Can still access collection when read is set to false (payload 3)

drd.devlast year

6

  access: {
    read: () => {
      return false
    },
  },

  const cabinets = await payload.find({
    collection: 'cabinets',
    depth: 1,
    limit: 10,
  })

• 

  zed0547last year

  Hey

  @126595896556257280

  ,

  
  
  

  So, I think when you call the Payload Local API from your server, it's done so with "elevated permissions" so to speak. Basically, since it's the server, it kind of bypasses access controls. Or, a better way to put it, is Access Controls are more for User-driven interactions rather than your server

  
  
  

  I know you mentioned that you're calling the local API from a "frontend" component, but that does not mean it is not executed on the server. In fact, NextJS is Server first by default, and you actually have to specifically dictate that code should run exclusively on the clientside.

• 

  drd.devlast year

  ahhhh that makes sense. I guess making my own end point and manually checking auth would be my best bet then?

• 

  zed0547last year

  That's definitely an option! You could also perform an auth check

  just

  before you call the local API as well in whatever flow you had it in originally. I think there's some examples of authenticating manually in the examples/templates folder - if you need them.

• 

  drd.devlast year

  awesome, I'll check those out. Thanks so much for your help!

• 

  zed0547last year

  My pleasure

• 

  drd.devlast year

  just wanted to provide a quick update for anyone else with the same issue, You can set this flag in your .find to disable the default Access override