directus 9.5.1 → 9.7.0

package/dist/services/relations.js

@@ -135,6 +135,10 @@ class RelationsService {
         if (relation.field in this.schema.collections[relation.collection].fields === false) {
             throw new exceptions_1.InvalidPayloadException(`Field "${relation.field}" doesn't exist in collection "${relation.collection}"`);
         }
+        // A primary key should not be a foreign key
+        if (this.schema.collections[relation.collection].primary === relation.field) {
+            throw new exceptions_1.InvalidPayloadException(`Field "${relation.field}" in collection "${relation.collection}" is a primary key`);
+        }
         if (relation.related_collection && relation.related_collection in this.schema.collections === false) {
             throw new exceptions_1.InvalidPayloadException(`Collection "${relation.related_collection}" doesn't exist`);
         }
@@ -171,7 +175,7 @@ class RelationsService {
             });
             await relationsItemService.createOne(metaRow);
         });
-        await this.systemCache.clear();
+        await (0, cache_1.clearSystemCache)();
     }
     /**
      * Update an existing foreign key constraint
@@ -232,7 +236,7 @@ class RelationsService {
                 }
             }
         });
-        await this.systemCache.clear();
+        await (0, cache_1.clearSystemCache)();
     }
     /**
      * Delete an existing relationship
@@ -253,7 +257,10 @@ class RelationsService {
         }
         await this.knex.transaction(async (trx) => {
             var _a;
-            if ((_a = existingRelation.schema) === null || _a === void 0 ? void 0 : _a.constraint_name) {
+            const existingConstraints = await this.schemaInspector.foreignKeys();
+            const constraintNames = existingConstraints.map((key) => key.constraint_name);
+            if (((_a = existingRelation.schema) === null || _a === void 0 ? void 0 : _a.constraint_name) &&
+                constraintNames.includes(existingRelation.schema.constraint_name)) {
                 await trx.schema.alterTable(existingRelation.collection, (table) => {
                     table.dropForeign(existingRelation.field, existingRelation.schema.constraint_name);
                 });
@@ -262,7 +269,7 @@ class RelationsService {
                 await trx('directus_relations').delete().where({ many_collection: collection, many_field: field });
             }
         });
-        await this.systemCache.clear();
+        await (0, cache_1.clearSystemCache)();
     }
     /**
      * Whether or not the current user has read access to relations

package/dist/services/utils.js

@@ -7,6 +7,7 @@ exports.UtilsService = void 0;
 const database_1 = __importDefault(require("../database"));
 const collections_1 = require("../database/system-data/collections");
 const exceptions_1 = require("../exceptions");
+const emitter_1 = __importDefault(require("../emitter"));
 class UtilsService {
     constructor(options) {
         this.knex = options.knex || (0, database_1.default)();
@@ -98,6 +99,15 @@ class UtilsService {
                 .andWhere(sortField, '<=', sourceSortValue)
                 .andWhereNot({ [primaryKeyField]: item });
         }
+        emitter_1.default.emitAction(['items.sort', `${collection}.items.sort`], {
+            collection,
+            item,
+            to,
+        }, {
+            database: this.knex,
+            schema: this.schema,
+            accountability: this.accountability,
+        });
     }
 }
 exports.UtilsService = UtilsService;

package/dist/utils/apply-query.js

@@ -48,29 +48,7 @@ function applyQuery(knex, collection, dbQuery, query, schema, subQuery = false)
     if (query.aggregate) {
         applyAggregate(dbQuery, query.aggregate, collection);
     }
-    if (query.union && query.union[1].length > 0) {
-        const [field, keys] = query.union;
-        const queries = keys.map((key) => {
-            const unionFilter = { [field]: { _eq: key } };
-            let filter = (0, lodash_1.cloneDeep)(query.filter);
-            if (filter) {
-                if ('_and' in filter) {
-                    filter._and.push(unionFilter);
-                }
-                else {
-                    filter = {
-                        _and: [filter, unionFilter],
-                    };
-                }
-            }
-            else {
-                filter = unionFilter;
-            }
-            return knex.select('*').from(applyFilter(knex, schema, dbQuery.clone(), filter, collection, subQuery).as('foo'));
-        });
-        dbQuery = knex.unionAll(queries);
-    }
-    else if (query.filter) {
+    if (query.filter) {
         applyFilter(knex, schema, dbQuery, query.filter, collection, subQuery);
     }
     return dbQuery;
@@ -234,7 +212,7 @@ function applyFilter(knex, schema, rootQuery, rootFilter, collection, subQuery =
                     applyFilterToQuery(`${collection}.${filterPath[0]}`, filterOperator, filterValue, logical);
                 }
             }
-            else if (subQuery === false) {
+            else if (subQuery === false || filterPath.length > 1) {
                 if (!relation)
                     continue;
                 let pkField = `${collection}.${schema.collections[relation.related_collection].primary}`;

package/dist/utils/get-date-formatted.d.ts

@@ -0,0 +1 @@
+export declare function getDateFormatted(): string;

package/dist/utils/get-date-formatted.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDateFormatted = void 0;
+function getDateFormatted() {
+    const date = new Date();
+    let month = String(date.getMonth() + 1);
+    if (month.length === 1)
+        month = '0' + month;
+    let day = String(date.getDate());
+    if (day.length === 1)
+        day = '0' + day;
+    return `${date.getFullYear()}${month}${day}-${date.getHours()}${date.getMinutes()}${date.getSeconds()}`;
+}
+exports.getDateFormatted = getDateFormatted;

package/dist/utils/get-permissions.js

@@ -65,7 +65,7 @@ async function getPermissions(accountability, schema) {
             ? await getFilterContext(schema, accountability, requiredPermissionData)
             : {};
         if (env_1.default.CACHE_PERMISSIONS !== false) {
-            await systemCache.set(cacheKey, { permissions, containDynamicData });
+            await (0, cache_1.setSystemCache)(cacheKey, { permissions, containDynamicData });
             if (containDynamicData && env_1.default.CACHE_ENABLED !== false) {
                 await (cache === null || cache === void 0 ? void 0 : cache.set(`filterContext-${(0, object_hash_1.default)({ user, role, permissions })}`, filterContext));
             }

package/dist/utils/get-schema.js

@@ -35,7 +35,7 @@ async function getSchema(options) {
         else {
             result = await getDatabaseSchema(database, schemaInspector);
             try {
-                await systemCache.set('schema', result);
+                await (0, cache_1.setSystemCache)('schema', result);
             }
             catch (err) {
                 logger_1.default.warn(err, `[schema-cache] Couldn't save cache. ${err}`);

package/dist/utils/is-directus-jwt.js

@@ -3,37 +3,20 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const atob_1 = __importDefault(require("atob"));
-const logger_1 = __importDefault(require("../logger"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 /**
  * Check if a given string conforms to the structure of a JWT
  * and whether it is issued by Directus.
  */
 function isDirectusJWT(string) {
-    const parts = string.split('.');
-    // JWTs have the structure header.payload.signature
-    if (parts.length !== 3)
-        return false;
-    // Check if all segments are base64 encoded
-    try {
-        (0, atob_1.default)(parts[0]);
-        (0, atob_1.default)(parts[1]);
-        (0, atob_1.default)(parts[2]);
-    }
-    catch (err) {
-        logger_1.default.error(err);
-        return false;
-    }
-    // Check if the header and payload are valid JSON
     try {
-        JSON.parse((0, atob_1.default)(parts[0]));
-        const payload = JSON.parse((0, atob_1.default)(parts[1]));
-        if (payload.iss !== 'directus')
+        const payload = jsonwebtoken_1.default.decode(string, { json: true });
+        if ((payload === null || payload === void 0 ? void 0 : payload.iss) !== 'directus')
             return false;
+        return true;
     }
     catch {
         return false;
     }
-    return true;
 }
 exports.default = isDirectusJWT;

package/dist/utils/jwt.d.ts

@@ -0,0 +1,2 @@
+import { DirectusTokenPayload } from '../types';
+export declare function verifyAccessJWT(token: string, secret: string): DirectusTokenPayload;

package/dist/utils/jwt.js

@@ -0,0 +1,49 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAccessJWT = void 0;
+const jsonwebtoken_1 = __importStar(require("jsonwebtoken"));
+const exceptions_1 = require("../exceptions");
+function verifyAccessJWT(token, secret) {
+    let payload;
+    try {
+        payload = jsonwebtoken_1.default.verify(token, secret, {
+            issuer: 'directus',
+        });
+    }
+    catch (err) {
+        if (err instanceof jsonwebtoken_1.TokenExpiredError) {
+            throw new exceptions_1.InvalidTokenException('Token expired.');
+        }
+        else if (err instanceof jsonwebtoken_1.JsonWebTokenError) {
+            throw new exceptions_1.InvalidTokenException('Token invalid.');
+        }
+        else {
+            throw new exceptions_1.ServiceUnavailableException(`Couldn't verify token.`, { service: 'jwt' });
+        }
+    }
+    const { id, role, app_access, admin_access, share, share_scope } = payload;
+    if (role === undefined || app_access === undefined || admin_access === undefined) {
+        throw new exceptions_1.InvalidTokenException('Invalid token payload.');
+    }
+    return { id, role, app_access, admin_access, share, share_scope };
+}
+exports.verifyAccessJWT = verifyAccessJWT;

package/dist/utils/merge-permissions.js

@@ -31,9 +31,15 @@ function mergePermission(strategy, currentPerm, newPerm) {
             };
         }
         else if (currentPerm.permissions) {
-            permissions = {
-                [logicalKey]: [currentPerm.permissions, newPerm.permissions],
-            };
+            // Empty {} supersedes other permissions in _OR merge
+            if (strategy === 'or' && ((0, lodash_1.isEqual)(currentPerm.permissions, {}) || (0, lodash_1.isEqual)(newPerm.permissions, {}))) {
+                permissions = {};
+            }
+            else {
+                permissions = {
+                    [logicalKey]: [currentPerm.permissions, newPerm.permissions],
+                };
+            }
         }
         else {
             permissions = {
@@ -51,9 +57,15 @@ function mergePermission(strategy, currentPerm, newPerm) {
             };
         }
         else if (currentPerm.validation) {
-            validation = {
-                [logicalKey]: [currentPerm.validation, newPerm.validation],
-            };
+            // Empty {} supersedes other validations in _OR merge
+            if (strategy === 'or' && ((0, lodash_1.isEqual)(currentPerm.validation, {}) || (0, lodash_1.isEqual)(newPerm.validation, {}))) {
+                validation = {};
+            }
+            else {
+                validation = {
+                    [logicalKey]: [currentPerm.validation, newPerm.validation],
+                };
+            }
         }
         else {
             validation = {

package/example.env

@@ -1,6 +1,7 @@
 ####################################################################################################
 # General
 
+HOST="0.0.0.0"
 PORT=8055
 PUBLIC_URL="http://localhost:8055"
 LOG_LEVEL="info"

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "directus",
-	"version": "9.5.1",
+	"version": "9.7.0",
 	"license": "GPL-3.0-only",
 	"homepage": "https://github.com/directus/directus#readme",
 	"description": "Directus is a real-time API and App dashboard for managing SQL database content.",
@@ -65,7 +65,7 @@
 		"cli": "cross-env NODE_ENV=development SERVE_APP=false ts-node --script-mode --transpile-only src/cli/run.ts",
 		"test": "jest",
 		"test:coverage": "jest --coverage",
-		"test:watch": "jest --watchAll"
+		"test:watch": "jest --watch"
 	},
 	"engines": {
 		"node": ">=12.20.0"
@@ -78,23 +78,22 @@
 	],
 	"dependencies": {
 		"@aws-sdk/client-ses": "^3.40.0",
-		"@directus/app": "9.5.1",
-		"@directus/drive": "9.5.1",
-		"@directus/drive-azure": "9.5.1",
-		"@directus/drive-gcs": "9.5.1",
-		"@directus/drive-s3": "9.5.1",
-		"@directus/extensions-sdk": "9.5.1",
-		"@directus/format-title": "9.5.1",
-		"@directus/schema": "9.5.1",
-		"@directus/shared": "9.5.1",
-		"@directus/specs": "9.5.1",
+		"@directus/app": "9.7.0",
+		"@directus/drive": "9.7.0",
+		"@directus/drive-azure": "9.7.0",
+		"@directus/drive-gcs": "9.7.0",
+		"@directus/drive-s3": "9.7.0",
+		"@directus/extensions-sdk": "9.7.0",
+		"@directus/format-title": "9.7.0",
+		"@directus/schema": "9.7.0",
+		"@directus/shared": "9.7.0",
+		"@directus/specs": "9.7.0",
 		"@godaddy/terminus": "^4.9.0",
-		"@rollup/plugin-alias": "^3.1.2",
+		"@rollup/plugin-alias": "^3.1.9",
 		"@rollup/plugin-virtual": "^2.0.3",
 		"argon2": "^0.28.2",
 		"async": "^3.2.0",
 		"async-mutex": "^0.3.1",
-		"atob": "^2.1.2",
 		"axios": "^0.24.0",
 		"busboy": "^0.3.1",
 		"camelcase": "^6.2.0",
@@ -149,11 +148,12 @@
 		"qs": "^6.9.4",
 		"rate-limiter-flexible": "^2.2.2",
 		"resolve-cwd": "^3.0.0",
-		"rollup": "^2.52.1",
+		"rollup": "^2.67.3",
 		"sanitize-html": "^2.6.0",
 		"sharp": "^0.29.0",
 		"stream-json": "^1.7.1",
 		"supertest": "^6.1.6",
+		"tmp-promise": "^3.0.3",
 		"update-check": "^1.5.4",
 		"uuid": "^8.3.2",
 		"uuid-validate": "0.0.3",
@@ -173,10 +173,9 @@
 		"sqlite3": "^5.0.2",
 		"tedious": "^13.0.0"
 	},
-	"gitHead": "c0c412d30b116bd38a2690b62463f775d37db79c",
+	"gitHead": "c1da41d6719d4efdc5d0196019fb7b2c6672c575",
 	"devDependencies": {
 		"@types/async": "3.2.10",
-		"@types/atob": "2.1.2",
 		"@types/body-parser": "1.19.2",
 		"@types/busboy": "0.3.1",
 		"@types/cookie-parser": "1.4.2",
@@ -189,7 +188,7 @@
 		"@types/flat": "5.0.2",
 		"@types/fs-extra": "9.0.13",
 		"@types/inquirer": "8.1.3",
-		"@types/jest": "27.0.3",
+		"@types/jest": "27.4.1",
 		"@types/js-yaml": "4.0.5",
 		"@types/json2csv": "5.0.3",
 		"@types/jsonwebtoken": "8.5.6",
@@ -215,9 +214,9 @@
 		"@types/wellknown": "0.5.1",
 		"copyfiles": "2.4.1",
 		"cross-env": "7.0.3",
-		"jest": "27.3.1",
+		"jest": "27.5.1",
 		"knex-mock-client": "1.6.1",
-		"ts-jest": "27.0.7",
+		"ts-jest": "27.1.3",
 		"ts-node-dev": "1.1.8",
 		"typescript": "4.5.2"
 	}

package/dist/__mocks__/cache.d.ts

@@ -1,6 +0,0 @@
-/// <reference types="jest" />
-export declare const cache: {
-    get: jest.Mock<any, any>;
-    set: jest.Mock<any, any>;
-};
-export declare const getCache: jest.Mock<any, any>;

package/dist/__mocks__/cache.js

@@ -1,8 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getCache = exports.cache = void 0;
-exports.cache = {
-    get: jest.fn().mockResolvedValue(undefined),
-    set: jest.fn().mockResolvedValue(true),
-};
-exports.getCache = jest.fn().mockReturnValue({ cache: exports.cache });

package/dist/services/import.d.ts

@@ -1,13 +0,0 @@
-/// <reference types="node" />
-import { Knex } from 'knex';
-import { AbstractServiceOptions } from '../types';
-import { Accountability, SchemaOverview } from '@directus/shared/types';
-export declare class ImportService {
-    knex: Knex;
-    accountability: Accountability | null;
-    schema: SchemaOverview;
-    constructor(options: AbstractServiceOptions);
-    import(collection: string, mimetype: string, stream: NodeJS.ReadableStream): Promise<void>;
-    importJSON(collection: string, stream: NodeJS.ReadableStream): Promise<void>;
-    importCSV(collection: string, stream: NodeJS.ReadableStream): Promise<void>;
-}

package/dist/services/import.js

@@ -1,118 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ImportService = void 0;
-const database_1 = __importDefault(require("../database"));
-const exceptions_1 = require("../exceptions");
-const StreamArray_1 = __importDefault(require("stream-json/streamers/StreamArray"));
-const items_1 = require("./items");
-const async_1 = require("async");
-const destroy_1 = __importDefault(require("destroy"));
-const csv_parser_1 = __importDefault(require("csv-parser"));
-const lodash_1 = require("lodash");
-class ImportService {
-    constructor(options) {
-        this.knex = options.knex || (0, database_1.default)();
-        this.accountability = options.accountability || null;
-        this.schema = options.schema;
-    }
-    async import(collection, mimetype, stream) {
-        var _a, _b, _c, _d, _e;
-        if (collection.startsWith('directus_'))
-            throw new exceptions_1.ForbiddenException();
-        const createPermissions = (_b = (_a = this.accountability) === null || _a === void 0 ? void 0 : _a.permissions) === null || _b === void 0 ? void 0 : _b.find((permission) => permission.collection === collection && permission.action === 'create');
-        const updatePermissions = (_d = (_c = this.accountability) === null || _c === void 0 ? void 0 : _c.permissions) === null || _d === void 0 ? void 0 : _d.find((permission) => permission.collection === collection && permission.action === 'update');
-        if (((_e = this.accountability) === null || _e === void 0 ? void 0 : _e.admin) !== true && (!createPermissions || !updatePermissions)) {
-            throw new exceptions_1.ForbiddenException();
-        }
-        switch (mimetype) {
-            case 'application/json':
-                return await this.importJSON(collection, stream);
-            case 'text/csv':
-            case 'application/vnd.ms-excel':
-                return await this.importCSV(collection, stream);
-            default:
-                throw new exceptions_1.UnsupportedMediaTypeException(`Can't import files of type "${mimetype}"`);
-        }
-    }
-    importJSON(collection, stream) {
-        const extractJSON = StreamArray_1.default.withParser();
-        return this.knex.transaction((trx) => {
-            const service = new items_1.ItemsService(collection, {
-                knex: trx,
-                schema: this.schema,
-                accountability: this.accountability,
-            });
-            const saveQueue = (0, async_1.queue)(async (value) => {
-                return await service.upsertOne(value);
-            });
-            return new Promise((resolve, reject) => {
-                stream.pipe(extractJSON);
-                extractJSON.on('data', ({ value }) => {
-                    saveQueue.push(value);
-                });
-                extractJSON.on('error', (err) => {
-                    (0, destroy_1.default)(stream);
-                    (0, destroy_1.default)(extractJSON);
-                    reject(new exceptions_1.InvalidPayloadException(err.message));
-                });
-                saveQueue.error((err) => {
-                    reject(err);
-                });
-                extractJSON.on('end', () => {
-                    saveQueue.drain(() => {
-                        return resolve();
-                    });
-                });
-            });
-        });
-    }
-    importCSV(collection, stream) {
-        return this.knex.transaction((trx) => {
-            const service = new items_1.ItemsService(collection, {
-                knex: trx,
-                schema: this.schema,
-                accountability: this.accountability,
-            });
-            const saveQueue = (0, async_1.queue)(async (value) => {
-                return await service.upsertOne(value);
-            });
-            return new Promise((resolve, reject) => {
-                stream
-                    .pipe((0, csv_parser_1.default)())
-                    .on('data', (value) => {
-                    const obj = (0, lodash_1.transform)(value, (result, value, key) => {
-                        if (value.length === 0) {
-                            delete result[key];
-                        }
-                        else {
-                            try {
-                                const parsedJson = JSON.parse(value);
-                                (0, lodash_1.set)(result, key, parsedJson);
-                            }
-                            catch {
-                                (0, lodash_1.set)(result, key, value);
-                            }
-                        }
-                    });
-                    saveQueue.push(obj);
-                })
-                    .on('error', (err) => {
-                    (0, destroy_1.default)(stream);
-                    reject(new exceptions_1.InvalidPayloadException(err.message));
-                })
-                    .on('end', () => {
-                    saveQueue.drain(() => {
-                        return resolve();
-                    });
-                });
-                saveQueue.error((err) => {
-                    reject(err);
-                });
-            });
-        });
-    }
-}
-exports.ImportService = ImportService;