Complex Permissions: Cascading Item-level Access through M2A to directus_comments and Related Files

Help
1

Directus Version: 11.11.0

1. Goal

I am trying to implement a permissions model where access to a comment (from directus_comments) is strictly determined by the user’s access to the item the comment is attached to. This must also cascade to files attached to the comment.

The desired logic is:

User can read Item X → User can read all Comments on Item X → `User can read all Files on those Comments

`

2. Current Setup

  • I have extended the directus_comments collection with a Many-to-Any (M2A) relationship field (e.g., collections), linking comments to items in various other collections (e.g., articles, pages, test).
  • A separate files relationship field on directus_comments links to the directus_files collection.

3. The Problem & What I’ve Tried

The core issue is that permissions for directus_comments cannot seem to dynamically reference the permissions of the parent item via the M2A relationship.

I tried to create a read permission rule for the directus_comments collection that checks the status of the linked item in the test collection:

image
image1096×567 21.9 KB

image
image1744×952 90.4 KB

image
image1044×867 48.5 KB

image
image1039×898 59.9 KB

Result: This does not work. Users only see their own comments, not all comments on items they have access to read.

Assumption: The permission system cannot perform a deep relational query across an M2A junction to validate the status of the parent test item.

4. Key Details

  • The test collection has item-level permissions: users can read an item if status is 'published' OR if they are the user_created.
  • The junction table for the M2A relationship currently has full read/create permissions.
  • The goal is for the comment permissions to be dynamic and inherit the rules of their parent collection/item.

Any guidance, clarification on syntax, or suggested alternative approaches would be immensely helpful. Thank you!