Function up

api/src/database/migrations/20240806A-permissions-policies.ts:66–209

(knex: Knex)

const PUBLIC_POLICY_ID = 'abf8a154-5b1c-4a46-ac9c-7300570f4f17';

export async function up(knex: Knex) {
	const logger = useLogger();

	/////////////////////////////////////////////////////////////////////////////////////////////////
	// If the policies table already exists the migration has already run
	if (await knex.schema.hasTable('directus_policies')) {
		return;
	}

	/////////////////////////////////////////////////////////////////////////////////////////////////
	// Create new policies table that mirrors previous Roles

	await knex.schema.createTable('directus_policies', (table) => {
		table.uuid('id').primary();
		table.string('name', 100).notNullable();
		table.string('icon', 64).notNullable().defaultTo('badge');
		table.text('description');
		table.text('ip_access');
		table.boolean('enforce_tfa').defaultTo(false).notNullable();
		table.boolean('admin_access').defaultTo(false).notNullable();
		table.boolean('app_access').defaultTo(false).notNullable();
	});

	/////////////////////////////////////////////////////////////////////////////////////////////////
	// Copy over all existing roles into new policies

	const roles = await knex
		.select('id', 'name', 'icon', 'description', 'ip_access', 'enforce_tfa', 'admin_access', 'app_access')
		.from('directus_roles');

	if (roles.length > 0) {
		await processChunk(roles, 100, async (chunk) => {
			await knex('directus_policies').insert(chunk);
		});
	}

	await knex
		.insert({
			id: PUBLIC_POLICY_ID,
			name: '$t:public_label',
			icon: 'public',
			description: '$t:public_description',
			app_access: false,
		})
		.into('directus_policies');

	// Change the admin policy description to $t:admin_policy_description
	await knex('directus_policies')
		.update({
			description: '$t:admin_policy_description',
		})
		.where('description', 'LIKE', '$t:admin_description');

	/////////////////////////////////////////////////////////////////////////////////////////////////
	// Remove access control + add nesting to roles

	await knex.schema.alterTable('directus_roles', (table) => {
		table.dropColumn('ip_access');