Access Control
Access control within Payload is extremely powerful while remaining easy and intuitive to manage. Declaring who should have access to what documents is no more complex than writing a simple JavaScript function that either returns a boolean
or a query
constraint to restrict which documents users can interact with.
Example use cases:
- Allowing anyone
read
access to allPost
s - Only allowing public access to
Post
s where astatus
field is equal topublished
- Giving only
User
s with arole
field equal toadmin
the ability to deletePage
(s) - Allowing anyone to create
ContactSubmission
s, but only logged in users toread
,update
ordelete
them - Restricting a
User
to only be able to see their ownOrder
(s), but no others - Allowing
User
s that belong to a certainOrganization
to access only thatOrganization
'sResource
s
Default Settings
By default, all Collections and Globals require that a user is logged in to be able to interact in any way. The default Access Control function evaluates the user
from the Express req
and returns true
if a user is logged in, and false
if not.
Default Access function:
Access Control Types
You can manage access within Payload on three different levels:
When Access Control is Executed
As you execute operations
When you perform Payload operations like create
, read
, update
, and delete
, your access control functions will be executed before any changes or operations are completed.
Within the Admin UI
The Payload Admin UI responds dynamically to the access control that you define. For example, if you restrict editing a ExampleCollection
to only users that feature a role
of admin
, the Payload Admin UI will hide the ExampleCollection
from the Admin UI entirely. This is super powerful and allows you to control who can do what with your Admin UI.
To accomplish this, Payload ships with an Access
operation, which is executed when a user logs into the Admin UI. Payload will execute each one of your access control functions, across all collections, globals, and fields, at the top level and return a response that contains a reflection of what the currently authenticated user can do with your application.
Argument Availability
If you use id
or data
within your access control functions, make sure to check that they are defined first. If they are not, then you can assume that your access control is being executed via the access
operation, to determine solely what the user can do within the Admin UI.