How to differentiate server requests from frontend requests for Access Control

haniel.u

2 months ago

45

• 

  notchr

  2 months ago

  I think the APIs share the same REST pattern when making calls, what is the use case for differentiating here?

• 

  haniel.u

  2 months ago

  The client I'm building for doesn't want a user who is not a super admin to be able view some collections on the payload dashboard, it should only be accessible from the custom frontend I'm building.

• 

  notchr

  2 months ago

  You can specify what a user can view via admin access control I believe

  
  

  
  

  Let me double check

  
  

  
  

  @haniel.u Collections can take an "admin" object, that has some options, including "hidden"

  
  

  
  

    admin: {
      useAsTitle: "positionTitle",
      group: "Careers",
      hidden: (req) => !isHR(req.user),
    },

  
  

  
  

  I copied that from myh project, but isHR is a function that checks the user role (in my case if they are HR)

  
  

  
  

  But I think that is what you want?

• 

  haniel.u

  2 months ago

  Yes

  
  

  
  

  That's it exactly!!

• 

  notchr

  2 months ago

  Let me know if that works for you! Otherwise happy to help troubleshoot

• 

  haniel.u

  2 months ago

  I will, Thank you so much

• 

  notchr

  2 months ago

  No problem, good luck!

• 

  haniel.u

  2 months ago

  It's really not working as expected

  
  

  
  

  Am I doing it wrong?

  
• 

  notchr

  2 months ago

  Hmm

• 

  haniel.u

  2 months ago

  It hides it

  
• 

  notchr

  2 months ago

  return !user.roles.includes("super_admin")

  
  

  
  

  Is that what youre doing?

• 

  haniel.u

  2 months ago

  yeah

• 

  notchr

  2 months ago

  And Feed Posts should be hidden from the sidebar for non admins

  
  

  
  

  ?

• 

  haniel.u

  2 months ago

  And It's hides it regardless of if the role is there or not

  
  

  
  

  Yeah

• 

  notchr

  2 months ago

  Oh weird

  
  

  
  

  Can you log user.roles

• 

  haniel.u

  2 months ago

  I can't even log user

• 

  notchr

  2 months ago

  Undefined?

• 

  haniel.u

  2 months ago

  Nothing happens

  
  

  
  

  yeah I probably

• 

  notchr

  2 months ago

  ok one sec

  
  

  
  

  Wait probably?

  
  

  
  

  You're saying you cant even log console.log('test')

• 

  haniel.u

  2 months ago

  yes

• 

  notchr

  2 months ago

  and have it show up?

  
  

  
  

  That means the control isn't getting hit hmm

• 

  haniel.u

  2 months ago

  I mean it works if I do this, just that nothing gets logged to the console

  
• 

  notchr

  2 months ago

  You would see the log if that was being parsed

  
  

  
  

  So that's concerning

  
  

  
  

  you're checking your app log right

  
  

  
  

  Not the browser

• 

  haniel.u

  2 months ago

  yeah

  
  

  
  

  
• 

  notchr

  2 months ago

  can you throw an error out of curiosity

  
  

  
  

  throw new Error('test')

• 

  haniel.u

  2 months ago

  lemme try

  
  

  
  

  ohhh

  
  

  
  

  oh

  
  

  
  

  ohhhh

  
  

  
  

  It's being logged in the browser

• 

  notchr

  2 months ago

  Ohhhh

• 

  haniel.u

  2 months ago

  

  
• 

  notchr

  2 months ago

  no 'roles' field

  
  

  
  

  why is that?

• 

  haniel.u

  2 months ago

  i jave no idea

• 

  notchr

  2 months ago

  Did you configure one on the admin collection?

• 

  haniel.u

  2 months ago

  I configured many others too

  
  

  
  

  It's just the basic one

• 

  notchr

  2 months ago

  Can I see the one on the admin collection

• 

  haniel.u

  2 months ago

  
  

  
  

  I wonder if I have to savetoJwt

  
• 

  notchr

  2 months ago

  i mean, that would expose it, but access should have still picked it up

• 

  haniel.u

  2 months ago

  But this isn't access

• 

  notchr

  2 months ago

  I do in my example, here's mine

• 

  haniel.u

  2 months ago

  This is admin

• 

  notchr

  2 months ago

      {
        name: "role",
        type: "select",
        hasMany: true,
        saveToJWT: true,
        defaultValue: "none",
        options: [
          {
            label: "None",
            value: "none",
          },
          {
            label: "Super Admin",
            value: "superAdmin",
          },
          {
            label: "User Admin",
            value: "userAdmin",
          },
          {
            label: "CMS Admin",
            value: "cmsAdmin",
          },
        ],
      },

• 

  haniel.u

  2 months ago

  yeah

  
  

  
  

  Makes sense

• 

  notchr

  2 months ago

  Lets try that

• 

  haniel.u

  2 months ago

  Yup that works

  
  

  
  

  Thank you so much for your help!

  
• 

  notchr

  2 months ago

  WOOT!

  
  

  
  

  Of course, let us know if anything else comes up

  
  

  
  

  Have a good one 😄

• 

  haniel.u

  2 months ago

  You too!

• 

  jarrod_not_jared

  Payload Team

  2 months ago

  It was the

  saveToJWT

  that you were missing, just for clarity!