How to distinguish request between LocalAPI and REST API in field hooks?

Nikichlast year

12

hooks: {
  afterRead: [
    args => {
      if (args.req.headers['x-payload-localapi']) {
        return args.value;
      }

      return 'The value of this field is visible only for developers.';
    },
  ],
},

• 

  jmikrut

  last year

  you should use access control here

  
  

  
  

  the

  req.payloadAPI

  property is definitely working properly, but you might be seeing it run as

  local

  if you have hooks or similar that run and then retrieve a doc via local api

  
  

  
  

  but if i were you, i'd use field-level access control. if you think about this, that's really what you are needing to do - - you need to restrict access to certain fields for your users

  
  

  
  

  so maybe

  update

  and / or

  read

  access control should be utilized, letting them

  create

  the value(s), but then not update them

  
  

  
  

  you could certainly also use field-level hooks to

  obscure

  the values, but the best way in that function would be to look at the

  req.user

  instead of a header

  
  

  
  

  so at that point you'd have an access control idea running in a hook

• 

  Nikichlast year

  Do field level hooks fire after collection's hooks?

  
  

  Checking

  req.user

  sounds like a good idea, thanks! 🙂

  
  
  

  If I use access something like this

  { read: () => false }

  , then this field is hidden in UI even if I create new collection value.

  
  

  
  

  Hm, looks like I have to introduce new role

  Developer

  and check that role in

  access

  prop if

  req.user.role === Role.Developer

  then show real DB values, in any other cases mangle them.

• 

  jmikrut

  last year

  you should look at the operation code within Payload to get a handle on what runs when. We will be adding more lifecycle-based info to our docs, but until then, looking at the operation code is the best bet

  
  

  
  

  that sounds right to me