Help About Access Control

kisut_8 months ago

2

read: isAdminOrSelf,
update: isAdminOrSelf,
delete: isAdminOrSelf,

import { Access } from "payload/config";

export const isAdminOrSelf: Access = ({ req: { user } }) => {
  // Need to be logged in
  if (user) {
    // If user has role of 'admin'
    if (user.roles?.includes('admin')) {
      return true;
    }

    // If any other type of user, only provide access to themselves
    return {
      id: {
        equals: user.id,
      }
    }
  }

  // Reject everyone else
  return false;
}

• 

  hristo60048 months ago

  This

  isAdminOrSelf

  access hook is meant for the Users collection, anywhere else it won't work, because it's checking whether the

  id

  of the document matches the

  id

  of the user.

  
  
  

  The media doesn't appear to exist for the user that has uploaded it, because the rights are not set up correctly (hence 404 after uploading).

  
  
  

  To fix this, you'll need a way to check whether the current user has created the media document. This can be done with additional field, like

  createdBy

  .

  
  
  

  1) You need to create a

  createdBy

  field in your media collection

  
  

  2) Then when you create a new media document, this field needs to be automatically populated with the current user's

  id

  , this will be useful for the access hook later to check whether the user's

  id

  matches with the

  id

  saved in

  createdBy

  .

  
  
  

  After you have your

  createdBy

  field, add the following hook:

  
  
  

  import type { CollectionBeforeChangeHook } from 'payload'
  
  export const populateCreatedBy: CollectionBeforeChangeHook = ({
    data,
    req: { user },
    operation,
  }) => {
    if (operation === 'create') {
      if (user) {
        data.createdBy = user.id
  
        return data
      }
    }
  
    return data
  }

  
  
  

  Import it in your media collection and set it as a

  beforeChange

  hook:

  
  
  

  hooks: {
    beforeChange: [populateCreatedBy],
  }

  
  
  

  Then for your read access, you can do something like this:

  
  
  

  import { Access } from "payload/config";
  
  export const isAdminOrSelf: Access = ({ req: { user } }) => {
    // Need to be logged in
    if (user) {
      // If user has role of 'admin'
      if (user.roles?.includes('admin')) {
        return true;
      }
  
      // If any other type of user, only provide access to themselves
      return {
        createdBy: {
          equals: user.id,
        }
      }
    }
  
    // Reject everyone else
    return false;
  }

  
  
  

  There might be some modifications here and there, but hopefully this helps.

• 

  kisut_8 months ago

  It's working, thanks

  @415764121280184330

  !