I searched and found a few issues about this. The solution seems to be to enable versions and drafts and then swap out the Publish button with a custom component. This works great.
However, I’m worried about people hacking on the front end and need some server side validation that only certain roles can publish drafts.
I tried the beforeValidate hook, but I don’t believe we can access the user there.
Am I wrong? Is there another approach to block publishing content to one or more roles?
Thanks.
I answered you in GitHub, but this may be a better place for discussion. You totally have access to the user on the req in a before validate function! Want to share a snippet of the collection hook code you are working with?
Hi did you implemented it? if yes could you share it please, also was searching for this type of solution
access control
https://payloadcms.com/docs/access-control/overviewhere's a snippet of my access control for
read
on a collection:
export const versionedRead: Access = ({ req }) => {
if (req.user) {
// api user can't see drafts
if (req.user?.role === 'api') {
return {
_status: {
equals: 'published',
},
}
}
// all other authd users can see drafts
return true
}
// no unauthenticated users
return false
}
thanks I also want to change publish button to send to approve and so admin users will see list of approval, and only admin able to publish
did you tried to implement something of this kind
nope i haven't done any custom components yet
Are you going to?
if yes let's share ideas and examples on how to implement it, anyways I am going to make custom components
Hi there, so I want to make the custom button for Publish and change it to Send to Approve which will send it to Approve collection, where admins could publish and then some type unread/read and notifications only from collection of Approve
Star
Discord
online
Get dedicated engineering support directly from the Payload team.