Graphql api draft option not working for unpublished documents

[Stupidism]

Bug Report

I found our draft articles and unpublished articles are shown in prod env.

Steps to Reproduce

1. Open pages list in demo site and publish the first article
2. Publish the second article and then unpublish it directly

3. Open the graphql-playground:
   https://demo.payloadcms.com/api/graphql-playground

Input this query and execute:

# Write your query or mutation here
query getPages {
  Pages(draft: false) {
    docs {
      slug
      _status
      updatedAt
    }
  }
}

Other Details

[Stupidism]

Do I have to use this query to filter out _status: "draft"? If so, can I find any documentation about this?

# Write your query or mutation here
query getPages {
  Pages(draft: false, where:{_status: {equals: published}}) {
    docs {
      title
      slug
      _status
      updatedAt
    }
  }
}

[jmikrut]

Your understanding in your second comment is correct - the draft: true argument replaces any docs in your main collection with their newest drafts, which would be stored in the _versions collection.

We do have docs about this - take a look here:
https://payloadcms.com/docs/versions/drafts#controlling-who-can-see-collection-drafts

Basically, the draft argument alone does not restrict who can see drafts. If you need that, you need to do that with access control. The draft arg simply does what is stated above.

Does that make sense? I will convert this to a discussion as I don't believe there's anything actionable to be done here. What do you think?

[Stupidism]

Thanks, i didn't understand this doc correctly.

[Stupidism]

@jmikrut An additional question, as I checked the doc and the ts interface, it seems there's no way I can get the graphql query variables from the access function.

I want to implement sth like this as the default access for our articles:

  access: {
    read: ({ req }) => {
      console.log('req: ', req.params);
      
      // to get the draft option from request
      if (req.params.draft) return true;

      return {
        _status: {
          equals: 'published',
        },
      };
    },
  },