Access Control

Speaker 0: Everybody, welcome back to the part 2 of Technically, I'm Lost, t I l. As, again, you're probably joining us from the last episode. I'm Matt, and this is Bryant. Put a little French spin on it today. If you've watched part 1, if are we gonna did I just cut you off?

Speaker 1: I no. No. It's okay. I was gonna say do I look French to you? But

Speaker 0: We'll have to ask, Alex Chopin, our director of engineering from France. I digress. But yeah. So if you watched part 1, if you haven't, you're probably confused. We suggest you go watch part 1, because this is part 2 of part 1.

But, part 1, we are building a partner directory for us to use with our current partners. In that first episode, we planned out, how it was all gonna look, and we built out the form, which I can actually pull up my screen here and show you kind of how far we've gotten along. So, we I will say I, with the help of Bryant, me being a nontechnical person, learning directors for the first time, set up, this initial form in here. So we were able to set up, you know, point of contact, some information about the actual agency themselves, what they specialize in, with the drop down, partner logos, and we had, these projects, here as well as as this. So the general idea just to catch you up, is we wanna create a partner directory on the director's website for our partners, and this is the back end to get that whole thing running.

So where we left off last time, Brian, do you remember?

Speaker 1: Yeah. Yeah. Kind of. No. I I think what we need to do now, Daniel, like, we've got our agency partner collection configured.

That's looking nice. We need to go through and create the actual projects that we want them to add. So what's a data model look like for that? And then we need to scope a role for our partners. So, they can only edit their content and only, like, the agency partners and the project's collections.

Speaker 0: Great. Okay. So let's start with that part 1. So the projects, to give you a little background on how we're thinking about this. So when somebody comes to, you know, direct style slash partners, they'll filter down on country and specialization.

By then, they'll find an agency they like. They click on them, and then that page will have a showcase of the projects that that agency has done with Directus. So we'll need to create that collection, as you mentioned. What's a good starting point for this? Is it just diving in?

Is it a little bit of planning your strategic approach to this? Or what do you think?

Speaker 1: I I mean, I I think at a high level, you wanna know what what goes on a project or or, like, what form feels, like, what are we gonna display when you click into a project. Mhmm. You know, if I'm imagining it, like, you've got an agency page where you're you're surfacing all these projects, maybe, like do we have an extra page for each project as well? So I can I'm on the agency page. I see a list of their recent projects.

I click in the project, and I get, like, a a mini case study type of thing, or we're gonna show those in a model, like, a pop up window. How what do we we wanna do there?

Speaker 0: I think it would be good to have a page. I like what you said about, like, a mini case study page. So maybe we'll have, like, the a scroller here of, like, they can go back and forth for, like, images of the actual website. And then

Speaker 1: I don't like it.

Speaker 0: You don't like it?

Speaker 1: I I want a grid. I don't like it. Give me a grid of projects.

Speaker 0: A grid. Wait for the individual project.

Speaker 1: Oh, no. No. No. For the individual projects, I I'm thinking well, you got, like, an image gallery. I I'm thinking like a grid still.

Speaker 0: Big grid guy.

Speaker 1: Yeah. Let me I'm gonna share. I'm gonna share a link.

Speaker 0: Let me share.

Speaker 1: This is, again, this is the agent c OS link. So this is a sample starter kit project that that I put together, to showcase what you could do with Directus. Let me I guess I could put it in the chat here instead of our team comps.

Speaker 0: Alright. Let me pull this up over here.

Speaker 1: This is not a a like, the text doesn't really jive here, but, you know, you've got, like, a a title for the project. You got, like, a summary, then you have some content, and then you have an image gallery that, you know, if you click on one of those images, then you could cycle through.

Speaker 0: Wow.

Speaker 1: Instead of, like, a instead of a carousel on the actual page, show a grid. And then you have some metadata, like, hey. What's the client? What's it built with? What's the cost?

I I don't know if we wanna probably omit that for this. You know? Would be nice to show, like, what it was built with. Those could just be, like, tags. So this is kinda what I'm envisioning.

You know, the the header there is probably not it doesn't really jive with, like, the direct as brand guidelines. So we'd probably do something different. But, you know, I I think at a high level, you got a title, a short summary of the project. You've got a featured image for the project. You have some content, in case they wanna expand or go into as much detail as they want to.

And then there's probably, like, the the content would probably be, like, text. Right? Mhmm. And then the yeah. And then you could have, like, a separate gallery if you wanted to.

Speaker 0: Separate gallery.

Speaker 1: And then, you know, like, some tags for what it was built with, like front end type of stuff, I guess. Like, hey. Is it built with Next? Is it built with Next? I I don't know.

I don't know if that's necessary either.

Speaker 0: Okay. I like this. So, yeah, so we would create a collection with these different items inside of Directus. Last time, if you can refresh my memory, when we created the projects here, this was a one to mini or a mini to 1?

Speaker 1: So it depends on where you're at. Right? Those are 2 inverse relationships. If you are a for this example, if we're on the agency partner, projects would be a one to many relationship because I've got one agency, many projects. But if I'm inside projects, it's the reverse.

Right? I've got, one project or, actually, I'm sorry. Is it many projects to one agency, basically.

Speaker 0: Yeah. That makes sense.

Speaker 1: Like a project can only have belong to a single agency is what I'm trying to say.

Speaker 0: That makes sense. So we'd have this is the one to many from the agency side. So if we go here, this would be the many to 1.

Speaker 1: Yep. So what you're gonna have to do here is go into our data model for projects because we we didn't add any fields for that.

Speaker 0: Mhmm. Where is our here. So from the agency side, if if I click here, this will take me

Speaker 1: automatically there.

Speaker 0: It's over here. Great. So just like we did last time, you know, obviously, going through, filling out these fields. Title, I assume, would be just a standard input field. Title, String.

Speaker 1: There you go.

Speaker 0: I mean, required, obviously. Project title, let's see. The name of the client, input project client. And,

Speaker 1: again, I would probably just do, like, client name. Right? Because there's, like, where else are you using client name? You're not.

Speaker 0: Naming conventions. I'm about to get open that can of worms. So short summary. Would you use an input field, or would you use a text area field? Or

Speaker 1: Text area for sure. No wysiwyg. I don't wanna deal with rendering HTML or, stripping out HTML. I I just want, like, a short description to display on a card or in a heading.

Speaker 0: And if I'm gonna add a placeholder here, I will do it in the placeholder field.

Speaker 1: Yeah. You've also got the help field or the the note field, I think, is is what it is as well. Like, the placeholder is gonna be it's gonna disappear as soon as they start typing. Right? The if you go to the field tab when you create 1, you got some helper text that you can add.

Okay.

Speaker 0: Okay. So here, we are creating the main image versus the gallery of images that they could just, like, see. So

Speaker 1: Yeah. There there's 2 ways you could you could do that. Right? You could just have an image gallery and use the first item in the gallery as, like, the featured image. It's kinda a matter of personal preference.

Usually, I like to be more explicit. And because of the way that Directus, like, queries the data and, like, if I'm showing a list of projects, I I can create it or treat it my gosh. I came to talk today. You could treat it like GraphQL, and I could tell it specifically the fields that I want. So, you know, on the index page where we're showing a list of projects, I can just grab the featured image and not worry about the image gallery.

So that's that's probably why I would do 2 separate fields for those. So you might have, like, a, like, a featured image field and then, like, an image gallery or gallery, whatever you wanna call it. This is just a single image that you're gonna use across the site.

Speaker 0: Featured No.

Speaker 1: No. No. No. What did you do?

Speaker 0: I created a featured

Speaker 1: It's not just messing with you. No. You don't need your Oh,

Speaker 0: Don't be doing that today. Oh, man. Got my heart rate up. So next part, if we're doing a showcase or gallery, I assume files based on the image here.

Speaker 1: Yep. Definitely.

Speaker 0: And then showcase.

Speaker 1: Bro, call it image gallery or a gallery.

Speaker 0: I was gonna call it a project showcase.

Speaker 1: I feel like we're going to The Price is Right if we're, like, doing showcase.

Speaker 0: Okay. So I don't know if we want this required because as long as they have the the Yeah.

Speaker 1: You don't necessarily have to add an image gallery. Cool.

Speaker 0: So what else what else here?

Speaker 1: That's it.

Speaker 0: Really? Alright.

Speaker 1: Now you're also gonna want what else do we have? We had the we had, like, the built with tags. That's gonna be yeah. You can use the tag interface for that. It'd be fine.

Speaker 0: Built with JSON.

Speaker 1: There you go. And in this case, you're gonna, like, do allow other values. You could also add some presets to this if you wanted

Speaker 0: to. I'll add a few

Speaker 1: where people can just choose those. There you go.

Speaker 0: There you go. Allow other values. So when they type in, it'll add it. So that'll be a continually growing list. Big fan.

Speaker 1: So for. You could force alphabetical order if you wanted to. Way to standardize. If not, you could have, you know, potentially, like, next being shown in a separate place. Mhmm.

Also, just to clarify, that's not my stomach growling. That is this squirrel that I have on my lap.

Speaker 0: Dog is protecting the house. Love it.

Speaker 1: Oh, it's not protecting the house. It's it's being a pain in the butt. Tiny dogs, what do you do?

Speaker 0: Would you force, like, capitalization and and white space and all that sort of stuff? It doesn't matter.

Speaker 1: I don't know that I would just because, like, some of these well, I'm trying to think of a a good example of, like, a framework that prefers lowercase. I can't really think of any. Like, the white space, you might you know, like, white space, I would definitely, like, trim the white space, like, the the beginning and end, just so you remove white space. There you go. That way, there's, like, no extra, like, the space that's that's big, like breaking formatting or anything like that.

Speaker 0: Cool. Alright. Awesome. Anything else I should consider here, in advanced field creation mode? Or Nah.

Speaker 1: I wouldn't worry about it.

Speaker 0: Great. So I feel like we're good there. I

Speaker 1: think the next thing

Speaker 0: we were looking for. Oh, the main content, which would be text area again.

Speaker 1: Yeah. No. WYSIWYG. This, we're gonna give them formatting options. Why is it why is it main content?

Not just content.

Speaker 0: Because it's different from the short summary. Long

Speaker 1: But that's already it's already a different field, my man.

Speaker 0: Alright. Content it is.

Speaker 1: Good here? I'm good. I'm good. My dog is not good. This This data model is good, though.

Speaker 0: Alright. Feels good. I might actually go and make this content required. At least I have to share something about it. Great.

So our mini to 1 is now done. Yeah. I guess we could go here. Let's say we're going to start a new project. Everything looks good.

Yeah. Yeah. Amazing. Alright. So we have our partners.

We have our one to many connection to the projects, then we've got the many to one back to the partners. So feel good about these 2 collections. Now it's about actioning the actual, role based permission control. So when somebody signs up on the agency side, they're gonna have to go in and be able to add these projects. Maybe invite somebody to add these projects, invite members of the other team if they have to update, agency information.

Let's dive into role based access control. RBAC, direct us off. This is my first time ever using this, so it should be interesting. Oh,

Speaker 1: okay. Alright. So what do you think you know?

Speaker 0: What do I think I know? I see this big plus, and then that's what I think I know is I click this to create something.

Speaker 1: Yeah. That would be a a user. But as far as, like, what we're trying to achieve, like, what's it what what is your current plan of attack in your mind? And then we'll, like, course correct.

Speaker 0: Alright. Current plane of attack is and I will visualize this. So we're gonna get a partner in, and that's this little circle. This is a partner that fills out our partner request form. They go through the process.

Once they have become a partner, via our partner manager, then that is when

Speaker 1: Are are you supposed to be showing something on the screen? All I see is the user directory.

Speaker 0: Yes. Yes. I am. Here we go.

Speaker 1: Okay. Alright. Yeah. Now, we're seeing the circles. Okay.

Speaker 0: Yeah. Yeah. You missed my circles. Alright. But these these are the phases.

Right? So, actually, this is going to be, there's no preset yellow, of course. So I'll use orange. Initial come in, person fills out the form. They are vetted, become a partner, and then at this point is when we would send the send invite to partner directory.

Send them here, and then once they fill that out, then they'd be officially a partner as part of that ecosystem.

Speaker 1: Okay.

Speaker 0: These circles are super misshapen. So at that point

Speaker 1: I think that's an oval.

Speaker 0: Yeah. It's definitely an oval. This is gonna be main oh my gosh. This is crazy. Main agency contact.

They would fill fill out that part that we built. And then at this point, they can invite their own team. And I think that's it. So we'd have to figure out a role for this person? Because they're coming in cold, so they have to be able to log in.

I think we'll provide them a username and a password they can change.

Speaker 1: Yep.

Speaker 0: And then we'll have to figure out a role for this person who doesn't necessarily have the ability to change the point of contact information, but just has access to a few fields in that collection, to update the agency information if they need to.

Speaker 1: Okay. So we've got a admin at the agency, and then we have, like, a a team member at the agency

Speaker 0: Yep.

Speaker 1: Kind of set up.

Speaker 0: Exactly. So 2 two roles, I think.

Speaker 1: Okay. Now can a person be a part of multiple agencies?

Speaker 0: I don't think so. I think that's too too much.

Speaker 1: Too much. Too much.

Speaker 0: I'm trying to think of any scenario. It seems like a very rare edge case that would be the case and would have to probably be treated on a one to one basis.

Speaker 1: You could still accommodate that from, like, a using a separate email, basically, I guess. Separate login Maybe. Kind of scenario.

Speaker 0: This is also the v two of this partner directory, I'd love to build in a thing where, like, an agency partner can go in and request a license or something for, like, a new project that they're building. I'm trying to think that would that would be either the admin or the team member can make that request, but it would be logged to that specific agency. So Yeah.

Speaker 1: I I think this is good.

Speaker 0: Good start.

Speaker 1: Yeah. We'll just scope it down to, like, hey. You can only be a part of 1 agency at a time, which makes sense to me.

Speaker 0: Okay. Cool. I like it.

Speaker 1: Alright. So what are you what are you gonna do, man? What are you gonna do?

Speaker 0: I'm gonna come to access control. I'm gonna click this big purple create role button. The role I create, the naming convention here is gonna be well, you know what? Why don't you tell me? Because I know whatever I put in this little purple Okay.

Speaker 1: Thank you. So you give me The no. I I would just say, like, agency partner admin or something.

Speaker 0: Agency partner admin. Not giving them admin access because that would

Speaker 1: be No. No. No. No. That's just, like, a different thing.

Yeah.

Speaker 0: So app access only.

Speaker 1: App access only.

Speaker 0: As a small pardon me.

Speaker 1: Yep.

Speaker 0: Alright. So now, this is where things get interesting, because we have our website powered through this, which we've got, like, the blocks. So there's going to be a ton of these in here. And it's we're gonna have to provide the right access

Speaker 1: to these. Correct.

Speaker 0: All we need to really give them access to is the agency specific things.

Speaker 1: Right? Correct. You got it, boss man. Which So yeah. Command f comes in handy here, for sure.

We don't have a search in here yet, but I think it's on the docket.

Speaker 0: You know, feature request would be great if we had the you know, it actually is frozen up here. That's very nice. I was gonna say, wait. If we could freeze that top column.

Speaker 1: Alright. So what are you gonna do? Like, how do you wanna play this? You you want me to tell you you wanna step through this?

Speaker 0: No. Let's I wanna think through this because I am looking at this. I haven't really messed with roles before, but, obviously, this is CRUD. You know, create, update, re what's the r for CRUD?

Speaker 1: Update. The r? Oh, read. Read. Read.

Speaker 0: Update. Delete. Yeah. So for the agents for the admin, we're gonna want them to be able to create.

Speaker 1: Are you? Are you are you not just gonna, like, create a partner and then add the user as part of that partner? Like, is this is this is kind of a high touch program. Right?

Speaker 0: Yeah. So we would create the agency partner, get the send them the login information. So it would already be created, so they don't need access to create, plus they might go and create stuff that they shouldn't.

Speaker 1: Yeah. In this case, like, the only thing that they need to be able to do is read their own edit their own. We're not gonna let them delete. We're going to let them create, edit projects. They should be able

Speaker 0: to delete projects too. Right?

Speaker 1: Yeah. I was I would allow them to delete their own projects out of the system, but maybe not if it's published. Right? So as long as it's not published, you could delete it. If it is if it's already been published, like, we gotta go through some kind of flow so you're not breaking website.

Speaker 0: So this would be custom.

Speaker 1: Yeah. We don't have a field for we didn't add a field for the status of a project. Hey. Like, is this draft or published or not?

Speaker 0: Alright. Yeah.

Speaker 1: Add that to the to do list. Alright. And then project files would be the same where you can add project files as you can. Because this is this is just the image gallery. Right?

So you need to be able to delete those as well.

Speaker 0: So question. We have the share functionality, which barely gets used, admittedly, because I think there's a little bit of confusion around, like, what it actually allows for. So in this scenario of sharing a collection, would it be useful for them to share with the non, like, the non admin users That works.

Speaker 1: So if we're gonna keep everybody contained inside, we probably wouldn't use share. We would just give them access. But but, like, say that somebody did not have user access and you wanted to share something with them, you could do that through the share functionality of, like, hey. I wanna share this one specific piece of content with someone, that's not a part of the Directus application.

Speaker 0: Okay. So this makes sense. So I think for if they're if they're putting in one of those projects in the showcase and they wanna share it with, like, the client and be like, hey. We wrote this little mini study, like, or case study about the project we did with you. Can you confirm it?

Would that be a good application for this?

Speaker 1: Yeah. You could potentially do that. Alright. Like, if you if you wanted to see it before you go live yeah. Hey.

Hey. Well, the other rub is, like, if you're rendering this on the front end, they're probably gonna wanna see the front end as well. So, you know, that kinda goes into, like, a live preview mode on the front end. But just to see the actual content to get approval, you could certainly add share access for this.

Speaker 0: And we would do that at the

Speaker 1: project? Project level. Yeah. Cool.

Speaker 0: Yeah. This feels good so far.

Speaker 1: Okay.

Speaker 0: Saves automatically. So Yeah. Alright. Agency So

Speaker 1: so what's next?

Speaker 0: I'm gonna create the other role just so

Speaker 1: it's Okay. Alright.

Speaker 0: Agency, partner. Boy. Not the admin. Team role. That's it.

Speaker 1: Team. Just team. Just team. It's already a role.

Speaker 0: Oh, man. Cracked me up. Alright. So here, they're not going to have access to ad. They'll have access to c, but we don't want them to have access to edit it because that'll be from the admin.

No. Actually, we do, because can we use a custom permission here, so where they can't see the proof of the point of contact and, like, edit that?

Speaker 1: Yeah. You certainly can.

Speaker 0: So

Speaker 1: It would be within the field permissions.

Speaker 0: Field permissions.

Speaker 1: So here's the here's the fields that they can update. So you're going to hit show more there so you can see the rest of them. Mhmm. Alright.

Speaker 0: So check everything except for point of contact group because everything that's within that group.

Speaker 1: That's a great question. Yeah. Let's try it and see.

Speaker 0: Okay.

Speaker 1: I I I I think it will just be I I think you'll still have to do contact first name, last name, email. Or well, you don't want them to edit that. I'm sorry. Yeah. Leave that unchecked.

Speaker 0: Yeah. Printer name. Divider. Country. Partners.

Work description, specialization, logo, team size, projects. Alright. So now they have, custom access to that, if that makes sense.

Speaker 1: Yep. They're gonna need access to projects, so they can add projects, update projects.

Speaker 0: Don't want them to be able to delete. We wanna leave that to the admin. And project files, add, see, and edit. Yeah. I think this makes sense for v one rule.

And if we need to update it later, we can. It's the beauty of automatically saving. Okay.

Speaker 1: Cool. Cool.

Speaker 0: Good with these 2. Now the tricky part is

Speaker 1: alright. What's what is the what is what's the tricky part?

Speaker 0: The tricky part is whenever we create, when we manually create an agency partner inside of this, we have to create their contact information for that that point of contact. So, like, user directory, we can see here. We can create a user within here. So we fill out, like, their first name, last name, email, password. Interesting we have company info already baked in here.

So

Speaker 1: Yeah. That is, that's interesting. I think that is a factor of the docs.

Speaker 0: Okay. No. This is good. Okay. So if we were to create a fake person here, fake person, and I'll just add in my email.

We'll have to blur these so they don't pop up.

Speaker 1: I'd I'd hopefully will be deleting fake person later. And you're gonna have to change your email address because you're already

Speaker 0: I'm already a member here.

Speaker 1: You're already in in the system.

Speaker 0: Auto pop are you seeing my auto

Speaker 1: Yeah. It looks like it's, spazzing out a little bit there.

Speaker 0: Yeah. I don't know if you see, like, the pop up where it's, like, all of the things I've pre filled.

Speaker 1: No. No. I don't see the pop up. Alright. It has to do with your sharing settings, I'm sure.

Speaker 0: Gotcha. Well, that's good because there's some private info in here. So I'm gonna use a personal Gmail here. I'm not worried about that. I'm not worried about any of that.

I just wanted to create the fake person stuff. So

Speaker 1: Okay. Here.

Speaker 0: I will save. Save. And then for this, I'll go check my email.

Speaker 1: Did you did you create a password for them? You can also just open up an incognito window and log in. So, like, if you do the if you invite them versus so there's a there's 2 ways. Right? You can invite a user, or you can create a user.

So what you did was created a user. They're already in the system. They should already have access. Yes. If you send an invite.

Speaker 0: Alright. So we're in. As an admin, I have access to, these things. I see you just added a agency I

Speaker 1: added some agency partners for you.

Speaker 0: Thank you. So if I were to look at yours, I see your name, your agency, your mug, team size, specializations. Looks good to me. There's my mug.

Speaker 1: What's the problem here, bro?

Speaker 0: Problem is you have access to all of our files and our user directory of other team members. And we want to scope that down. Additionally, you have access to our insights, which shouldn't have access to that. So we have to limit access to parts of the app from the admin.

Speaker 1: And what else?

Speaker 0: And

Speaker 1: And then, and then, alright. Can you edit my agency?

Speaker 0: I can edit your agency. That's right. That is right.

Speaker 1: I'm I'm not saying, like, that would be in a potential issue. Like, we've got a a great list of community members, but

Speaker 0: Oh, man.

Speaker 1: Probably not good if you can update somebody else's agency information.

Speaker 0: If I had other agencies in the US that were in my territory, I'd be editing, like, this agency sucks.

Speaker 1: Alright. So how do we fix it?

Speaker 0: So we're gonna go back, step 1, to our normal back enroll right here. I think what we do here, access control, printer admin.

Speaker 1: There's a step that comes before this.

Speaker 0: I don't know what the step is. That's why I brought you.

Speaker 1: So you need, if if you're gonna restrict to a certain agency partner. Right? You got a user. You got an agency partner. You need an arrow between the 2.

If we're looking at, like, a your diagram of your your circles. You gotta have a relationship between the 2 to be able to filter permissions based on it. Right?

Speaker 0: Right.

Speaker 1: Alright.

Speaker 0: Right. I think. It's early. I'm having trouble conceptualizing this. So

Speaker 1: Okay. So, basically, we have to create a relationship between the user and the agency partner.

Speaker 0: Who's the user in this scenario?

Speaker 1: The the person who's logging in to update the actual information.

Speaker 0: The the team member? Like, the team

Speaker 1: The team member or the admin role. Right? They're still logging in to direct us.

Speaker 0: Gotcha. What would be that step?

Speaker 1: Alright. So you're gonna go to your data model.

Speaker 0: Going to the data model. Alright. Sorry.

Speaker 1: That's where we're gonna create the relationship. You're gonna go to your partners collection.

Speaker 0: Agency partners.

Speaker 1: Alright. And we're gonna create a relationship here. We're gonna create a relationship here.

Speaker 0: I don't know.

Speaker 1: We're gonna create a relationship here.

Speaker 0: Yeah. Where does, where do you create a relationship at? I have no idea.

Speaker 1: Right there, man.

Speaker 0: Where? Here? Create

Speaker 1: It has a field. Create a field. Yep. Alright. So you tell me what the relationship is gonna be.

Speaker 0: This is stringing into territory.

Speaker 1: Get, like, the, like, the jeopardy timer up? Yeah. Like, the final jeopardy question?

Speaker 0: This is where I'm not sure. Because when I think of a collection, I think of a form, like fields. And the admin here is gonna be creating a mini to 1. Right? Because it'll be multiple team members associated to one agency.

Speaker 1: Correct. They will create that via a form, or it's not just, like, automatically So we've gotta create the relationship first, and then you can have it automatically populate the information

Speaker 0: Okay.

Speaker 1: When users get created.

Speaker 0: So from the agency partner's perspective, it's gonna be many to 1 because on the other side is the team member that's a one. Now wait.

Speaker 1: That's it. No. No. No. If you've got if you've got multiple people that are part of the same agency, it is a The agency to many because a user belongs to one agency.

The agency could have many users.

Speaker 0: Gotcha. So

Speaker 1: here, you're gonna pick the one to one to many option.

Speaker 0: Okay. One to many.

Speaker 1: There you go. This is gonna be

Speaker 0: the admin is the one that's filling this out. So they're gonna be building they're gonna invite team members.

Speaker 1: User. You're gonna call it user. Yeah. Or servers. Users, plural.

There you go. Users. Alright. The related collection is going to be directus_users. That is a system collection.

That's why it's prefixed with directus. Yeah. And then for the foreign key, that's gonna be the field that holds the agency partner ID inside the Directus users table or the directus users collection. So that would probably be agency partner or agency partner ID.

Speaker 0: Is that something that's built already?

Speaker 1: No. You don't have to build it, though. If you key it in and it doesn't exist, Directus will create it for you.

Speaker 0: No. Agency partner ID.

Speaker 1: There you go.

Speaker 0: Okay.

Speaker 1: Alright. Doesn't really matter if we show these in a list or a table. Solid. Do we wanna show a link to the user? Probably.

Yeah. And we're gonna dismiss. Not sure why that error shows up. But now we have created a relationship. Right?

And if you go back to the data model, open up the system fields. There you go.

Speaker 0: Fields. System collection.

Speaker 1: There you go. Click on direct as users. So these are the system collections. You can't update any of the, like, the default fields, but we should see at the very bottom of this, you should see an agency partner ID field. You might wanna unhide that just for fun.

There you go. Alright. So we've got the relationship now. Now we can actually use that to restrict permissions. That make sense?

Speaker 0: Yep.

Speaker 1: Got it? Alright. So we're gonna go back to access control, and we'll we'll just do, like, the part agency partner admin for now because we that's the user that we've got. Alright. So down the bottom, you got scroll up to where you got the actual permissions.

There you go. Alright. So agency partners, all these are gonna be custom permissions. Right? So change this from all to custom for read.

Right? We only want them to be able to see their own agency.

Speaker 0: The admin?

Speaker 1: Right. K. So Alright. So for item permissions there oh, go back.

Speaker 0: So for here

Speaker 1: Yep. View. Go to use custom. Yeah. Alright.

So for item permissions, we're gonna add a filter for this. Right? And the filter is gonna be the ID. So the agency partner ID, right, is equal to we're gonna use a little bit of Directus magic here. You're gonna type in dollar sign, all caps, current_user.

So that's gonna give us the current user that's logged in. Right? We can use the related fields that are attached to that user in our filter here. So we're gonna do current underscore user dot agency underscore, you gotta get now we're going back all lowercase. There you go.

Partner

Speaker 0: underscore

Speaker 1: underscore ID. Right? That's the field that we set up on that particular on the direct us users collection. So now what we've just said is basically, hey. I can only read the agency partner's collection, like, the items within that collection that that equal this rule, which is only gonna be 1.

Right?

Speaker 0: Okay.

Speaker 1: Makes sense? Now what you're gonna do, click, click the drop down. Well, hover over rule or just the actual heading. Let me give you a shortcut. Yeah.

Or it it says rule right up above that. Click that. Click copy raw value. Mhmm. Save this.

And then go to the edit permissions for that agency partners Mhmm. And click use custom, and paste that there for the item permissions here. Say okay. So now we can only see our own agencies that we're a part of. We can only edit our own agency.

Now we have to go through and do something similar for projects. Right? Because I I shouldn't be able to edit some other agency's project.

Speaker 0: Right.

Speaker 1: So I can create projects. When when I go to custom here and instead of there's no item permissions for creating an item because there's we're creating an item. The item doesn't exist yet. We can't filter by it. But what we're gonna do for the presets, in this case, we're gonna give it a preset.

And the preset we're gonna do here, you're gonna do, the mustache brackets so we get some JSON. Okay. And within that, you're gonna create a new field. There you go. What do we hit enter.

Mhmm. And what are we gonna do here? Agency okay. So the if we're in the project trying to think of the field. What did we call the field relating back?

Partner. Okay. So you're gonna put partner in quotation marks. K. Colon.

There you go. Colon. Quotation mark. 2 left mustache brackets, dollar sign current, Whoop. That's a hash.

Current. Underscore user dot what? Agency underscore partner underscore ID. And then you're gonna close that mustache syntax and hit the quotation mark. Alright.

So what that's gonna do, whenever this user within this role creates a new project, it's gonna default the partner value to that specific field or to the agency partner ID that's attached to that user. So whenever they create a project, it's always gonna be scoped to that specific agency.

Speaker 0: Gotcha. Okay. That makes sense.

Speaker 1: Cool. So now you hit save.

Speaker 0: Should I oh, no. Because this is on creation. So

Speaker 1: Yep. And then so within that go back down. And then we're gonna apply custom permissions for the other items here. Right? Mhmm.

So the rule here is not gonna be ID because now we're inside the project. Right? We're not inside the partner anymore. So it's gonna be the partner dot ID. So there you go.

Expand that. Partner dot ID. Yeah. But it's gonna be the same value. Dollar sign current underscore user dot agency_partner.i oh, not dotid_id.

Yeah. You got it right. Alright. And now you can copy that, and you can apply it to all the other ones.

Speaker 0: This is something that's so for as I paste this, that, like, custom type of filter and and building the presets and things like that. Like, that's that's high level stuff. Like, like, the doc, would the docs be the best place to learn things like that, for somebody

Speaker 1: Yeah. There's a good primer on the on roles and permissions within docs. So hover over role. There you go. Paste.

But the the docs are certainly good. There's a couple of great guides on it as well. But all those variables that are available are documented there. Right?

Speaker 0: Yeah. And they should only be able to share their own things. There you go. Now Alright. So files or

Speaker 1: So for project files, that's a junction collection. We could go in and, like, scope that as well. It probably not necessary for for this episode.

Speaker 0: No. We can do that.

Speaker 1: Because, basically, what that project files collection is is just a, like, a pointer to a direct to file and a pointer to a project. There's nothing else that's being stored in there.

Speaker 0: Okay.

Speaker 1: Now the other thing that we're probably gonna want to adjust, and there's there's a couple ways we could get this done, is the file access. Right? We don't want them to be able to access all of our files.

Speaker 0: Mhmm.

Speaker 1: We don't want them to be able to delete our files. You know, we probably trying to think of the best way to scope this where you get tied to a specific user who has the same partner. Like, I could see only the files that we've uploaded into the system.

Speaker 0: So the Does

Speaker 1: that make sense?

Speaker 0: You're thinking of doing it tied to the main admin user, or would it be like a

Speaker 1: So each each user who is logged in is gonna have like, if they're part of this agency partner program, they're gonna have to be tied to a specific agency. Right? We should be able to go through that relationship and just show all of the files that were uploaded by members of that agency. I'm thinking we should be able to do that. This gets a little deeper into, like, the nesting, but, a couple things that I would do here.

Right? Like, the the other option is to do something like a folder or, you know, add we could go in and modify the Directus files collection to have a relationship to the actual agency. And then whenever a file gets created, we add the agency relationship to that specific file. So there's multiple ways we could achieve it. I'm trying to think of the the easiest one to do for for this one.

Speaker 0: Here's a question. Should we make a part 3 where we focus on kind of the system collections and how they interact with, like, the role based access control stuff.

Speaker 1: Where are we at time wise?

Speaker 0: We're coming up on about an hour. So may I mean, that seems like a good part through to me, because it sounds like it's gonna be a little bit more in the weeds on kind of structuring this out on the more of the back less of the partner directory itself, so more of, like, how Directus interacts with specific roles and and things like that. So, if you think it's quick fix, quick solution, I'm up for it. But

Speaker 1: Hey. Let's log in and test this out. Hey. Let's test what we've got so far Alright. And see see how that's working.

Right? So at at this point, like, actually, do one more thing for me. Go to the system collections, and we wanna restrict access to the insights. Right? So if you go into Directus dashboards

Speaker 0: Directus dashboards here.

Speaker 1: Just set that to none. So there's a shortcut over there. Right? Go to Directus panels.

Speaker 0: Panels.

Speaker 1: Set that to none. Mhmm. There you go. Alright. So that should limit any of the actual folks from seeing any of the inside spales.

Speaker 0: Great. Okay.

Speaker 1: Oh, and then the other thing that we wanna do here, where this is the agency partner role, So where it says direct as

Speaker 0: roles Mhmm.

Speaker 1: We let's change that. So add a custom permission for that.

Speaker 0: For which one?

Speaker 1: For the the read.

Speaker 0: Read. Use custom.

Speaker 1: Alright. So for the role here, we want to, what roles do we wanna see? The roles of the item yeah. So there's a oh, okay. I think it's actually already set in it.

ID equals current rule. Follow automatically applied when okay. So I think that should be good then.

Speaker 0: Okay. So they'll only be able to see because we should they should only be able to see in the in the admin of, like, users. It should just be their agency users. Yeah.

Speaker 1: Right. No. So what we need to do there is we just need to add a condition to the direct as users collection instead of the role. So go ahead and close this. Scroll down to direct as users, and the read there is the one that we're gonna update.

Speaker 0: Okay.

Speaker 1: Alright. So the yeah. It's gonna be the agency partner. You should be able to search for it. Agency partner ID.

Yep. There you go. Equals current, dollar sign. Right? Current underscore user.

Yeah. Dot agency_partner.id. Great. Alright. So now let's log in.

We'll worry about files later. We're gonna open up that other browser, whatever you had. Now hit refresh.

Speaker 0: And any other agency projects or partners.

Speaker 1: And you shouldn't be able to see any projects either because we don't have any Yeah. Yeah. We don't have any projects, but as far as the user directory, I shouldn't see any other users either.

Speaker 0: I see myself.

Speaker 1: Yeah. And and, again, like, we could go in and restrict that list of roles, I guess. You know, not particularly sensitive, but, you know, we could restrict that to just the agency partner roles if we wanted to. You know, files, they're still gonna be able to see all files. But what I'm gonna do behind the scenes here, we don't have this relationship between your fake user and the project or the agency.

Right? So that's why you're not seeing any projects. Maybe you wanna pull the admin back up. That way we could just show everybody, I guess. Mhmm.

Alright. So go to your user's directory. Here. In the the module bar. So, like, the actual user's directory.

There you go. Alright. Find your fake person. And I don't want any scrubs on my team, so it could be in your agency.

Speaker 0: Don't want no scrubs.

Speaker 1: Agency So the agency partner ID, yeah, you could put them in your agency, and hit save. So now you've added that user to that agency, and that user has the appropriate role. They've got a partner ID that's linked. If you log in as that user now, if you switch back to that incognito window and hit refresh Mhmm. We should see, like, on the agency partner side of it, should see your agency.

And, like, if you click into it, should have the ability to edit that as well. Wonderful.

Speaker 0: It's just okay. Yeah. Just okay. Oh, cool. So, and then here we could instead of, you know, a table layout, I could do map.

And wherever the country is, maybe that shows up here.

Speaker 1: Very cool. There you go. So now within that, right, we could go in and like, you could go in and flesh out all of your projects if you wanted to.

Speaker 0: Yeah. And then they would all automatically be associated just with that single agency because that's what the person's Correct. Fantastic.

Speaker 1: Yeah. So as far as, like, the the next steps, right, would be a figure out I I I at this point, I don't think we fully understand how we wanna scope, like, the file library because, yeah, I would think that it it would be helpful for agency partners to have access to, like, all the brand assets.

Speaker 0: Right.

Speaker 1: Right? There's there's certain internal files we wanna give them access to, but, you know, there's probably some private things that we wouldn't want them to have access to. So it it would make sense to do it on a combination of maybe, like, folder structure and files that they've uploaded as well. Like, any of the files that we've uploaded, they can't change. They could read those files.

They could download them. They can't delete or edit. But files that they've uploaded, you know, maybe they've got the ability to edit or replace those.

Speaker 0: That's a great point. That brand kit. Alright. Awesome. Well, episode 2, part 2.

I feel like we've covered a lot of good ground here. Part 1, we got the actual data model set up. Part 2, we got the roles and access. Next part, part 3, we'll talk about how to share specific internal assets, how they can upload assets, and only access the things that they need within a direct instance test.