Multi tenant setup and access control

letobbe

10 months ago

10

• 

  jacobsfletch

  Payload Team

  9 months ago

  This is a common pattern and should be totally doable. Your relationship needs to be set on the

  Users

  collection instead of

  OrganisationMembers

  so that

  req.user

  contains all the data needed in your access control hooks. This also means you could remove your

  OrganisationMembers

  altogether. Check this out:

  
  
  

  {
      type: 'array',
      name: 'access',
      fields: [
          {
              type: 'select',
              name: 'name',
              options: [
                  {
                      name: 'Read',
                      value: 'read'
                  },
                  {
                      name: 'Write',
                      value: 'write'
                  },
              ]
          },
          {
              type: 'relationship',
              relationTo: 'organisations'
          }
      ]
  }

  
  

  
  

  For anyone dropping into this thread, we just shipped an official multi-tenant example, check it out!

  https://github.com/payloadcms/payload/tree/master/examples/multi-tenant
• 

  taun2160

  4 months ago

  Not sure if it's relevant to your case - there's a multi-tenancy example in this vid:

  
  https://www.youtube.com/watch?v=DoPLyXG26Dg
• 

  wiesson

  4 months ago

  Is it possible to somehow switch between the tenants? (Like a global dropdown) - I'd like to maintain 5-6 pages with a single payload instance.

  
  
  

  I have created a sites collection and each page has a relation to a site - so that works, but it's a bit cumbersome to filter the content or to see the whole content of all pages at once (images, collections, ...)

• 

  jacobsfletch

  Payload Team

  4 months ago

  Could you log in as a super-admin?

• 

  jarrod_not_jared

  Payload Team

  4 months ago

  @wiesson I think we could add another field to the user config. i.e. a relationship field

  viewAsTenant

  and then we could adjust access control to take that into account if it is set.

  
  
  

  @jacobsfletch not sure if this is something we want to support out of the box? I could give it a go if you think so. I do see the value.

• 

  Bouba

  4 months ago

  I was thinking that we should add a component in beforeNavLink. This component will be a dropdown that will be selected with the lastLoginTenant and if we change the selection we update the lastLogin tenant.

  
  

  Moreover we should also add a interval of like 3 minutes where we refetch the last value to be sure that we don’t have any stale data.

  
  

  If we do that we can improve the access control by only showing every time the data of this tenant.

  
  

  What do you think ?

• 

  jacobsfletch

  Payload Team

  4 months ago

  @jarrod_not_jared totally as long as it doesn't overcomplicate the example, but I think @Bouba is spot on here we can reuse the existing

  lastLoggedInTenant

  field. Although I don't think we should add any time interval to this example. I went ahead and took a stab at this just now, check it out!

  https://github.com/payloadcms/payload/pull/2719
• 

  techinverted

  3 weeks ago

  @jacobsfletch How do i setup the dns records for the admin panel? I have pointed my A record to the server IP address, but it isn't working

  
  

  
  

  This is for the client admin page and not for the super-admin admin page

• 

  jacobsfletch

  Payload Team

  3 weeks ago

  @techinverted Are you on Payload Cloud? If not, a simple A record should work just fine, but if you're using Nginx as a reverse you'd need to also ensure your server blocks are setup properly

• 

  techinverted

  3 weeks ago

  Okay, so I’ve used an A record and I’m still getting “404 page not found”, I’ll look into the nginx config