Collection access: upload does not contain the id or data argument

[AlessioGr]

Bug Report

I have specified the following access object in my collection:

access: {
        update: ({ req, id, data }) => {
            console.log("ID:", id);
            console.log("Data:", data);
            return true;
        },
},

The problem: both id and data are undefined. Using update: ( req, id, data ) => { won't work as well.

It seems that only the req object is passed in, but not the data or id objects. This contradicts what's described here: https://payloadcms.com/docs/access-control/collections#update

[jmikrut]

Hey @AlessioGr — I've just done some verification that these arguments do indeed populate properly, and I think I know what's going on here.

We run update access control in a few places:

1. Before you actually update a document (I've validated that the arguments are populated properly here).
2. Via the /api/access endpoint which is used for the admin panel to show which users can update which documents

In the second case, because we are just simply executing the update access control, without a related document, to determine if a user can update any document within a collection, there is no data or id argument. But, when you go to actually update a specific document, the access control will be executed with arguments defined properly.

Will you take a look to see if this produces your desired results?

PS - I am going to move this to a Discussion because we do indeed populate those arguments while you update document(s).

[AlessioGr]

Ookay that makes sense, thank you! By default, I am returning false under access > update for my post collection type. And thus in my admin I cannot actually edit anything / it prevents me from performing an "actual update":

(the field is gray - I cannot edit it)

However, I do need that data/id parameter there because I want users with a certain role to only be able to update the document if they have created it.
How would I be able to do that if it doesn't provide a data or id argument there and already prevents me from trying to perform an actual update?

[jmikrut]

I'd do something like this:

const updateAccess = ({ data, id, req: { user }}) => {
  if (user) {
    if (data) {
      return {
        createdBy: { // whatever your field is named that stores user
          equals: user.id
        }
      }
    }
    // for cases where there is no data, just return true
    // this allows admin UI to allow logged in users to be able to edit your docs
    return true;
  }

  // only logged in users can update
  return false;
}

[AlessioGr]

I'd do something like this:

const updateAccess = ({ data, id, req: { user }}) => {
  if (user) {
    if (data) {
      return {
        createdBy: { // whatever your field is named that stores user
          equals: user.id
        }
      }
    }
    // for cases where there is no data, just return true
    // this allows admin UI to allow logged in users to be able to edit your docs
    return true;
  }

  // only logged in users can update
  return false;
}

Thank you, would that only prevent the user from saving/publishing the edited document, or would it also show him via grayed-out fields that they cannot edit it?

Also I got some problem with data population for the data object there. data.author should be a relation to my Authors collection. However, it only returns the author ID - not the whole author object (which I would need).
Is there a way to populate that / increase the depth there?

EDIT: I have tried using the Local API there, but I can't wait for async calls there, so that doesn't work.

[AlessioGr]

Never mind, I can use the Local API. It does show me a typescript error when making the function async, but it seems I can just ignore it. That's how I'm using it now:

update: async ({ data, req: { user, payload  }}) => {
            if (user && user.role === 'lead_editor' || user.role === 'editor' || user.role === 'freelancer_editor') {
                if (data && user.role === 'freelancer_editor') {
                    const author = await payload.findByID({
                        collection: 'authors', // required
                        id: data.author, // required
                        depth: 1,
                        user: user,
                    });

                    return author.user.id === user.id;
                }
                // for cases where there is no data, just return true
                // this allows admin UI to allow logged in users to be able to edit your docs
                return true;
            }

            // only logged in users can update
            return false;
        }

Only problem: It prevents the user from updating the post, which is good. However, the fields are not grayed-out

[jmikrut]

Good stuff!

So, we are currently evaluating how to more granularly / proactively render documents as read-only for complex update access controls like the one you're using. It is possible in the future. We just need to build that function yet.

I don't think it'd be too hard. Basically we'd need to create a new operation, and then open up GraphQL / REST / Local APIs that would return if a given user can update a given document. It'd simply execute the access control function assigned to that collection with the current document's data and id and return a set of permissions that show if the user can update, and if so, which fields.

Then we'd make a fetch to that endpoint within our DocumentInfoProvider and use the result to assign read-only to each field.

The team and I at Payload think this is valuable and we will be happy to build it. Not sure when, but it is certainly worthwhile.

I will convert this discussion into a Feature Request from here and we will slate it into our workload!