directus 9.6.0 → 9.8.0

package/dist/services/authorization.js

@@ -4,14 +4,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthorizationService = void 0;
+const exceptions_1 = require("@directus/shared/exceptions");
+const utils_1 = require("@directus/shared/utils");
 const lodash_1 = require("lodash");
 const database_1 = __importDefault(require("../database"));
-const exceptions_1 = require("../exceptions");
-const exceptions_2 = require("@directus/shared/exceptions");
-const utils_1 = require("@directus/shared/utils");
+const exceptions_2 = require("../exceptions");
+const strip_function_1 = require("../utils/strip-function");
 const items_1 = require("./items");
 const payload_1 = require("./payload");
-const strip_function_1 = require("../utils/strip-function");
 class AuthorizationService {
     constructor(options) {
         this.knex = options.knex || (0, database_1.default)();
@@ -32,9 +32,10 @@ class AuthorizationService {
         // If the permissions don't match the collections, you don't have permission to read all of them
         const uniqueCollectionsRequestedCount = (0, lodash_1.uniq)(collectionsRequested.map(({ collection }) => collection)).length;
         if (uniqueCollectionsRequestedCount !== permissionsForCollections.length) {
-            throw new exceptions_1.ForbiddenException();
+            throw new exceptions_2.ForbiddenException();
         }
         validateFields(ast);
+        validateFilterPermissions(ast, this.schema, this.accountability);
         applyFilters(ast, this.accountability);
         return ast;
         /**
@@ -87,7 +88,7 @@ class AuthorizationService {
                             continue;
                         for (const column of Object.values(aliasMap)) {
                             if (allowedFields.includes(column) === false)
-                                throw new exceptions_1.ForbiddenException();
+                                throw new exceptions_2.ForbiddenException();
                         }
                     }
                 }
@@ -100,7 +101,136 @@ class AuthorizationService {
                         continue;
                     const fieldKey = (0, strip_function_1.stripFunction)(childNode.name);
                     if (allowedFields.includes(fieldKey) === false) {
-                        throw new exceptions_1.ForbiddenException();
+                        throw new exceptions_2.ForbiddenException();
+                    }
+                }
+            }
+        }
+        function validateFilterPermissions(ast, schema, accountability) {
+            var _a, _b, _c, _d, _e;
+            let requiredFieldPermissions = {};
+            if (ast.type !== 'field') {
+                if (ast.type === 'a2o') {
+                    for (const collection of Object.keys(ast.children)) {
+                        requiredFieldPermissions = mergeRequiredFieldPermissions(requiredFieldPermissions, extractRequiredFieldPermissions(collection, (_c = (_b = (_a = ast.query) === null || _a === void 0 ? void 0 : _a[collection]) === null || _b === void 0 ? void 0 : _b.filter) !== null && _c !== void 0 ? _c : {}));
+                        for (const child of ast.children[collection]) {
+                            // Always add relational field as a deep child may have a filter
+                            if (child.type !== 'field') {
+                                (requiredFieldPermissions[collection] || (requiredFieldPermissions[collection] = new Set())).add(child.fieldKey);
+                            }
+                            requiredFieldPermissions = mergeRequiredFieldPermissions(requiredFieldPermissions, validateFilterPermissions(child, schema, accountability));
+                        }
+                    }
+                }
+                else {
+                    requiredFieldPermissions = mergeRequiredFieldPermissions(requiredFieldPermissions, extractRequiredFieldPermissions(ast.name, (_e = (_d = ast.query) === null || _d === void 0 ? void 0 : _d.filter) !== null && _e !== void 0 ? _e : {}));
+                    for (const child of ast.children) {
+                        // Always add relational field as a deep child may have a filter
+                        if (child.type !== 'field') {
+                            (requiredFieldPermissions[ast.name] || (requiredFieldPermissions[ast.name] = new Set())).add(child.fieldKey);
+                        }
+                        requiredFieldPermissions = mergeRequiredFieldPermissions(requiredFieldPermissions, validateFilterPermissions(child, schema, accountability));
+                    }
+                }
+            }
+            if (ast.type === 'root') {
+                // Validate all required permissions once at the root level
+                checkFieldPermissions(requiredFieldPermissions);
+            }
+            return requiredFieldPermissions;
+            function extractRequiredFieldPermissions(collection, filter, parentCollection, parentField) {
+                return (0, lodash_1.reduce)(filter, function (result, filterValue, filterKey) {
+                    if (filterKey.startsWith('_')) {
+                        if (filterKey === '_and' || filterKey === '_or') {
+                            if ((0, lodash_1.isArray)(filterValue)) {
+                                for (const filter of filterValue) {
+                                    const requiredPermissions = extractRequiredFieldPermissions(collection, filter, parentCollection, parentField);
+                                    result = mergeRequiredFieldPermissions(result, requiredPermissions);
+                                }
+                            }
+                            return result;
+                        }
+                        // Filter value is not a filter, so we should skip it
+                        return result;
+                    }
+                    else {
+                        if (collection) {
+                            (result[collection] || (result[collection] = new Set())).add(filterKey);
+                        }
+                        else {
+                            const relation = schema.relations.find((relation) => {
+                                var _a;
+                                return ((relation.collection === parentCollection && relation.field === parentField) ||
+                                    (relation.related_collection === parentCollection && ((_a = relation.meta) === null || _a === void 0 ? void 0 : _a.one_field) === parentField));
+                            });
+                            if (relation) {
+                                if (relation.related_collection === parentCollection) {
+                                    (result[relation.collection] || (result[relation.collection] = new Set())).add(filterKey);
+                                    parentCollection = relation.collection;
+                                }
+                                else {
+                                    (result[relation.related_collection] || (result[relation.related_collection] = new Set())).add(filterKey);
+                                    parentCollection = relation.related_collection;
+                                }
+                            }
+                            else {
+                                // Filter key not found in parent collection
+                                throw new exceptions_2.ForbiddenException();
+                            }
+                        }
+                        if (typeof filterValue === 'object') {
+                            // Parent collection is undefined when we process the top level filter
+                            if (!parentCollection)
+                                parentCollection = collection;
+                            for (const [childFilterKey, childFilterValue] of Object.entries(filterValue)) {
+                                if (childFilterKey.startsWith('_')) {
+                                    if (childFilterKey === '_and' || childFilterKey === '_or') {
+                                        if ((0, lodash_1.isArray)(childFilterValue)) {
+                                            for (const filter of childFilterValue) {
+                                                const requiredPermissions = extractRequiredFieldPermissions('', filter, parentCollection, filterKey);
+                                                result = mergeRequiredFieldPermissions(result, requiredPermissions);
+                                            }
+                                        }
+                                    }
+                                }
+                                else {
+                                    const requiredPermissions = extractRequiredFieldPermissions('', filterValue, parentCollection, filterKey);
+                                    result = mergeRequiredFieldPermissions(result, requiredPermissions);
+                                }
+                            }
+                        }
+                    }
+                    return result;
+                }, {});
+            }
+            function mergeRequiredFieldPermissions(current, child) {
+                for (const collection of Object.keys(child)) {
+                    if (!current[collection]) {
+                        current[collection] = child[collection];
+                    }
+                    else {
+                        current[collection] = new Set([...current[collection], ...child[collection]]);
+                    }
+                }
+                return current;
+            }
+            function checkFieldPermissions(requiredPermissions) {
+                var _a;
+                if ((accountability === null || accountability === void 0 ? void 0 : accountability.admin) === true)
+                    return;
+                for (const collection of Object.keys(requiredPermissions)) {
+                    const permission = (_a = accountability === null || accountability === void 0 ? void 0 : accountability.permissions) === null || _a === void 0 ? void 0 : _a.find((permission) => permission.collection === collection && permission.action === 'read');
+                    if (!permission || !permission.fields)
+                        throw new exceptions_2.ForbiddenException();
+                    const allowedFields = permission.fields;
+                    if (allowedFields.includes('*'))
+                        continue;
+                    // Allow legacy permissions with an empty fields array, where id can be accessed
+                    if (allowedFields.length === 0)
+                        allowedFields.push('id');
+                    for (const field of requiredPermissions[collection]) {
+                        if (!allowedFields.includes(field))
+                            throw new exceptions_2.ForbiddenException();
                     }
                 }
             }
@@ -164,20 +294,24 @@ class AuthorizationService {
                 return permission.collection === collection && permission.action === action;
             });
             if (!permission)
-                throw new exceptions_1.ForbiddenException();
+                throw new exceptions_2.ForbiddenException();
             // Check if you have permission to access the fields you're trying to access
             const allowedFields = permission.fields || [];
             if (allowedFields.includes('*') === false) {
                 const keysInData = Object.keys(payload);
                 const invalidKeys = keysInData.filter((fieldKey) => allowedFields.includes(fieldKey) === false);
                 if (invalidKeys.length > 0) {
-                    throw new exceptions_1.ForbiddenException();
+                    throw new exceptions_2.ForbiddenException();
                 }
             }
         }
         const preset = (_e = permission.presets) !== null && _e !== void 0 ? _e : {};
         const payloadWithPresets = (0, lodash_1.merge)({}, preset, payload);
+        const fieldValidationRules = Object.values(this.schema.collections[collection].fields)
+            .map((field) => field.validation)
+            .filter((v) => v);
         const hasValidationRules = (0, lodash_1.isNil)(permission.validation) === false && Object.keys((_f = permission.validation) !== null && _f !== void 0 ? _f : {}).length > 0;
+        const hasFieldValidationRules = fieldValidationRules && fieldValidationRules.length > 0;
         const requiredColumns = [];
         for (const field of Object.values(this.schema.collections[collection].fields)) {
             const specials = (_g = field === null || field === void 0 ? void 0 : field.special) !== null && _g !== void 0 ? _g : [];
@@ -187,7 +321,7 @@ class AuthorizationService {
                 requiredColumns.push(field);
             }
         }
-        if (hasValidationRules === false && requiredColumns.length === 0) {
+        if (hasValidationRules === false && hasFieldValidationRules === false && requiredColumns.length === 0) {
             return payloadWithPresets;
         }
         if (requiredColumns.length > 0) {
@@ -207,8 +341,16 @@ class AuthorizationService {
                 });
             }
         }
+        if (hasFieldValidationRules) {
+            if (permission.validation) {
+                permission.validation = { _and: [permission.validation, ...fieldValidationRules] };
+            }
+            else {
+                permission.validation = { _and: fieldValidationRules };
+            }
+        }
         const validationErrors = [];
-        validationErrors.push(...(0, lodash_1.flatten)((0, utils_1.validatePayload)(permission.validation, payloadWithPresets).map((error) => error.details.map((details) => new exceptions_2.FailedValidationException(details)))));
+        validationErrors.push(...(0, lodash_1.flatten)((0, utils_1.validatePayload)(permission.validation, payloadWithPresets).map((error) => error.details.map((details) => new exceptions_1.FailedValidationException(details)))));
         if (validationErrors.length > 0)
             throw validationErrors;
         return payloadWithPresets;
@@ -228,14 +370,14 @@ class AuthorizationService {
         if (Array.isArray(pk)) {
             const result = await itemsService.readMany(pk, { ...query, limit: pk.length }, { permissionsAction: action });
             if (!result)
-                throw new exceptions_1.ForbiddenException();
+                throw new exceptions_2.ForbiddenException();
             if (result.length !== pk.length)
-                throw new exceptions_1.ForbiddenException();
+                throw new exceptions_2.ForbiddenException();
         }
         else {
             const result = await itemsService.readOne(pk, query, { permissionsAction: action });
             if (!result)
-                throw new exceptions_1.ForbiddenException();
+                throw new exceptions_2.ForbiddenException();
         }
     }
 }