Restrict access on auth's email field

chrispy.qlast year

7

// Users collection
  access: {
    create: isAdmin,
    read: () => true,
    update: isAdminOrSelf,
    delete: isAdminOrSelf,
  },

• 

  jarrod_not_jared

  last year

  Hey

  @690590499202924574

  I think this is a great observation. If update results in false we should not show anything but the field when viewing an existing doc

• 

  chrispy.qlast year

  Thanks for confirming I was wondering if there might be some configuration option that I missed. Also the field should be read-only similar to the others. I can open an issue in github to address this

  @281120856527077378
• 

  kevscriptlast year

  Hey, not sure if I should be opening a new topic, but I have a similar problem. Since I'm providing a custom email for my users and setting up their account with it, I'd like to prevent none-admin users from ever modifying that email. I can't find a way to modify access to that auto-generated email field on an auth collection. Any update on that?

• 

  chrispy.qlast year

  The problem I was facing was solved with the UI update. It is still possible to edit fields of another user (as editor via bulk edit) but those changes wont get applied it says “Successfully updated 0 Users” or something like that. Your specific case is a bit different not sure if this is possible yet. Maybe it is worth a new github issue 🙂

• 

  kevscriptlast year

  Hmm thanks for the update

• 

  chrispy.qlast year

  You’re welcome

• 

  kevscriptlast year

  Ok just to update for anyone, the solution was pretty similar. You can initialize an auth collection with your own configured field with

  { name: "email" }

  , which should overwrite the generated one. If you set

  access: { update: isAdmin }

  on it, the field won't appear as read only to none-admin users as other classic fields,

  but

  it will not keep the changes on save even tho the

  success

  toast appears.