Refined access control for uploads

default discord avatar
tompatrick
6 months ago
15

How would you go about only allowing users to see their own images within the admin panel. But whilst still allowing public read access to the URL for display on the front-end?



For more detail, I have a

media

upload collection that has a user field, which is set to too the user that creates the asset. I would like to be able to have the user see their own images in the Media collection, and not other images. But I can't seem to find a way to restrict this, without blocking read access to the asset URL. Is there something in the request object I can use?

  • default discord avatar
    Arskeliss
    6 months ago

    I'm no expert, nor know how to implement it in code, but the logic would be to allow public access to the underlying URL && some kind of an custom access control hook which allows only the uploading user to their own uploads. Right? I guess you need to check the access control and hooks docs, there are examples on the payload github

  • default discord avatar
    thgh
    6 months ago

    I got a similar issue. I think the best way forward is configuring strict access controls and then add a custom endpoint that exposes all data



    Another option would be to add an express middleware that adds a filter (by modifying req.query) if the request referer contains /admin but that is probably a rabbit hole.



    And another idea: configure the access controls such that anonymous read is allowed but authenticated read is limited to your own.

  • default discord avatar
    tompatrick
    6 months ago

    Thanks @Arskeliss and @thgh. In the end I found a way using the cloud storage plugin. I enabled public read ACL, and disabled the access control via the plugin which reveals the actual object storage URL instead of the rewritten payload one. And then I just added a CDN onto the cloud storage in this case via digital ocean and added the rules I needed in the collection config. Works well.

  • default discord avatar
    mihanc
    6 months ago

    Hi. How can I bypass the access restriction via custom endpoints?


    If I understood correctly, the restrictions apply to each endpoint



    Solved it by adding overrideAccess

    image.png
  • default discord avatar
    Arskeliss
    6 months ago

    You are using this inside payload or your frontend?

  • default discord avatar
    mihanc
    6 months ago

    Inside payload.

  • default discord avatar
    thgh
    6 months ago

    The global payload object cannot take access restrictions into account as it is not aware of who is querying? Or are you using req.payload (which I think is also unrestricted but starting to doubt that now)?

  • default discord avatar
    mihanc
    6 months ago

    Seems it take into account the restrictions. At least it didn't work until I added the overrideAccess as true



    In the documentation says that if the overrideAccess is false, you have to pass the user to use against the access control checks.



    So another solution is to create a dummy user object and use it to bypass the restriction. But for me overrideAccess: true looks better

    image.png
  • default discord avatar
    thgh
    6 months ago

    Well, the docs say the default is true so that's peculiar. (Which matches my experience)

Open the post
Continue the discussion in Discord
Like what we're doing?
Star us on GitHub!

Star

Connect with the Payload Community on Discord

Discord

online

Can't find what you're looking for?

Get help straight from the Payload team with an Enterprise License.