Implement permission policies in the API

[rijkvanzanten]

Scope

What's changed:

• Implements policy-system based permissions handling on the API
• Replaces AuthorizationService with new set of functions in the api/src/permissions folder
• Allows roles to be nested
• Adds new roles flag to accountability object. This is an ordered array of all the parent roles of the current user
• Cleans up get-ast-from-query by splitting it into multiple files
• Permissions are now injected into the AST through cases and whenCase. This allows us to dynamically generate the case/when SQL to have dynamic field output per item.
• Cleans up run-ast by splitting it up into smaller files

Potential Risks / Drawbacks

• The risks are very high. This replaces the full permissions system, and thus needs a lot of testing

Review Notes / Questions

• This PR now compiles, but doesn't run yet.
• There was some weird logic happening in the users controller for TFA enable/disable that I'm not sure we need to keep. Needs a bit more testing

Todos

• Add permissions processing for $CURRENT_USER etc flags
  • Introduce $CURRENT_POLICIES and $CURRENT_ROLES for permissions
  • Decide if $CURRENT_POLICIES and $CURRENT_ROLES should be available in presets as well
• Add permissions merging when you're accessing from a share
• Add caching to:
  • Fetching Policies
  • Fetching permissions
  • Fetching the roles tree
  • Fetching the field map
  • Fetching allowed fields
  • Fetching allowed collections
• Enable validation for admin users for wrong paths
• Figure out what we want to do with Presets
• Use whenCases in run-ast
• Use applyCases in Meta Service for permissions aware counts
• Handle admin-checks in roles and users services¹ -> Handled in Rework user integrity checks for Auditus #22737
• Add unit testing for clear method in memory/cache
• Make sure graphql gracefully handles optional fields when you have different fields for the same collection in multiple permission sets
• Add changeset
• Unbork /permissions endpoint
• Invalidate cache on permission changes
  • On directus_access changes
  • On directus_roles changes
  • On directus_permissions changes
  • On directus_policies changes
• Purge request level cache on permission related changes
• Bring back check-ip middlewares?
• Fix down migration
• Fix telemetry user counting -> Handled in Rework user integrity checks for Auditus #22737
• Fix user limit checking -> Handled in Rework user integrity checks for Auditus #22737
• Reduce accountability used in the withCache to the known keys -> Handled in Use ip in global access and stabilize accountability keys #22727
• Fix $FOLLOW field key for filters (Fixed in c00ff5d)
• Fix handling of o2m fields that have partial permissions set (currently if some access to a o2m related field is given, it is returned for all items, even if the user should not see the field for some items)
• Account for user IP in the global request cache
• Make sure that the globalAccess for a public user always has app_access and admin_access false
• Add new collections to GraphQL
• Add new collections to websockets
• Add new endpoints + types to SDK
• Before merging this one in main, either retarget Add roles and permissions to the app #22654 to main, or merge it in here

---

Closes #21778, closes #21765, closes #22163, closes #21769, closes #21768, closes #21767, closes #21766

Footnotes

1. Eg check to make sure there's still >=1 admin left after the mutation is done ↩