le-app/directus/permissions.md

# Roles, policies, and permissions

This is a readable rendering of `reference/exports/roles.json`, `policies.json`, `access.json`, and `permissions.json`. `C/R/U/D` mean create/read/update/delete. An absent action means no permission row was exported; it does not establish permissions inherited from an omitted user-specific policy.

## Role and policy assignments

| Role/access subject | Assigned policy | Admin access | Data Studio app access | Enforced TFA | IP restriction |
| --- | --- | --- | --- | --- | --- |
| Administrator | Administrator | Yes | Yes | No | None |
| Registration Bot | Registration | No | No | No | None |
| Supporter Bot | Supporter | No | No | No | None |
| Users | Users Self Access (sort 1), Users (sort 2) | No | No | No | None |
| Public/role-less | Public | No | No | No | None |

No user-specific access assignments appear in the sanitized export because user data was intentionally omitted. The Administrator policy's collection permissions are implicit in `admin_access`; no individual rows were exported for it.

## High-level matrix

| Collection group | Public | Users | Users Self Access | Registration | Supporter |
| --- | --- | --- | --- | --- | --- |
| Public catalog/content collections listed below | R | R | - | - | - |
| `directus_fields` | R: `id,collection,field` | R: metadata fields listed below | - | - | - |
| `directus_files` | R all fields | C/R all fields | - | - | - |
| `directus_users` | - | R public profile fields | own-row R/U | R/C broad registration fields | - |
| Projects and settings collections | R | C/R/U/D | - | - | - |
| `projects_files` | R | C/R | - | - | - |
| `user_claims` | - | C/R/U/D with presets and own/pending filters | - | - | - |
| `user_rigs` | - | C/R/U/D with owner controls | - | - | - |
| `user_rig_type` | - | C/R | - | - | - |
| `user_memberships` | - | - | - | - | C/R/U all fields |
| `directus_roles` | - | - | - | R selected role fields | - |

## Public policy

Unrestricted read, all fields, is exported for:

`bg_cat`, `bg_entries`, `bg_sub_cat`, `directus_files`, `hazard_danger`, `hazard_severity`, `hazard_source`, `hazard_tags`, `laser_focus_lens`, `laser_focus_lens_config`, `laser_focus_lens_diameter`, `laser_scan_lens`, `laser_scan_lens_apt`, `laser_scan_lens_config`, `laser_scan_lens_exp`, `laser_software`, `laser_source`, `material`, `material_cat`, `material_coating`, `material_coating_hazard_tags`, `material_color`, `material_hazard_tags`, `material_opacity`, `material_status`, `projects`, `projects_files`, `settings_co2gal`, `settings_co2gan`, `settings_fiber`, and `settings_uv`.

Public can also read `directus_fields`, restricted to `field,collection,id`. There are no exported public create, update, or delete permissions.

## Users policy

Users have unrestricted, all-field read for every public content collection above. Additional or expanded permissions are:

| Collection | Actions | Row filter | Fields/presets |
| --- | --- | --- | --- |
| `directus_fields` | R | None | `id,collection,field,special,interface,options,readonly,hidden,required,sort,width,group,note` |
| `directus_files` | C/R | None | All fields; no folder/owner filter or preset exported |
| `directus_users` | R | None | `username,first_name,avatar,location,id` |
| `projects` | C/R/U/D | U/D require `owner=$CURRENT_USER`; C/R unrestricted | All fields; C presets `owner` and `uploader` to `$CURRENT_USER` |
| `projects_files` | C/R | None | All fields; no ownership filter exported |
| `settings_co2gal` | C/R/U/D | U/D require `owner=$CURRENT_USER`; C/R unrestricted | All fields; C presets owner/uploader to current user |
| `settings_co2gan` | C/R/U/D | Same as above | Same as above |
| `settings_fiber` | C/R/U/D | Same as above | Same as above |
| `settings_uv` | C/R/U/D | U/D require `owner=$CURRENT_USER`; C/R unrestricted | C/R/U all fields and owner/uploader presets on C; D has `fields=null` in the export |
| `user_claims` | C/R/U/D | R: claimant is current user. U/D: claimant is current user and status is `pending`. C unrestricted. | C fields omit `claimant` and `status` but preset them to current user/`pending`; R selected fields; U only `note`; D `fields=null` |
| `user_rigs` | C/R/U/D | R/D require owner current user. U filter contains `owner _eq "%CURRENT_USER"` exactly as exported. C unrestricted. | All fields; C presets owner to `$CURRENT_USER` |
| `user_rig_type` | C/R | None | All fields |

The `%CURRENT_USER` update filter on `user_rigs` differs from the `$CURRENT_USER` token used everywhere else. This is a **verified exported value** and is likely ineffective, but its Directus runtime interpretation has not been tested.

No validation rules are present on any exported Users permission row.

## Users Self Access policy

Both rows require `id=$CURRENT_USER`:

- Read fields: `username,last_name,first_name,email,password,avatar,location,title,description,tags,language,tfa_secret,email_notifications,id`.
- Update fields: `first_name,last_name,email,password,avatar,location`.

There are no presets or validation rules. Username is readable but not updateable. The exported read list includes sensitive field names such as `password` and `tfa_secret`; Directus may suppress stored secret values independently, but that behavior is **not proven by this export** and should be tested.

## Registration policy

- `directus_users.create`: unrestricted rows; fields `email,username,password,role,status,auth_data,first_name,last_name,avatar,id`.
- `directus_users.read`: unrestricted rows; a broad field list including `username,email,id,password,auth_data,token,policies,role,status,tfa_secret` and UI/theme fields.
- `directus_roles.read`: unrestricted rows; fields `id,name,icon,description,parent,children`.

No validation rules or presets are exported. Least privilege therefore depends on the static credential being held only by the server and the application strictly controlling submitted fields. The application registration route currently uses email, username, password, and optionally role; username-to-email login resolution uses read access.

## Supporter policy

`user_memberships` has unrestricted create, read, and update permissions on all fields. No delete row, row filters, validation rules, or presets are exported. The policy is assigned to Supporter Bot.

## Validation and preset summary

- Every exported `validation` value is null.
- Presets exist only for Users creates on projects/settings (`owner`/`uploader`), user claims (`claimant`/`pending`), and user rigs (`owner`).
- Row filters exist only for Users updates/deletes and selected reads described above, plus own-row filters in Users Self Access.
- Null permissions mean no row filter in these exports; null fields on delete rows are preserved as observed rather than interpreted as all/no fields.