Overlapping policies allow update to non-allowed fields in directus

@@ -1,7 +1,8 @@
 import { useEnv } from '@directus/env';
-import type { Filter, Permission, Query, SchemaOverview } from '@directus/types';
+import type { Filter, Permission, Query } from '@directus/types';
 import type { Knex } from 'knex';
 import { cloneDeep } from 'lodash-es';
+import type { Context } from '../../../permissions/types.js';
 import type { FieldNode, FunctionFieldNode, O2MNode } from '../../../types/ast.js';
 import type { ColumnSortRecord } from '../../../utils/apply-query.js';
 import applyQuery, { applyLimit, applySort, generateAlias } from '../../../utils/apply-query.js';
@@ -15,19 +16,23 @@ import { getNodeAlias } from '../utils/get-field-alias.js';
 import { getInnerQueryColumnPreProcessor } from '../utils/get-inner-query-column-pre-processor.js';
 import { withPreprocessBindings } from '../utils/with-preprocess-bindings.js';
 
+export type DBQueryOptions = {
+	table: string;
+	fieldNodes: (FieldNode | FunctionFieldNode)[];
+	o2mNodes: O2MNode[];
+	query: Query;
+	cases: Filter[];
+	permissions: Permission[];
+	permissionsOnly?: boolean;
+};
+
 export function getDBQuery(
-	schema: SchemaOverview,
-	knex: Knex,
-	table: string,
-	fieldNodes: (FieldNode | FunctionFieldNode)[],
-	o2mNodes: O2MNode[],
-	query: Query,
-	cases: Filter[],
-	permissions: Permission[],
+	{ table, fieldNodes, o2mNodes, query, cases, permissions, permissionsOnly }: DBQueryOptions,
+	{ knex, schema }: Context,
 ): Knex.QueryBuilder {
 	const aliasMap: AliasMap = Object.create(null);
 	const env = useEnv();
-	const preProcess = getColumnPreprocessor(knex, schema, table, cases, permissions, aliasMap);
+	const preProcess = getColumnPreprocessor(knex, schema, table, cases, permissions, aliasMap, permissionsOnly);
 	const queryCopy = cloneDeep(query);
 	const helpers = getHelpers(knex);
 

@@ -0,0 +1,50 @@
+import type { Accountability, Permission, SchemaOverview } from '@directus/types';
+import type { Knex } from 'knex';
+import { cloneDeep } from 'lodash-es';
+import { fetchPermissions } from '../../../permissions/lib/fetch-permissions.js';
+import { fetchPolicies } from '../../../permissions/lib/fetch-policies.js';
+import type { AST } from '../../../types/ast.js';
+import { getDBQuery } from '../lib/get-db-query.js';
+import { parseCurrentLevel } from '../lib/parse-current-level.js';
+
+type FetchPermittedAstRootFieldsOptions = {
+	schema: SchemaOverview;
+	accountability: Accountability;
+	knex: Knex;
+};
+
+/**
+ * Fetch the permitted top level fields of a given root type AST using a case/when query that is constructed the
+ * same way as `runAst` but only returns flags (1/null) instead of actual field values.
+ */
+export async function fetchPermittedAstRootFields(
+	originalAST: AST,
+	{ schema, accountability, knex }: FetchPermittedAstRootFieldsOptions,
+) {
+	const ast = cloneDeep(originalAST);
+
+	const { name: collection, children, cases, query } = ast;
+
+	// Retrieve the database columns to select in the current AST
+	const { fieldNodes } = await parseCurrentLevel(schema, collection, children, query);
+
+	let permissions: Permission[] = [];
+
+	if (accountability && !accountability.admin) {
+		const policies = await fetchPolicies(accountability, { schema, knex });
+		permissions = await fetchPermissions({ action: 'read', accountability, policies }, { schema, knex });
+	}
+
+	return getDBQuery(
+		{
+			table: collection,
+			fieldNodes,
+			o2mNodes: [],
+			query,
+			cases,
+			permissions,
+			permissionsOnly: true,
+		},
+		{ schema, knex },
+	);
+}

@@ -71,7 +71,17 @@ export async function runAst(
 		}
 
 		// The actual knex query builder instance. This is a promise that resolves with the raw items from the db
-		const dbQuery = getDBQuery(schema, knex, collection, fieldNodes, o2mNodes, query, cases, permissions);
+		const dbQuery = getDBQuery(
+			{
+				table: collection,
+				fieldNodes,
+				o2mNodes,
+				query,
+				cases,
+				permissions,
+			},
+			{ schema, knex },
+		);
 
 		const rawItems: Item | Item[] = await dbQuery;
 

@@ -21,6 +21,7 @@ export function getColumnPreprocessor(
 	cases: Filter[],
 	permissions: Permission[],
 	aliasMap: AliasMap,
+	permissionsOnly?: boolean,
 ) {
 	const helpers = getHelpers(knex);
 
@@ -47,7 +48,13 @@ export function getColumnPreprocessor(
 
 		let column;
 
-		if (field?.type?.startsWith('geometry')) {
+		if (permissionsOnly) {
+			if (noAlias) {
+				column = knex.raw(1);
+			} else {
+				column = knex.raw('1 as ??', [alias]);
+			}
+		} else if (field?.type?.startsWith('geometry')) {
 			column = helpers.st.asText(table, field.field, rawColumnAlias);
 		} else if (fieldNode.type === 'functionField') {
 			// Include the field cases in the functionField query filter

@@ -1,6 +1,6 @@
 import type { Accountability, PermissionsAction, PrimaryKey, Query } from '@directus/types';
 import { getAstFromQuery } from '../../../../database/get-ast-from-query/get-ast-from-query.js';
-import { runAst } from '../../../../database/run-ast/run-ast.js';
+import { fetchPermittedAstRootFields } from '../../../../database/run-ast/modules/fetch-permitted-ast-root-fields.js';
 import type { Context } from '../../../types.js';
 import { processAst } from '../../process-ast/process-ast.js';
 
@@ -9,6 +9,7 @@ export interface ValidateItemAccessOptions {
 	action: PermissionsAction;
 	collection: string;
 	primaryKeys: PrimaryKey[];
+	fields?: string[];
 }
 
 export async function validateItemAccess(options: ValidateItemAccessOptions, context: Context) {
@@ -24,7 +25,7 @@ export async function validateItemAccess(options: ValidateItemAccessOptions, con
 	const query: Query = {
 		// We don't actually need any of the field data, just want to know if we can read the item as
 		// whole or not
-		fields: [],
+		fields: options.fields ?? [],
 		limit: options.primaryKeys.length,
 	};
 
@@ -46,9 +47,17 @@ export async function validateItemAccess(options: ValidateItemAccessOptions, con
 		},
 	};
 
-	const items = await runAst(ast, context.schema, options.accountability, { knex: context.knex });
+	const items = await fetchPermittedAstRootFields(ast, {
+		schema: context.schema,
+		accountability: options.accountability,
+		knex: context.knex,
+	});
 
 	if (items && items.length === options.primaryKeys.length) {
+		if (options.fields) {
+			return items.every((item: any) => options.fields!.every((field) => item[field] === 1));
+		}
+
 		return true;
 	}
 

@@ -9,6 +9,7 @@ export interface ValidateAccessOptions {
 	action: PermissionsAction;
 	collection: string;
 	primaryKeys?: PrimaryKey[];
+	fields?: string[];
 }
 
 /**
@@ -40,8 +41,16 @@ export async function validateAccess(options: ValidateAccessOptions, context: Co
 	}
 
 	if (!access) {
+		if (options.fields?.length ?? 0 > 0) {
+			throw new ForbiddenError({
+				reason: `You don't have permissions to perform "${options.action}" for the field(s) ${options
+					.fields!.map((field) => `"${field}"`)
+					.join(', ')} in collection "${options.collection}" or it does not exist.`,
+			});
+		}
+
 		throw new ForbiddenError({
-			reason: `You don't have permission to "${options.action}" from collection "${options.collection}" or it does not exist.`,
+			reason: `You don't have permission to perform "${options.action}" for collection "${options.collection}" or it does not exist.`,
 		});
 	}
 }

@@ -727,6 +727,7 @@ export class ItemsService<Item extends AnyItem = AnyItem, Collection extends str
 					action: 'update',
 					collection: this.collection,
 					primaryKeys: keys,
+					fields: Object.keys(payloadAfterHooks),
 				},
 				{
 					schema: this.schema,