le-app/directus/permissions.md

Roles, policies, and permissions

This is a readable rendering of reference/exports/roles.json, policies.json, access.json, and permissions.json. C/R/U/D mean create/read/update/delete. An absent action means no permission row was exported; it does not establish permissions inherited from an omitted user-specific policy.

Role and policy assignments

Role/access subject	Assigned policy	Admin access	Data Studio app access	Enforced TFA	IP restriction
Administrator	Administrator	Yes	Yes	No	None
Registration Bot	Registration	No	No	No	None
Supporter Bot	Supporter	No	No	No	None
Users	Users Self Access (sort 1), Users (sort 2)	No	No	No	None
Public/role-less	Public	No	No	No	None

No user-specific access assignments appear in the sanitized export because user data was intentionally omitted. The Administrator policy's collection permissions are implicit in admin_access; no individual rows were exported for it.

High-level matrix

Collection group	Public	Users	Users Self Access	Registration	Supporter
Public catalog/content collections listed below	R	R	-	-	-
directus_fields	R: id,collection,field	R: metadata fields listed below	-	-	-
directus_files	R all fields	C/R all fields	-	-	-
directus_users	-	R public profile fields	own-row R/U	R/C broad registration fields	-
Projects and settings collections	R	C/R/U/D	-	-	-
projects_files	R	C/R	-	-	-
user_claims	-	C/R/U/D with presets and own/pending filters	-	-	-
user_rigs	-	C/R/U/D with owner controls	-	-	-
user_rig_type	-	C/R	-	-	-
user_memberships	-	-	-	-	C/R/U all fields
directus_roles	-	-	-	R selected role fields	-

Public policy

Unrestricted read, all fields, is exported for:

bg_cat, bg_entries, bg_sub_cat, directus_files, hazard_danger, hazard_severity, hazard_source, hazard_tags, laser_focus_lens, laser_focus_lens_config, laser_focus_lens_diameter, laser_scan_lens, laser_scan_lens_apt, laser_scan_lens_config, laser_scan_lens_exp, laser_software, laser_source, material, material_cat, material_coating, material_coating_hazard_tags, material_color, material_hazard_tags, material_opacity, material_status, projects, projects_files, settings_co2gal, settings_co2gan, settings_fiber, and settings_uv.

Public can also read directus_fields, restricted to field,collection,id. There are no exported public create, update, or delete permissions.

Users policy

Users have unrestricted, all-field read for every public content collection above. Additional or expanded permissions are:

Collection	Actions	Row filter	Fields/presets
directus_fields	R	None	id,collection,field,special,interface,options,readonly,hidden,required,sort,width,group,note
directus_files	C/R	None	All fields; no folder/owner filter or preset exported
directus_users	R	None	username,first_name,avatar,location,id
projects	C/R/U/D	U/D require owner=$CURRENT_USER; C/R unrestricted	All fields; C presets owner and uploader to $CURRENT_USER
projects_files	C/R	None	All fields; no ownership filter exported
settings_co2gal	C/R/U/D	U/D require owner=$CURRENT_USER; C/R unrestricted	All fields; C presets owner/uploader to current user
settings_co2gan	C/R/U/D	Same as above	Same as above
settings_fiber	C/R/U/D	Same as above	Same as above
settings_uv	C/R/U/D	U/D require owner=$CURRENT_USER; C/R unrestricted	C/R/U all fields and owner/uploader presets on C; D has fields=null in the export
user_claims	C/R/U/D	R: claimant is current user. U/D: claimant is current user and status is pending. C unrestricted.	C fields omit claimant and status but preset them to current user/pending; R selected fields; U only note; D fields=null
user_rigs	C/R/U/D	R/D require owner current user. U filter contains owner _eq "%CURRENT_USER" exactly as exported. C unrestricted.	All fields; C presets owner to $CURRENT_USER
user_rig_type	C/R	None	All fields

The %CURRENT_USER update filter on user_rigs differs from the $CURRENT_USER token used everywhere else. This is a verified exported value and is likely ineffective, but its Directus runtime interpretation has not been tested.

No validation rules are present on any exported Users permission row.

Users Self Access policy

Both rows require id=$CURRENT_USER:

• Read fields: username,last_name,first_name,email,password,avatar,location,title,description,tags,language,tfa_secret,email_notifications,id.
• Update fields: first_name,last_name,email,password,avatar,location.

There are no presets or validation rules. Username is readable but not updateable. The exported read list includes sensitive field names such as password and tfa_secret; Directus may suppress stored secret values independently, but that behavior is not proven by this export and should be tested.

Registration policy

• directus_users.create: unrestricted rows; fields email,username,password,role,status,auth_data,first_name,last_name,avatar,id.
• directus_users.read: unrestricted rows; a broad field list including username,email,id,password,auth_data,token,policies,role,status,tfa_secret and UI/theme fields.
• directus_roles.read: unrestricted rows; fields id,name,icon,description,parent,children.

No validation rules or presets are exported. Least privilege therefore depends on the static credential being held only by the server and the application strictly controlling submitted fields. The application registration route currently uses email, username, password, and optionally role; username-to-email login resolution uses read access.

Supporter policy

user_memberships has unrestricted create, read, and update permissions on all fields. No delete row, row filters, validation rules, or presets are exported. The policy is assigned to Supporter Bot.

Validation and preset summary

• Every exported validation value is null.
• Presets exist only for Users creates on projects/settings (owner/uploader), user claims (claimant/pending), and user rigs (owner).
• Row filters exist only for Users updates/deletes and selected reads described above, plus own-row filters in Users Self Access.
• Null permissions mean no row filter in these exports; null fields on delete rows are preserved as observed rather than interpreted as all/no fields.