API endpoint authentication

radishkitten2 years ago

6

• 

  notchr2 years ago

  Hello

  @1019667378960863293

  !

  
  
  

  You want to setup up Access Control for your collections

  
  
  https://payloadcms.com/docs/access-control/collections
  
  

  For instance, if you have your Pages Collection

  
  
  

  const Pages: CollectionConfig = {
    slug: "pages",
    access: {
      create: ({ req: { user } }) => { ... },
      read: ({ req: { user } }) => { ... },
      update: ({ req: { user } }) => { ... },
      delete: ({ req: { user } }) => { ... },
      admin: ({ req: { user } }) => { ... },
    },
  };

  
  
  

  Each type of operation in access (create, read, etc) has a function as its value

  
  
  

  The function should return a boolean

  
  
  

  Some folks implement role-based access and have slightly more complex access logic

  
  
  

  If you can elaborate on how you want the access to work, I can suggest a configuration

• 

  paulpopus2 years ago

  ^^^

  
  
  

  And if you need helper plugins, I'll shill mine and another one:

  
  https://github.com/NouanceLabs/payload-simple-rbac
  https://www.npmjs.com/package/payload-rbac
• 

  radishkitten2 years ago

  Oh yeah

  @858693520012476436

  we definitely used yours at first but then we somewhat copied what payload itself uses, which is defining roles in /access/ and referencing them later on in Pages.ts

  
  access: { read: (isAdminOrHasSiteAccessOrPublished || isTech), create: (isAdminOrHasSiteAccess('id') || isTech), update: (isAdminOrHasSiteAccess('id') || isTech), delete: isAdmin,
• 

  paulpopus2 years ago

  interesting, im up for updating my plugin with further utilities if it stays within the scope of its simplicity...what limitations did you have?

• 

  radishkitten2 years ago

  @858693520012476436

  I think one of my devs just preferred the cleaner look 🙂 No biggie

• 

  paulpopus2 years ago

  thats actually the main reason i didnt do anything complex for mine...with payload its much easier to roll your own solution than to have an overengineered plugin that might still not do everything you need