Share announcement read grant with Enterprise User and Read-Only roles

[posthog-eu]

Problem

• Customers on the Enterprise User and Read-Only roles saw no dembrane announcements and no sidebar inbox unread count since the inbox shipped in ECHO-936 feat(inbox): surface dembrane updates in the sidebar #993. We announce to them and they never see it.
• The announcement read grant (announcement, announcement_translations, announcement_activity) sits on one policy, the Basic User Policy, which is attached to the Basic User role only. Any other app role gets a Directus FORBIDDEN the moment the sidebar loads.
• The sidebar summary poll runs every 60 seconds and reports each failure to error tracking, so one signed-in session repeats the 403 all day.

Changes

• Add a dedicated read-only Announcements policy and attach it to the Enterprise User and Read-Only roles. It grants read on announcement content plus read/create/update on the per-user activity rows, so the inbox and its unread count work while announcement content stays read-only. Basic User keeps its own grant, untouched.
• Ship the change as an idempotent Directus REST migration script (directus/migrations/add_announcement_read_policy.py), per the repo's Directus workflow, and update the sync collection JSON to the same end state.
• Delete the unused useWhatsNewAnnouncements hook. It had zero references and, unlike its siblings, was not gated on currentUser.

Why a shared policy

Option	Result
Attach Basic User Policy to the other roles	Over-grants: Read-Only would gain write access to projects, conversations, and more
Duplicate every announcement permission per role	Same grant maintained in three places
Dedicated Announcements policy, one set of rows, attached to each role	Scoped to exactly the announcement grant, edited in one place

Agent context

• Directus could not run in the automation environment, so the sync JSON was authored to match the migration script's end state. A maintainer should run the script against Directus and bash sync.sh ... pull to regenerate canonical sync IDs before deploy. Both paths push cleanly.
• announcement_activity delete and announcement update (both present on Basic User Policy) are left off the new policy on purpose: the frontend never calls them, and omitting them keeps Read-Only read-only.

---

Created with PostHog Desktop from this inbox report.