directus 9.9.1 → 9.11.1

package/dist/env.js

@@ -14,6 +14,180 @@ const lodash_1 = require("lodash");
 const path_1 = __importDefault(require("path"));
 const require_yaml_1 = require("./utils/require-yaml");
 const utils_1 = require("@directus/shared/utils");
+const parse_json_1 = require("./utils/parse-json");
+// keeping this here for now to prevent a circular import to constants.ts
+const allowedEnvironmentVars = [
+    // general
+    'CONFIG_PATH',
+    'HOST',
+    'PORT',
+    'PUBLIC_URL',
+    'LOG_LEVEL',
+    'LOG_STYLE',
+    'MAX_PAYLOAD_SIZE',
+    'ROOT_REDIRECT',
+    'SERVE_APP',
+    'GRAPHQL_INTROSPECTION',
+    // server
+    'SERVER_KEEP_ALIVE_TIMEOUT',
+    'SERVER_HEADERS_TIMEOUT',
+    // database
+    'DB_CLIENT',
+    'DB_HOST',
+    'DB_PORT',
+    'DB_DATABASE',
+    'DB_USER',
+    'DB_PASSWORD',
+    'DB_FILENAME',
+    'DB_CONNECTION_STRING',
+    'DB_POOL_.+',
+    'DB_EXCLUDE_TABLES',
+    'DB_CHARSET',
+    'DB_VERSION',
+    // security
+    'KEY',
+    'SECRET',
+    'ACCESS_TOKEN_TTL',
+    'REFRESH_TOKEN_TTL',
+    'REFRESH_TOKEN_COOKIE_DOMAIN',
+    'REFRESH_TOKEN_COOKIE_SECURE',
+    'REFRESH_TOKEN_COOKIE_SAME_SITE',
+    'REFRESH_TOKEN_COOKIE_NAME',
+    'PASSWORD_RESET_URL_ALLOW_LIST',
+    'USER_INVITE_URL_ALLOW_LIST',
+    'IP_TRUST_PROXY',
+    'IP_CUSTOM_HEADER',
+    'ASSETS_CONTENT_SECURITY_POLICY',
+    'IMPORT_IP_DENY_LIST',
+    'CONTENT_SECURITY_POLICY_.+',
+    'HSTS_.+',
+    // hashing
+    'HASH_MEMORY_COST',
+    'HASH_LENGTH',
+    'HASH_TIME_COST',
+    'HASH_PARALLELISM',
+    'HASH_TYPE',
+    'HASH_ASSOCIATED_DATA',
+    // cors
+    'CORS_ENABLED',
+    'CORS_ORIGIN',
+    'CORS_METHODS',
+    'CORS_ALLOWED_HEADERS',
+    'CORS_EXPOSED_HEADERS',
+    'CORS_CREDENTIALS',
+    'CORS_MAX_AGE',
+    // rate limiting
+    'RATE_LIMITER_ENABLED',
+    'RATE_LIMITER_POINTS',
+    'RATE_LIMITER_DURATION',
+    'RATE_LIMITER_STORE',
+    'RATE_LIMITER_REDIS',
+    'RATE_LIMITER_REDIS_HOST',
+    'RATE_LIMITER_REDIS_PORT',
+    'RATE_LIMITER_REDIS_PASSWORD',
+    'RATE_LIMITER_MEMCACHE',
+    // cache
+    'CACHE_ENABLED',
+    'CACHE_TTL',
+    'CACHE_CONTROL_S_MAXAGE',
+    'CACHE_AUTO_PURGE',
+    'CACHE_SYSTEM_TTL',
+    'CACHE_SCHEMA',
+    'CACHE_PERMISSIONS',
+    'CACHE_NAMESPACE',
+    'CACHE_STORE',
+    'CACHE_STATUS_HEADER',
+    'CACHE_REDIS',
+    'CACHE_REDIS_HOST',
+    'CACHE_REDIS_PORT',
+    'CACHE_REDIS_PASSWORD',
+    'CACHE_MEMCACHE',
+    // storage
+    'STORAGE_LOCATIONS',
+    'STORAGE_.+_DRIVER',
+    'STORAGE_.+_ROOT',
+    'STORAGE_.+_KEY',
+    'STORAGE_.+_SECRET',
+    'STORAGE_.+_BUCKET',
+    'STORAGE_.+_REGION',
+    'STORAGE_.+_ENDPOINT',
+    'STORAGE_.+_ACL',
+    'STORAGE_.+_CONTAINER_NAME',
+    'STORAGE_.+_ACCOUNT_NAME',
+    'STORAGE_.+_ACCOUNT_KEY',
+    'STORAGE_.+_ENDPOINT',
+    'STORAGE_.+_KEY_FILENAME',
+    'STORAGE_.+_BUCKET',
+    // metadata
+    'FILE_METADATA_ALLOW_LIST',
+    // assets
+    'ASSETS_CACHE_TTL',
+    'ASSETS_TRANSFORM_MAX_CONCURRENT',
+    'ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION',
+    'ASSETS_TRANSFORM_MAX_OPERATIONS',
+    'ASSETS_CONTENT_SECURITY_POLICY',
+    // auth
+    'AUTH_PROVIDERS',
+    'AUTH_DISABLE_DEFAULT',
+    'AUTH_.+_DRIVER',
+    'AUTH_.+_CLIENT_ID',
+    'AUTH_.+_CLIENT_SECRET',
+    'AUTH_.+_SCOPE',
+    'AUTH_.+_AUTHORIZE_URL',
+    'AUTH_.+_ACCESS_URL',
+    'AUTH_.+_PROFILE_URL',
+    'AUTH_.+_IDENTIFIER_KEY',
+    'AUTH_.+_EMAIL_KEY',
+    'AUTH_.+_FIRST_NAME_KEY',
+    'AUTH_.+_LAST_NAME_KEY',
+    'AUTH_.+_ALLOW_PUBLIC_REGISTRATION',
+    'AUTH_.+_DEFAULT_ROLE_ID',
+    'AUTH_.+_ICON',
+    'AUTH_.+_PARAMS',
+    'AUTH_.+_ISSUER_URL',
+    'AUTH_.+_AUTH_REQUIRE_VERIFIED_EMAIL',
+    'AUTH_.+_CLIENT_URL',
+    'AUTH_.+_BIND_DN',
+    'AUTH_.+_BIND_PASSWORD',
+    'AUTH_.+_USER_DN',
+    'AUTH_.+_USER_ATTRIBUTE',
+    'AUTH_.+_USER_SCOPE',
+    'AUTH_.+_MAIL_ATTRIBUTE',
+    'AUTH_.+_FIRST_NAME_ATTRIBUTE',
+    'AUTH_.+_LAST_NAME_ATTRIBUTE',
+    'AUTH_.+_GROUP_DN',
+    'AUTH_.+_GROUP_ATTRIBUTE',
+    'AUTH_.+_GROUP_SCOPE',
+    // extensions
+    'EXTENSIONS_PATH',
+    'EXTENSIONS_AUTO_RELOAD',
+    // emails
+    'EMAIL_FROM',
+    'EMAIL_TRANSPORT',
+    'EMAIL_SENDMAIL_NEW_LINE',
+    'EMAIL_SENDMAIL_PATH',
+    'EMAIL_SMTP_HOST',
+    'EMAIL_SMTP_PORT',
+    'EMAIL_SMTP_USER',
+    'EMAIL_SMTP_PASSWORD',
+    'EMAIL_SMTP_POOL',
+    'EMAIL_SMTP_SECURE',
+    'EMAIL_SMTP_IGNORE_TLS',
+    'EMAIL_MAILGUN_API_KEY',
+    'EMAIL_MAILGUN_DOMAIN',
+    'EMAIL_MAILGUN_HOST',
+    'EMAIL_SES_CREDENTIALS__ACCESS_KEY_ID',
+    'EMAIL_SES_CREDENTIALS__SECRET_ACCESS_KEY',
+    'EMAIL_SES_REGION',
+    // admin account
+    'ADMIN_EMAIL',
+    'ADMIN_PASSWORD',
+    // telemetry
+    'TELEMETRY',
+    // limits & optimization
+    'RELATIONAL_BATCH_SIZE',
+    'EXPORT_BATCH_SIZE',
+].map((name) => new RegExp(`^${name}$`));
 const acceptedEnvTypes = ['string', 'number', 'regex', 'array', 'json'];
 const defaults = {
     CONFIG_PATH: path_1.default.resolve(process.cwd(), '.env'),
@@ -70,6 +244,7 @@ const defaults = {
     RELATIONAL_BATCH_SIZE: 25000,
     EXPORT_BATCH_SIZE: 5000,
     FILE_METADATA_ALLOW_LIST: 'ifd0.Make,ifd0.Model,exif.FNumber,exif.ExposureTime,exif.FocalLength,exif.ISO',
+    GRAPHQL_INTROSPECTION: true,
 };
 // Allows us to force certain environment variable into a type, instead of relying
 // on the auto-parsed type in processValues. ref #3705
@@ -84,6 +259,7 @@ const typeMap = {
     DB_EXCLUDE_TABLES: 'array',
     IMPORT_IP_DENY_LIST: 'array',
     FILE_METADATA_ALLOW_LIST: 'array',
+    GRAPHQL_INTROSPECTION: 'boolean',
 };
 let env = {
     ...defaults,
@@ -177,15 +353,17 @@ function processValues(env) {
         let newKey;
         if (key.length > 5 && key.endsWith('_FILE')) {
             newKey = key.slice(0, -5);
-            if (newKey in env) {
-                throw new Error(`Duplicate environment variable encountered: you can't use "${newKey}" and "${key}" simultaneously.`);
-            }
-            try {
-                value = fs_1.default.readFileSync(value, { encoding: 'utf8' });
-                key = newKey;
-            }
-            catch {
-                throw new Error(`Failed to read value from file "${value}", defined in environment variable "${key}".`);
+            if (allowedEnvironmentVars.some((pattern) => pattern.test(newKey))) {
+                if (newKey in env) {
+                    throw new Error(`Duplicate environment variable encountered: you can't use "${newKey}" and "${key}" simultaneously.`);
+                }
+                try {
+                    value = fs_1.default.readFileSync(value, { encoding: 'utf8' });
+                    key = newKey;
+                }
+                catch {
+                    throw new Error(`Failed to read value from file "${value}", defined in environment variable "${key}".`);
+                }
             }
         }
         // Convert values with a type prefix
@@ -209,6 +387,8 @@ function processValues(env) {
                 case 'json':
                     env[key] = tryJSON(value);
                     break;
+                case 'boolean':
+                    env[key] = toBoolean(value);
             }
             continue;
         }
@@ -251,9 +431,12 @@ function processValues(env) {
 }
 function tryJSON(value) {
     try {
-        return JSON.parse(value);
+        return (0, parse_json_1.parseJSON)(value);
     }
     catch {
         return value;
     }
 }
+function toBoolean(value) {
+    return value === 'true' || value === true || value === '1' || value === 1;
+}

package/dist/exceptions/index.d.ts

@@ -7,6 +7,7 @@ export * from './invalid-credentials';
 export * from './invalid-ip';
 export * from './invalid-otp';
 export * from './invalid-payload';
+export * from './invalid-provider';
 export * from './invalid-query';
 export * from './invalid-token';
 export * from './method-not-allowed';

package/dist/exceptions/index.js

@@ -19,6 +19,7 @@ __exportStar(require("./invalid-credentials"), exports);
 __exportStar(require("./invalid-ip"), exports);
 __exportStar(require("./invalid-otp"), exports);
 __exportStar(require("./invalid-payload"), exports);
+__exportStar(require("./invalid-provider"), exports);
 __exportStar(require("./invalid-query"), exports);
 __exportStar(require("./invalid-token"), exports);
 __exportStar(require("./method-not-allowed"), exports);

package/dist/exceptions/invalid-provider.d.ts

@@ -0,0 +1,4 @@
+import { BaseException } from '@directus/shared/exceptions';
+export declare class InvalidProviderException extends BaseException {
+    constructor(message?: string);
+}

package/dist/exceptions/invalid-provider.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidProviderException = void 0;
+const exceptions_1 = require("@directus/shared/exceptions");
+class InvalidProviderException extends exceptions_1.BaseException {
+    constructor(message = 'Invalid provider.') {
+        super(message, 403, 'INVALID_PROVIDER');
+    }
+}
+exports.InvalidProviderException = InvalidProviderException;

package/dist/exceptions/range-not-satisfiable.d.ts

@@ -1,5 +1,5 @@
-import { Range } from '@directus/drive';
 import { BaseException } from '@directus/shared/exceptions';
+import { Range } from '@directus/drive';
 export declare class RangeNotSatisfiableException extends BaseException {
-    constructor(range: Range);
+    constructor(range?: Range);
 }

package/dist/exceptions/range-not-satisfiable.js

@@ -4,7 +4,11 @@ exports.RangeNotSatisfiableException = void 0;
 const exceptions_1 = require("@directus/shared/exceptions");
 class RangeNotSatisfiableException extends exceptions_1.BaseException {
     constructor(range) {
-        super(`Range "${range.start}-${range.end}" is invalid or the file's size doesn't match the requested range.`, 416, 'RANGE_NOT_SATISFIABLE');
+        var _a, _b;
+        const rangeString = range && ((range === null || range === void 0 ? void 0 : range.start) !== undefined || (range === null || range === void 0 ? void 0 : range.end) !== undefined)
+            ? `"${(_a = range.start) !== null && _a !== void 0 ? _a : ''}-${(_b = range.end) !== null && _b !== void 0 ? _b : ''}" `
+            : '';
+        super(`Range ${rangeString}is invalid or the file's size doesn't match the requested range.`, 416, 'RANGE_NOT_SATISFIABLE');
     }
 }
 exports.RangeNotSatisfiableException = RangeNotSatisfiableException;

package/dist/middleware/graphql.js

@@ -7,6 +7,7 @@ exports.parseGraphQL = void 0;
 const graphql_1 = require("graphql");
 const exceptions_1 = require("../exceptions");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
+const parse_json_1 = require("../utils/parse-json");
 exports.parseGraphQL = (0, async_handler_1.default)(async (req, res, next) => {
     if (req.method !== 'GET' && req.method !== 'POST') {
         throw new exceptions_1.MethodNotAllowedException('GraphQL only supports GET and POST requests.', { allow: ['GET', 'POST'] });
@@ -19,7 +20,7 @@ exports.parseGraphQL = (0, async_handler_1.default)(async (req, res, next) => {
         query = req.query.query || null;
         if (req.query.variables) {
             try {
-                variables = JSON.parse(req.query.variables);
+                variables = (0, parse_json_1.parseJSON)(req.query.variables);
             }
             catch {
                 throw new exceptions_1.InvalidQueryException(`Variables are invalid JSON.`);

package/dist/services/assets.js

@@ -70,9 +70,35 @@ class AssetsService {
         if (!exists)
             throw new exceptions_1.ForbiddenException();
         if (range) {
-            if (range.start >= file.filesize || (range.end && range.end >= file.filesize)) {
+            const missingRangeLimits = range.start === undefined && range.end === undefined;
+            const endBeforeStart = range.start !== undefined && range.end !== undefined && range.end <= range.start;
+            const startOverflow = range.start !== undefined && range.start >= file.filesize;
+            const endUnderflow = range.end !== undefined && range.end <= 0;
+            if (missingRangeLimits || endBeforeStart || startOverflow || endUnderflow) {
                 throw new exceptions_1.RangeNotSatisfiableException(range);
             }
+            const lastByte = file.filesize - 1;
+            if (range.end) {
+                if (range.start === undefined) {
+                    // fetch chunk from tail
+                    range.start = file.filesize - range.end;
+                    range.end = lastByte;
+                }
+                if (range.end >= file.filesize) {
+                    // fetch entire file
+                    range.end = lastByte;
+                }
+            }
+            if (range.start) {
+                if (range.end === undefined) {
+                    // fetch entire file
+                    range.end = lastByte;
+                }
+                if (range.start < 0) {
+                    // fetch file from head
+                    range.start = 0;
+                }
+            }
         }
         const type = file.type;
         const transforms = TransformationUtils.resolvePreset(transformation, file);

package/dist/services/authentication.js

@@ -45,7 +45,6 @@ class AuthenticationService {
             .from('directus_users as u')
             .leftJoin('directus_roles as r', 'u.role', 'r.id')
             .where('u.id', await provider.getUserID((0, lodash_1.cloneDeep)(payload)))
-            .andWhere('u.provider', providerName)
             .first();
         const updatedPayload = await emitter_1.default.emitFilter('auth.login', payload, {
             status: 'pending',
@@ -79,6 +78,10 @@ class AuthenticationService {
                 throw new exceptions_1.InvalidCredentialsException();
             }
         }
+        else if (user.provider !== providerName) {
+            await (0, stall_1.stall)(STALL_TIME, timeStart);
+            throw new exceptions_1.InvalidProviderException();
+        }
         const settingsService = new settings_1.SettingsService({
             knex: this.knex,
             schema: this.schema,

package/dist/services/fields.js

@@ -351,13 +351,6 @@ class FieldsService {
             });
             await this.knex.transaction(async (trx) => {
                 var _a, _b;
-                if (this.schema.collections[collection] &&
-                    field in this.schema.collections[collection].fields &&
-                    this.schema.collections[collection].fields[field].alias === false) {
-                    await trx.schema.table(collection, (table) => {
-                        table.dropColumn(field);
-                    });
-                }
                 const relations = this.schema.relations.filter((relation) => {
                     var _a;
                     return ((relation.collection === collection && relation.field === field) ||
@@ -389,6 +382,14 @@ class FieldsService {
                             .where({ many_collection: relation.collection, many_field: relation.field });
                     }
                 }
+                // Delete field only after foreign key constraints are removed
+                if (this.schema.collections[collection] &&
+                    field in this.schema.collections[collection].fields &&
+                    this.schema.collections[collection].fields[field].alias === false) {
+                    await trx.schema.table(collection, (table) => {
+                        table.dropColumn(field);
+                    });
+                }
                 const collectionMeta = await trx
                     .select('archive_field', 'sort_field')
                     .from('directus_collections')
@@ -441,7 +442,13 @@ class FieldsService {
         if (field.type === 'alias' || field.type === 'unknown')
             return;
         if ((_a = field.schema) === null || _a === void 0 ? void 0 : _a.has_auto_increment) {
-            column = table.increments(field.field);
+            if (field.type === 'bigInteger') {
+                // Create an auto-incremented big integer (MySQL, PostgreSQL) or an auto-incremented integer (other DBs)
+                column = table.bigIncrements(field.field);
+            }
+            else {
+                column = table.increments(field.field);
+            }
         }
         else if (field.type === 'string') {
             column = table.string(field.field, (_c = (_b = field.schema) === null || _b === void 0 ? void 0 : _b.max_length) !== null && _c !== void 0 ? _c : undefined);

package/dist/services/graphql.js

@@ -89,7 +89,16 @@ class GraphQLService {
     async execute({ document, variables, operationName, contextValue, }) {
         var _a;
         const schema = this.getSchema();
-        const validationErrors = (0, graphql_1.validate)(schema, document, graphql_1.specifiedRules);
+        const validationErrors = (0, graphql_1.validate)(schema, document, [
+            ...graphql_1.specifiedRules,
+            (context) => ({
+                Field(node) {
+                    if (env_1.default.GRAPHQL_INTROSPECTION === false && (node.name.value === '__schema' || node.name.value === '__type')) {
+                        context.reportError(new graphql_1.GraphQLError('GraphQL introspection is not allowed. The query contained __schema or __type.', [node]));
+                    }
+                },
+            }),
+        ]);
         if (validationErrors.length > 0) {
             throw new exceptions_1.GraphQLValidationException({ graphqlErrors: validationErrors });
         }
@@ -161,16 +170,7 @@ class GraphQLService {
                 acc[collectionName] = ReadCollectionTypes[collection.collection].getResolver(collection.collection);
                 if (this.schema.collections[collection.collection].singleton === false) {
                     acc[`${collectionName}_by_id`] = ReadCollectionTypes[collection.collection].getResolver(`${collection.collection}_by_id`);
-                    const hasAggregate = Object.values(collection.fields).some((field) => {
-                        const graphqlType = (0, get_graphql_type_1.getGraphQLType)(field.type);
-                        if (graphqlType === graphql_1.GraphQLInt || graphqlType === graphql_1.GraphQLFloat) {
-                            return true;
-                        }
-                        return false;
-                    });
-                    if (hasAggregate) {
-                        acc[`${collectionName}_aggregated`] = ReadCollectionTypes[collection.collection].getResolver(`${collection.collection}_aggregated`);
-                    }
+                    acc[`${collectionName}_aggregated`] = ReadCollectionTypes[collection.collection].getResolver(`${collection.collection}_aggregated`);
                 }
                 return acc;
             }, {}));
@@ -415,7 +415,8 @@ class GraphQLService {
             const { CollectionTypes: ReadCollectionTypes } = getTypes('read');
             const ReadableCollectionFilterTypes = {};
             const AggregatedFunctions = {};
-            const AggregatedFilters = {};
+            const AggregatedFields = {};
+            const AggregateMethods = {};
             const StringFilterOperators = schemaComposer.createInputTC({
                 name: 'string_filter_operators',
                 fields: {
@@ -671,7 +672,7 @@ class GraphQLService {
                     _and: [ReadableCollectionFilterTypes[collection.collection]],
                     _or: [ReadableCollectionFilterTypes[collection.collection]],
                 });
-                AggregatedFilters[collection.collection] = schemaComposer.createObjectTC({
+                AggregatedFields[collection.collection] = schemaComposer.createObjectTC({
                     name: `${collection.collection}_aggregated_fields`,
                     fields: Object.values(collection.fields).reduce((acc, field) => {
                         const graphqlType = (0, get_graphql_type_1.getGraphQLType)(field.type);
@@ -689,46 +690,71 @@ class GraphQLService {
                         return acc;
                     }, {}),
                 });
-                AggregatedFunctions[collection.collection] = schemaComposer.createObjectTC({
-                    name: `${collection.collection}_aggregated`,
-                    fields: {
-                        group: {
-                            name: 'group',
-                            type: graphql_compose_1.GraphQLJSON,
-                        },
+                AggregateMethods[collection.collection] = {
+                    group: {
+                        name: 'group',
+                        type: graphql_compose_1.GraphQLJSON,
+                    },
+                    countAll: {
+                        name: 'countAll',
+                        type: graphql_1.GraphQLInt,
+                    },
+                    count: {
+                        name: 'count',
+                        type: schemaComposer.createObjectTC({
+                            name: `${collection.collection}_aggregated_count`,
+                            fields: Object.values(collection.fields).reduce((acc, field) => {
+                                acc[field.field] = {
+                                    type: graphql_1.GraphQLInt,
+                                    description: field.note,
+                                };
+                                return acc;
+                            }, {}),
+                        }),
+                    },
+                };
+                const hasNumericAggregates = Object.values(collection.fields).some((field) => {
+                    const graphqlType = (0, get_graphql_type_1.getGraphQLType)(field.type);
+                    if (graphqlType === graphql_1.GraphQLInt || graphqlType === graphql_1.GraphQLFloat) {
+                        return true;
+                    }
+                    return false;
+                });
+                if (hasNumericAggregates) {
+                    Object.assign(AggregateMethods[collection.collection], {
                         avg: {
                             name: 'avg',
-                            type: AggregatedFilters[collection.collection],
+                            type: AggregatedFields[collection.collection],
                         },
                         sum: {
                             name: 'sum',
-                            type: AggregatedFilters[collection.collection],
-                        },
-                        count: {
-                            name: 'count',
-                            type: AggregatedFilters[collection.collection],
+                            type: AggregatedFields[collection.collection],
                         },
                         countDistinct: {
                             name: 'countDistinct',
-                            type: AggregatedFilters[collection.collection],
+                            type: AggregatedFields[collection.collection],
                         },
                         avgDistinct: {
                             name: 'avgDistinct',
-                            type: AggregatedFilters[collection.collection],
+                            type: AggregatedFields[collection.collection],
                         },
                         sumDistinct: {
                             name: 'sumDistinct',
-                            type: AggregatedFilters[collection.collection],
+                            type: AggregatedFields[collection.collection],
                         },
                         min: {
                             name: 'min',
-                            type: AggregatedFilters[collection.collection],
+                            type: AggregatedFields[collection.collection],
                         },
                         max: {
                             name: 'max',
-                            type: AggregatedFilters[collection.collection],
+                            type: AggregatedFields[collection.collection],
                         },
-                    },
+                    });
+                }
+                AggregatedFunctions[collection.collection] = schemaComposer.createObjectTC({
+                    name: `${collection.collection}_aggregated`,
+                    fields: AggregateMethods[collection.collection],
                 });
                 ReadCollectionTypes[collection.collection].addResolver({
                     name: collection.collection,
@@ -1228,7 +1254,7 @@ class GraphQLService {
                         if (!query.deep)
                             query.deep = {};
                         const args = this.parseArgs(selection.arguments, variableValues);
-                        (0, lodash_1.set)(query.deep, current, (0, lodash_1.merge)((0, lodash_1.get)(query.deep, current), (0, lodash_1.mapKeys)((0, sanitize_query_1.sanitizeQuery)(args, this.accountability), (value, key) => `_${key}`)));
+                        (0, lodash_1.set)(query.deep, currentAlias !== null && currentAlias !== void 0 ? currentAlias : current, (0, lodash_1.merge)((0, lodash_1.get)(query.deep, currentAlias !== null && currentAlias !== void 0 ? currentAlias : current), (0, lodash_1.mapKeys)((0, sanitize_query_1.sanitizeQuery)(args, this.accountability), (value, key) => `_${key}`)));
                     }
                 }
             }
@@ -1287,8 +1313,10 @@ class GraphQLService {
      */
     formatError(error) {
         if (Array.isArray(error)) {
+            error[0].extensions.code = error[0].code;
             return new graphql_1.GraphQLError(error[0].message, undefined, undefined, undefined, undefined, error[0]);
         }
+        error.extensions.code = error.code;
         return new graphql_1.GraphQLError(error.message, undefined, undefined, undefined, undefined, error);
     }
     /**

package/dist/services/import-export.d.ts

@@ -1,7 +1,7 @@
 /// <reference types="node" />
+import { Accountability, Query, SchemaOverview } from '@directus/shared/types';
 import { Knex } from 'knex';
 import { AbstractServiceOptions, File } from '../types';
-import { Accountability, Query, SchemaOverview } from '@directus/shared/types';
 export declare class ImportService {
     knex: Knex;
     accountability: Accountability | null;

package/dist/services/import-export.js

@@ -4,24 +4,26 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ExportService = exports.ImportService = void 0;
-const database_1 = __importDefault(require("../database"));
-const exceptions_1 = require("../exceptions");
-const StreamArray_1 = __importDefault(require("stream-json/streamers/StreamArray"));
-const items_1 = require("./items");
+const utils_1 = require("@directus/shared/utils");
 const async_1 = require("async");
-const destroy_1 = __importDefault(require("destroy"));
 const csv_parser_1 = __importDefault(require("csv-parser"));
-const lodash_1 = require("lodash");
+const destroy_1 = __importDefault(require("destroy"));
+const fs_extra_1 = require("fs-extra");
 const js2xmlparser_1 = require("js2xmlparser");
 const json2csv_1 = require("json2csv");
-const fs_extra_1 = require("fs-extra");
+const lodash_1 = require("lodash");
+const StreamArray_1 = __importDefault(require("stream-json/streamers/StreamArray"));
+const strip_bom_stream_1 = __importDefault(require("strip-bom-stream"));
 const tmp_promise_1 = require("tmp-promise");
+const database_1 = __importDefault(require("../database"));
 const env_1 = __importDefault(require("../env"));
-const files_1 = require("./files");
+const exceptions_1 = require("../exceptions");
+const logger_1 = __importDefault(require("../logger"));
 const get_date_formatted_1 = require("../utils/get-date-formatted");
-const utils_1 = require("@directus/shared/utils");
+const parse_json_1 = require("../utils/parse-json");
+const files_1 = require("./files");
+const items_1 = require("./items");
 const notifications_1 = require("./notifications");
-const logger_1 = __importDefault(require("../logger"));
 class ImportService {
     constructor(options) {
         this.knex = options.knex || (0, database_1.default)();
@@ -91,6 +93,7 @@ class ImportService {
             });
             return new Promise((resolve, reject) => {
                 stream
+                    .pipe((0, strip_bom_stream_1.default)())
                     .pipe((0, csv_parser_1.default)())
                     .on('data', (value) => {
                     const obj = (0, lodash_1.transform)(value, (result, value, key) => {
@@ -99,7 +102,7 @@ class ImportService {
                         }
                         else {
                             try {
-                                const parsedJson = JSON.parse(value);
+                                const parsedJson = (0, parse_json_1.parseJSON)(value);
                                 (0, lodash_1.set)(result, key, parsedJson);
                             }
                             catch {

package/dist/services/items.d.ts

@@ -1,7 +1,7 @@
-import { Knex } from 'knex';
+import { Accountability, PermissionsAction, Query, SchemaOverview } from '@directus/shared/types';
 import Keyv from 'keyv';
-import { Accountability, Query, PermissionsAction, SchemaOverview } from '@directus/shared/types';
-import { AbstractService, AbstractServiceOptions, Item as AnyItem, PrimaryKey, MutationOptions } from '../types';
+import { Knex } from 'knex';
+import { AbstractService, AbstractServiceOptions, Item as AnyItem, MutationOptions, PrimaryKey } from '../types';
 export declare type QueryOptions = {
     stripNonRequested?: boolean;
     permissionsAction?: PermissionsAction;