Access based on originalDoc data

chladog

12 months ago

1 1

• Selected Answer
  

  jmikrut

  Payload Team

  12 months ago

  Hey @chladog — question for you.

  When you say:

  Now I need to write an access functions that will resolve true only if user.id === doc.owner. I stuck here as access functions don't pass doc data.

  Do you want to use field hooks, or collection-level hooks here?

  If collection level, this is actually super easy. In access control, you can return a query constraint to restrict which documents that a user can perform actions against.

  Here's an example of how we would normally do something like this:

  const adminOwnerAccess = ({ req: { user } }) => {
    // If user is admin, return true
    if (user && user.roles.includes('admin')) {
      return true;
    }
  
    // If there is a user, return a query constraint
    // that only allows users to perform actions against
    // documents where the owner is equal to their user ID
    if (user) {
      return {
        owner: {
          equals: user.id,
        },
      };
    }
  
    // If neither of the above conditions are met,
    // Block access
    return false;
  };

  Is this what you need? Note, we might need to expand on our docs if you didn't see that this is possible via documentation. It's one of the strongest features of our access control!

  3 replies
• 

  chladog

  12 months ago

  oh, right! I even had it implemented similiary in other collection already facepalm.

  Though how to implement same logic with FieldAccess?
  My collection has following structure:

  {
  owner: User
  editors: User[],
  someData: {
       ...
  }

  Required behavior is that User who is an Owner or one of the Editors can update the document (solved already by query constraint).
  But only Owner can change Owner and Editors field.
  Editor can change everything except Owner and Editors.

• 

  jmikrut

  Payload Team

  12 months ago

  OK I just released payload@0.14.30-beta.0 which now includes doc in the field access function arguments for both read and update operations.

  You can read whatever you want off that original doc. But note that the doc is only available in read and update operations, as there will be no doc in create. There, you'll need to check the incoming data property due to the document just recently having been created.

  How's that? Give it a shot!

• 

  chladog

  12 months ago

  Working like a charm. Perfect, thank you!