-            await provider.logout((0, lodash_1.clone)(user), sessionData);
+            await provider.logout((0, lodash_1.clone)(user));
             await this.knex.delete().from('directus_sessions').where('token', refreshToken);
         }
     }

package/dist/services/authorization.js

@@ -41,7 +41,7 @@ class AuthorizationService {
          */
         function getCollectionsFromAST(ast) {
             const collections = [];
-            if (ast.type === 'm2a') {
+            if (ast.type === 'a2o') {
                 collections.push(...ast.names.map((name) => ({ collection: name, field: ast.fieldKey })));
                 for (const children of Object.values(ast.children)) {
                     for (const nestedNode of children) {
@@ -67,7 +67,7 @@ class AuthorizationService {
         function validateFields(ast) {
             var _a, _b, _c;
             if (ast.type !== 'field') {
-                if (ast.type === 'm2a') {
+                if (ast.type === 'a2o') {
                     for (const [collection, children] of Object.entries(ast.children)) {
                         checkFields(collection, children, (_b = (_a = ast.query) === null || _a === void 0 ? void 0 : _a[collection]) === null || _b === void 0 ? void 0 : _b.aggregate);
                     }
@@ -106,7 +106,7 @@ class AuthorizationService {
         }
         function applyFilters(ast, accountability) {
             if (ast.type !== 'field') {
-                if (ast.type === 'm2a') {
+                if (ast.type === 'a2o') {
                     const collections = Object.keys(ast.children);
                     for (const collection of collections) {
                         updateFilterQuery(collection, ast.query[collection]);