Graphql api draft option not working for unpublished documents

default discord avatar
Stupidism
9 months ago
1 3

Bug Report

I found our draft articles and unpublished articles are shown in prod env.

Steps to Reproduce

  1. Open pages list in demo site and publish the first article
  2. Publish the second article and then unpublish it directly

image

  1. Open the graphql-playground:
    https://demo.payloadcms.com/api/graphql-playground

Input this query and execute:

# Write your query or mutation here
query getPages {
  Pages(draft: false) {
    docs {
      slug
      _status
      updatedAt
    }
  }
}

image

Other Details

  • discord user avatar
    jmikrut
    Payload Team
    9 months ago

    Your understanding in your second comment is correct - the draft: true argument replaces any docs in your main collection with their newest drafts, which would be stored in the _versions collection.

    We do have docs about this - take a look here:
    https://payloadcms.com/docs/versions/drafts#controlling-who-can-see-collection-drafts

    Basically, the draft argument alone does not restrict who can see drafts. If you need that, you need to do that with access control. The draft arg simply does what is stated above.

    Does that make sense? I will convert this to a discussion as I don't believe there's anything actionable to be done here. What do you think?

    1 reply
  • default discord avatar
    Stupidism
    9 months ago

    Thanks, i didn't understand this doc correctly.

  • default discord avatar
    Stupidism
    9 months ago

    Do I have to use this query to filter out _status: "draft"? If so, can I find any documentation about this?

    # Write your query or mutation here
    query getPages {
      Pages(draft: false, where:{_status: {equals: published}}) {
        docs {
          title
          slug
          _status
          updatedAt
        }
      }
    }
    

    image

  • default discord avatar
    Stupidism
    9 months ago

    @jmikrut An additional question, as I checked the doc and the ts interface, it seems there's no way I can get the graphql query variables from the access function.

    I want to implement sth like this as the default access for our articles:

      access: {
        read: ({ req }) => {
          console.log('req: ', req.params);
          
          // to get the draft option from request
          if (req.params.draft) return true;
    
          return {
            _status: {
              equals: 'published',
            },
          };
        },
      },
    
Open the post
Continue the discussion in GitHub
Like what we're doing?
Star us on GitHub!

Star

Connect with the Payload Community on Discord

Discord

online

Can't find what you're looking for?

Get help straight from the Payload team with an Enterprise License.