Snapshot, diff, and apply for roles and permissions

[becdetat]

Summary

Similar to the excellent schema management endpoints, there should be a way to manage roles and permissions.

This is similar in spirit but not implementation to #13041.

Basic Example

Three new API endpoints, similar in operation to the existing /schema/* APIs. access-control might not be the best name but this is the idea:

• GET /access-control/snapshot - Retreive a snapshot of the access controls, including roles and permissions
• POST /access-control/diff - Retrieve the diff between the posted snapshot and the current access controls
• POST /access-control/apply - Apply the posted diff

This will allow programmatic management of access control across Directus instances, removing the need for human interaction to build applications across different environments, and make it possible to store access control configuration in source control as a JSON file, alongside the schema JSON.

Motivation

We want to create Directus applications in a repeatable fashion, going from local development to a test environment to production. We can reproduce the schema using the /schema APIs, however there is no comparable way to generate and apply access control, which forms a critical part of the application. Having a set of APIs that allow building a repeatable set of access controls would enable better development practices.

Detailed Design

This is a high level feature request so I won't get deep into implementation details.

This feature should be similar in operation to the /schema APIs:

• retrieve a JSON snapshot of the access controls, including roles and permissions (down to custom permissions and filters)
• produce a JSON diff between a snapshot and the current access controls
• apply the diff to the access controls

Requirements List

Must Have:

• The ability to fully reproduce access control configuration across different Directus instances
• Parity with /schema APIs in terms of functionality

Drawbacks

Access control is complex, going down into custom permissions for example.

Alternatives

There are existing APIs that allow CRUD management of roles and permissions, however implementing repeatable environments using these APIs would be highly onerous compared to a set of APIs similar to the /schema/* APIs.

Adoption Strategy

This isn't a breaking change, it would be an additional set of APIs that allow repeatable deployment of access controls to multiple Directus instances.

Unresolved Questions

Roles are applied to users, and if /access-controls/apply allows the destruction of roles, existing users with those roles would suddenly not have them. While this is probably desirable behaviour, it may be unexpected.

Note that this already applies to content that is affected by schema changes via /schema/apply.