@directus/api/dist/controllers/permissions.js

Directus is a real-time API and App dashboard for managing SQL database content

import async_handler_default from "../utils/async-handler.js";
import database_default from "../database/index.js";
import { respond } from "../middleware/respond.js";
import { fetchAccountabilityCollectionAccess } from "../permissions/modules/fetch-accountability-collection-access/fetch-accountability-collection-access.js";
import { sanitizeQuery } from "../utils/sanitize-query.js";
import { MetaService } from "../services/meta.js";
import { PermissionsService } from "../services/permissions.js";
import use_collection_default from "../middleware/use-collection.js";
import { validateBatch } from "../middleware/validate-batch.js";
import { ErrorCode, ForbiddenError, isDirectusError } from "@directus/errors";
import express from "express";

//#region src/controllers/permissions.ts
const router = express.Router();
router.use(use_collection_default("directus_permissions"));
router.post("/", async_handler_default(async (req, res, next) => {
	const service = new PermissionsService({
		accountability: req.accountability,
		schema: req.schema
	});
	const savedKeys = [];
	if (Array.isArray(req.body)) {
		const keys = await service.createMany(req.body);
		savedKeys.push(...keys);
	} else {
		const key = await service.createOne(req.body);
		savedKeys.push(key);
	}
	try {
		if (Array.isArray(req.body)) {
			const items = await service.readMany(savedKeys, req.sanitizedQuery);
			res.locals["payload"] = { data: items };
		} else {
			const item = await service.readOne(savedKeys[0], req.sanitizedQuery);
			res.locals["payload"] = { data: item };
		}
	} catch (error) {
		if (isDirectusError(error, ErrorCode.Forbidden)) return next();
		throw error;
	}
	return next();
}), respond);
const readHandler = async_handler_default(async (req, res, next) => {
	const service = new PermissionsService({
		accountability: req.accountability,
		schema: req.schema
	});
	const metaService = new MetaService({
		accountability: req.accountability,
		schema: req.schema
	});
	let result;
	const temporaryQuery = {
		...req.sanitizedQuery,
		limit: -1
	};
	if (req.singleton) result = await service.readSingleton(temporaryQuery);
	else if (req.body.keys) result = await service.readMany(req.body.keys, temporaryQuery);
	else result = await service.readByQuery(temporaryQuery);
	const meta = await metaService.getMetaForQuery("directus_permissions", temporaryQuery);
	res.locals["payload"] = {
		data: result,
		meta
	};
	return next();
});
router.get("/", validateBatch("read"), readHandler, respond);
router.search("/", validateBatch("read"), readHandler, respond);
router.get("/me", async_handler_default(async (req, res, next) => {
	if (!req.accountability?.user && !req.accountability?.role && !req.accountability?.share) throw new ForbiddenError();
	const result = await fetchAccountabilityCollectionAccess(req.accountability, {
		schema: req.schema,
		knex: database_default()
	});
	res.locals["payload"] = { data: result };
	return next();
}), respond);
router.get("/:pk", async_handler_default(async (req, res, next) => {
	if (req.path.endsWith("me")) return next();
	const record = await new PermissionsService({
		accountability: req.accountability,
		schema: req.schema
	}).readOne(req.params["pk"], req.sanitizedQuery);
	res.locals["payload"] = { data: record };
	return next();
}), respond);
router.patch("/", validateBatch("update"), async_handler_default(async (req, res, next) => {
	const service = new PermissionsService({
		accountability: req.accountability,
		schema: req.schema
	});
	let keys = [];
	if (Array.isArray(req.body)) keys = await service.updateBatch(req.body);
	else if (req.body.keys) keys = await service.updateMany(req.body.keys, req.body.data);
	else {
		const sanitizedQuery = await sanitizeQuery(req.body.query, req.schema, req.accountability);
		keys = await service.updateByQuery(sanitizedQuery, req.body.data);
	}
	try {
		const result = await service.readMany(keys, req.sanitizedQuery);
		res.locals["payload"] = { data: result };
	} catch (error) {
		if (isDirectusError(error, ErrorCode.Forbidden)) return next();
		throw error;
	}
	return next();
}), respond);
router.patch("/:pk", async_handler_default(async (req, res, next) => {
	const service = new PermissionsService({
		accountability: req.accountability,
		schema: req.schema
	});
	const primaryKey = await service.updateOne(req.params["pk"], req.body);
	try {
		const item = await service.readOne(primaryKey, req.sanitizedQuery);
		res.locals["payload"] = { data: item || null };
	} catch (error) {
		if (isDirectusError(error, ErrorCode.Forbidden)) return next();
		throw error;
	}
	return next();
}), respond);
router.delete("/", validateBatch("delete"), async_handler_default(async (req, _res, next) => {
	const service = new PermissionsService({
		accountability: req.accountability,
		schema: req.schema
	});
	if (Array.isArray(req.body)) await service.deleteMany(req.body);
	else if (req.body.keys) await service.deleteMany(req.body.keys);
	else {
		const sanitizedQuery = await sanitizeQuery(req.body.query, req.schema, req.accountability);
		await service.deleteByQuery(sanitizedQuery);
	}
	return next();
}), respond);
router.delete("/:pk", async_handler_default(async (req, _res, next) => {
	await new PermissionsService({
		accountability: req.accountability,
		schema: req.schema
	}).deleteOne(req.params["pk"]);
	return next();
}), respond);
router.get("/me/:collection/:pk?", async_handler_default(async (req, res, next) => {
	const { collection, pk } = req.params;
	const itemPermissions = await new PermissionsService({
		accountability: req.accountability,
		schema: req.schema
	}).getItemPermissions(collection, pk);
	res.locals["payload"] = { data: itemPermissions };
	return next();
}), respond);
var permissions_default = router;

//#endregion
export { permissions_default as default };