Refined access control for uploads
How would you go about only allowing users to see their own images within the admin panel. But whilst still allowing public read access to the URL for display on the front-end?
For more detail, I have a
mediaupload collection that has a user field, which is set to too the user that creates the asset. I would like to be able to have the user see their own images in the Media collection, and not other images. But I can't seem to find a way to restrict this, without blocking read access to the asset URL. Is there something in the request object I can use?
I'm no expert, nor know how to implement it in code, but the logic would be to allow public access to the underlying URL && some kind of an custom access control hook which allows only the uploading user to their own uploads. Right? I guess you need to check the access control and hooks docs, there are examples on the payload github
I got a similar issue. I think the best way forward is configuring strict access controls and then add a custom endpoint that exposes all data
Another option would be to add an express middleware that adds a filter (by modifying req.query) if the request referer contains /admin but that is probably a rabbit hole.
And another idea: configure the access controls such that anonymous read is allowed but authenticated read is limited to your own.
Thanks @Arskeliss and @thgh. In the end I found a way using the cloud storage plugin. I enabled public read ACL, and disabled the access control via the plugin which reveals the actual object storage URL instead of the rewritten payload one. And then I just added a CDN onto the cloud storage in this case via digital ocean and added the rules I needed in the collection config. Works well.
Hi. How can I bypass the access restriction via custom endpoints?
If I understood correctly, the restrictions apply to each endpoint
Solved it by adding overrideAccess
You are using this inside payload or your frontend?
Inside payload.
The global payload object cannot take access restrictions into account as it is not aware of who is querying? Or are you using req.payload (which I think is also unrestricted but starting to doubt that now)?
Seems it take into account the restrictions. At least it didn't work until I added the overrideAccess as true
In the documentation says that if the overrideAccess is false, you have to pass the user to use against the access control checks.
So another solution is to create a dummy user object and use it to bypass the restriction. But for me overrideAccess: true looks better
Well, the docs say the default is true so that's peculiar. (Which matches my experience)
Continue the discussion in Discord
Star
Discord
online
Get help straight from the Payload team with an Enterprise License.