Allow Directus Activity usage in insights

[jorauch]

Describe the Bug

Only the directus_activity collection is missing in the collection dropdown in the panel option dialog. Otherwise, it is possible to select the collection if you use the raw editor and everything works.

To Reproduce

1. Create a new dashboard
2. Create a new e.g. list-panel
3. Open the Collection Dropdown
   → directus_activity is missing in this list

Errors Shown

No response

What version of Directus are you using?

9.14.5

What version of Node.js are you using?

16.16.0

What database are you using?

mySQL

What browser are you using?

Chrome

How are you deploying Directus?

Plesk

[azrikahar]

It is technically not just limited to directus_activity, because there are several system tables which have their own CRUD nuances compared to other system tables, hence they were intentionally restricted when Insights were implemented in #8009:

directus/app/src/constants.ts

Lines 27 to 39 in cf10b17

	/**
	* These are the system endpoints that don't have full/regular CRUD operations available.
	*/
	export const COLLECTIONS_DENY_LIST = [
	'directus_activity',
	'directus_collections',
	'directus_fields',
	'directus_migrations',
	'directus_relations',
	'directus_revisions',
	'directus_sessions',
	'directus_settings',
	];

So it may not just be a question of adding them back to the dropdown. But as you shared via the raw value method, perhaps an exception can be made here for READ operation, assuming all of the aforementioned collections will still behave properly of course.

[jorauch]

I was not aware that there is a blacklist and there was a conscious decision to hide this collection. I only noticed the incontinence.
For example, I wanted to visualize how many users have logged into the my app in a defined period of time in order to derive the frequency of use.
For my requirement, the workearound with the RAW editor is fine.
I thought this or similar requirements could have other users as well.
Are there any security risks or errors to be expected if you access this information reading from it?

[azrikahar]

I was not aware that there is a blacklist and there was a conscious decision to hide this collection. I only noticed the incontinence.
For example, I wanted to visualize how many users have logged into the my app in a defined period of time in order to derive the frequency of use.
For my requirement, the workearound with the RAW editor is fine.
I thought this or similar requirements could have other users as well.

Your use case is definitely valid! It is a great enhancement to have, hence it was moved to a feature request 👍

Are there any security risks or errors to be expected if you access this information reading from it?

Not that I'm aware of, at least in terms of Insights (since we can't create/update/delete). However do note that by default, non-admin roles/users will only see their activities (login, comment, create new items etc), so that can technically be a form of risk if we open full read permission for them.

Other than that, there shouldn't be any obvious errors to expected except the slight chance of some of them not being 100% compatible with regular reads, if any.

[jorauch]

Okay, I understand the concerns about the default permissions that only allow you to see your own.
If desired, these rights cannot always be exercised by the application administrator and there would be no need to adjust the core?

[jorauch]

Maybe, this may also result in a basic solution for a similar use case: #8434

[rijkvanzanten]

Heya! Thank you for taking the time to submit this request!

It has been over 90 days, and this discussion has not received at least 15 votes from the community. This means that we don't feel like there's enough community interest to warrant further R&D into this topic at this time. 🧊

This request will now be closed to keep our discussions tidy. Please reach out if you have any questions!

For more information, see our Feature Request Process.