Access control in collection

dtoa.9 months ago

2

import { Access } from "payload/config";

export const isAdminOrHasCollectionAccess = (collectionSlug: string = ''): Access => async ({ req: { user } }) => {
    if (user) {
        if (user.roles.includes('admin')) return true;

      
        if (user.roles.includes('editor') && user.access?.length > 0 && user.access.includes(collectionSlug)) {
            return {
                createdBy: {
                    equals: user.id,
                },
            };
        } else {
            return false;
        }
    }
    return false;
}

    access: {
        read: isAdminOrHasCollectionAccess('housing_and_shelter'),
    },

  // Non-logged in users can only read published docs
  return {
    _status: {
      equals: 'published'
    }
  };

• 

  notchr10 months ago

  @711506236998418442

  Sorry, which operations do you want to restrict?

  
  
  

  hmm

  
  
  

  At work I do

  
  
  

  import type { Access, FieldAccess } from 'payload/types';
  
  import type { Admin } from '../payload-types';
  
  export const isSuperAdmin: Access<
    any, // eslint-disable-line @typescript-eslint/no-explicit-any
    Admin
  > = ({ req: { user } }) => {
    return Boolean(user?.role.includes('superAdmin'));
  };
  
  export const isCmsAdmin: Access<
    any, // eslint-disable-line @typescript-eslint/no-explicit-any
    Admin
  > = ({ req: { user } }) => {
    return (
      Boolean(user?.role.includes('superAdmin')) ||
      Boolean(user?.role.includes('cmsAdmin'))
    );
  };

  
  
  

  But they added a new "admin" access rule

  
  
  

  Idk if it necessary but

  
  
  

    access: {
      read: () => true,
      create: isUserAdmin,
      update: isUserAdmin,
      delete: isUserAdmin,
      admin: ({ req: { user } }) => {
        return (
          user.role.includes('userAdmin') || user.role.includes('superAdmin')
        );
      },
    },

  
  
  

  is an example of how i apply roles

  
  
  

  (the type for admin access control was different than normal so that's why i have an extra check on admin)

  
  
  

  hmmm wdym

  
  
  

  Oo that seems promising, whered ya see that?

• 

  arstoien_3991810 months ago

  Using

  _status: 'published'

  is how I'm currently doing this. I believe if you add versioning to the collection, this field is automatically added.

  
  
  https://payloadcms.com/docs/versions/overview