Fix regression in count database helper when counting filtered related fields

[hanneskuettner]

Scope

A special case that slipped the cracks of #22297: When counting the items of a related field, that is filtered down using permissions, we incorrectly use the un-aliased collection name for the joins in addJoin.

You can reproduce this by setting up the following collections

• videos collection
• battles collection with at least a status field and a o2m relation to the videos collections, called videos, call the foreign key battle

Create a test role and set the permissions:

• battles collection to All Access for reading
• videos collection to Custom. Allow all fields and set the Item Permission filter to {"_and":[{"battle_id":{"status":{"_eq":"published"}}}]}

Without this PR you should see the error as described in #22443 for the GraphQL query

{
  battles {
    id
    videos_func {
      count
    }
}

What's changed:

Add the newly aliased related collection to the alias map as parent collection with an empty string as key for the nestedapplyFilter. This will cause addJoin to use this alias as aliasedParentCollection instead of the real name of the collection here, as parentFields is undefined for the first level of nested filter.

directus/api/src/utils/apply-query.ts

Line 165 in 1d65b0d

const aliasedParentCollection = aliasMap[parentFields ?? '']?.alias || parentCollection;

For additional levels of nested filters parentFields has the parent collections in there as thus the behavior is still the default behavior for nested filters.

Potential Risks / Drawbacks

None, hopefully

Review Notes / Questions

• Is the changeset understandable?

---

Fixes #22443

[changeset-bot]

🦋 Changeset detected

Latest commit: 5a28241

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@directus/api	Patch
directus	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[paescuj]

Additionally updated the addWhereClauses function to respect the alias. Required when there's a permission filter on the related collection itself, e.g. on videos:

{
    "_and": [
        {
            "id": {
                "_eq": "1"
            }
        }
    ]
}

Ran the blackbox tests locally as an additional check.