Repository: directus/directus
File: api/src/database/migrations/20240710A-permissions-policies.ts (TypeScript)

Code before:
	const accessRows = await context
		.knex('directus_access')
		.select(
			'directus_policies.id',
			'directus_policies.admin_access',
			'directus_policies.app_access',
			'directus_policies.ip_access',
			'directus_policies.enforce_tfa',
		)
		.where('role', 'in', roles)
		.leftJoin('directus_policies', 'directus_policies.id', 'directus_access.policy');

	const ipAccess = new Set();

	for (const { admin_access, app_access, ip_access, enforce_tfa } of accessRows) {
		if (toBoolean(admin_access)) {
			roleAccess.admin_access = true;
		}

		if (toBoolean(app_access)) {
			roleAccess.app_access = true;
		}

		if (toBoolean(enforce_tfa)) {
			roleAccess.enforce_tfa = true;
		}

		if (ip_access && ip_access.length) {
			ip_access.split(',').forEach((ip: string) => ipAccess.add(ip));
		}
	}

	if (ipAccess.size > 0) {
		roleAccess.ip_access = Array.from(ipAccess).join(',');
	}

	return roleAccess;
}

/**
 * The public role used to be `null`, we gotta create a single new policy for the permissions
 * previously attached to the public role (marked through `role = null`).
 */
const PUBLIC_POLICY_ID = 'abf8a154-5b1c-4a46-ac9c-7300570f4f17';

export async function up(knex: Knex) {
	/////////////////////////////////////////////////////////////////////////////////////////////////
	// If the policies table already exists the migration has already run
	if (await knex.schema.hasTable('directus_policies')) {
		return;
	}

Review comment (suggestion):
```suggestion
		roleAccess.admin_access ||= toBoolean(admin_access);
		roleAccess.app_access ||= toBoolean(app_access);
		roleAccess.enforce_tfa ||= toBoolean(enforce_tfa);
```

Code after:
			'directus_policies.id',
			'directus_policies.admin_access',
			'directus_policies.app_access',
			'directus_policies.ip_access',
			'directus_policies.enforce_tfa',
		)
		.where('role', 'in', roles)
		.leftJoin('directus_policies', 'directus_policies.id', 'directus_access.policy');

	const ipAccess = new Set();

	for (const { admin_access, app_access, ip_access, enforce_tfa } of accessRows) {
		roleAccess.admin_access ||= toBoolean(admin_access);
		roleAccess.app_access ||= toBoolean(app_access);
		roleAccess.enforce_tfa ||= toBoolean(enforce_tfa);

		if (ip_access && ip_access.length) {
			ip_access.split(',').forEach((ip: string) => ipAccess.add(ip));
		}
	}

	if (ipAccess.size > 0) {
		roleAccess.ip_access = Array.from(ipAccess).join(',');
	}

	return roleAccess;
}

/**
 * The public role used to be `null`, we gotta create a single new policy for the permissions
 * previously attached to the public role (marked through `role = null`).
 */
const PUBLIC_POLICY_ID = 'abf8a154-5b1c-4a46-ac9c-7300570f4f17';

export async function up(knex: Knex) {
	/////////////////////////////////////////////////////////////////////////////////////////////////
	// If the policies table already exists the migration has already run
	if (await knex.schema.hasTable('directus_policies')) {
		return;
	}

	/////////////////////////////////////////////////////////////////////////////////////////////////
	// Create new policies table that mirrors previous Roles

	await knex.schema.createTable('directus_policies', (table) => {
		table.uuid('id').primary();
		table.string('name', 100).notNullable();
		table.string('icon', 64).notNullable().defaultTo('badge');
		table.text('description');
		table.text('ip_access');
		table.boolean('enforce_tfa').defaultTo(false).notNullable();