directus

1
import { ErrorCode, isDirectusError } from '@directus/errors';
2
import type { PrimaryKey } from '@directus/types';
3
import express from 'express';
4
import { respond } from '../middleware/respond.js';
5
import useCollection from '../middleware/use-collection.js';
6
import { validateBatch } from '../middleware/validate-batch.js';
7
import { MetaService } from '../services/meta.js';
8
import { PermissionsService } from '../services/permissions/index.js';
9
import asyncHandler from '../utils/async-handler.js';
10
import { sanitizeQuery } from '../utils/sanitize-query.js';
11

12
const router = express.Router();
13

14
router.use(useCollection('directus_permissions'));
15

16
router.post(
17
	'/',
18
	asyncHandler(async (req, res, next) => {
19
		const service = new PermissionsService({
20
			accountability: req.accountability,
21
			schema: req.schema,
22
		});
23

24
		const savedKeys: PrimaryKey[] = [];
25

26
		if (Array.isArray(req.body)) {
27
			const keys = await service.createMany(req.body);
28
			savedKeys.push(...keys);
29
		} else {
30
			const key = await service.createOne(req.body);
31
			savedKeys.push(key);
32
		}
33

34
		try {
35
			if (Array.isArray(req.body)) {
36
				const items = await service.readMany(savedKeys, req.sanitizedQuery);
37
				res.locals['payload'] = { data: items };
38
			} else {
39
				const item = await service.readOne(savedKeys[0]!, req.sanitizedQuery);
40
				res.locals['payload'] = { data: item };
41
			}
42
		} catch (error: any) {
43
			if (isDirectusError(error, ErrorCode.Forbidden)) {
44
				return next();
45
			}
46

47
			throw error;
48
		}
49

50
		return next();
51
	}),
52
	respond,
53
);
54

55
const readHandler = asyncHandler(async (req, res, next) => {
56
	const service = new PermissionsService({
57
		accountability: req.accountability,
58
		schema: req.schema,
59
	});
60

61
	const metaService = new MetaService({
62
		accountability: req.accountability,
63
		schema: req.schema,
64
	});
65

66
	let result;
67

68
	// TODO fix this at the service level
69
	// temporary fix for missing permissions https://github.com/directus/directus/issues/18654
70
	const temporaryQuery = { ...req.sanitizedQuery, limit: -1 };
71

72
	if (req.singleton) {
73
		result = await service.readSingleton(temporaryQuery);
74
	} else if (req.body.keys) {
75
		result = await service.readMany(req.body.keys, temporaryQuery);
76
	} else {
77
		result = await service.readByQuery(temporaryQuery);
78
	}
79

80
	const meta = await metaService.getMetaForQuery('directus_permissions', temporaryQuery);
81

82
	res.locals['payload'] = { data: result, meta };
83
	return next();
84
});
85

86
router.get('/', validateBatch('read'), readHandler, respond);
87
router.search('/', validateBatch('read'), readHandler, respond);
88

89
router.get(
90
	'/:pk',
91
	asyncHandler(async (req, res, next) => {
92
		if (req.path.endsWith('me')) return next();
93

94
		const service = new PermissionsService({
95
			accountability: req.accountability,
96
			schema: req.schema,
97
		});
98

99
		const record = await service.readOne(req.params['pk']!, req.sanitizedQuery);
100

101
		res.locals['payload'] = { data: record };
102
		return next();
103
	}),
104
	respond,
105
);
106

107
router.patch(
108
	'/',
109
	validateBatch('update'),
110
	asyncHandler(async (req, res, next) => {
111
		const service = new PermissionsService({
112
			accountability: req.accountability,
113
			schema: req.schema,
114
		});
115

116
		let keys: PrimaryKey[] = [];
117

118
		if (Array.isArray(req.body)) {
119
			keys = await service.updateBatch(req.body);
120
		} else if (req.body.keys) {
121
			keys = await service.updateMany(req.body.keys, req.body.data);
122
		} else {
123
			const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
124
			keys = await service.updateByQuery(sanitizedQuery, req.body.data);
125
		}
126

127
		try {
128
			const result = await service.readMany(keys, req.sanitizedQuery);
129
			res.locals['payload'] = { data: result };
130
		} catch (error: any) {
131
			if (isDirectusError(error, ErrorCode.Forbidden)) {
132
				return next();
133
			}
134

135
			throw error;
136
		}
137

138
		return next();
139
	}),
140
	respond,
141
);
142

143
router.patch(
144
	'/:pk',
145
	asyncHandler(async (req, res, next) => {
146
		const service = new PermissionsService({
147
			accountability: req.accountability,
148
			schema: req.schema,
149
		});
150

151
		const primaryKey = await service.updateOne(req.params['pk']!, req.body);
152

153
		try {
154
			const item = await service.readOne(primaryKey, req.sanitizedQuery);
155
			res.locals['payload'] = { data: item || null };
156
		} catch (error: any) {
157
			if (isDirectusError(error, ErrorCode.Forbidden)) {
158
				return next();
159
			}
160

161
			throw error;
162
		}
163

164
		return next();
165
	}),
166
	respond,
167
);
168

169
router.delete(
170
	'/',
171
	validateBatch('delete'),
172
	asyncHandler(async (req, _res, next) => {
173
		const service = new PermissionsService({
174
			accountability: req.accountability,
175
			schema: req.schema,
176
		});
177

178
		if (Array.isArray(req.body)) {
179
			await service.deleteMany(req.body);
180
		} else if (req.body.keys) {
181
			await service.deleteMany(req.body.keys);
182
		} else {
183
			const sanitizedQuery = sanitizeQuery(req.body.query, req.accountability);
184
			await service.deleteByQuery(sanitizedQuery);
185
		}
186

187
		return next();
188
	}),
189
	respond,
190
);
191

192
router.delete(
193
	'/:pk',
194
	asyncHandler(async (req, _res, next) => {
195
		const service = new PermissionsService({
196
			accountability: req.accountability,
197
			schema: req.schema,
198
		});
199

200
		await service.deleteOne(req.params['pk']!);
201

202
		return next();
203
	}),
204
	respond,
205
);
206

207
router.get(
208
	'/me/:collection/:pk?',
209
	asyncHandler(async (req, res, next) => {
210
		const { collection, pk } = req.params;
211

212
		const service = new PermissionsService({
213
			accountability: req.accountability,
214
			schema: req.schema,
215
		});
216

217
		const itemPermissions = await service.getItemPermissions(collection!, pk);
218

219
		res.locals['payload'] = { data: itemPermissions };
220

221
		return next();
222
	}),
223
	respond,
224
);
225

226
export default router;
227