Collection Group Access Control

[ToneseekerMusical]

We already have collection and field level access control which is extremely powerful and granular, however I believe that having a wider hierarchy of access control priority can greatly improve developer experience, as when developing a complex implementation of role based access control in payload, the number of access control functions you need to define can quickly grow out of hand. This issue is similar to the one that I lay out in my conditional tabs feature request, as the number of access control functions grows quite rapidly as you add user roles to the application, and having to manage a large number of access controls can get quite tedious.

Adding an additional level of access control at the group level would allow for faster development, and decrease the time spent on setting up user permissions in payload, as developers could set rough access control at the group level and refine it further at the collection and field level. It would also allow for easier cleanup of the admin interface, allowing entire collection groups to be omitted from the admin interface with a single access control setup. I propose implementing a simple CollectionsGroupConfig that allows us to set access control rules on all collections contained within that group as below:

import { CollectionConfig } from 'payload/types';
import { isAdmin } from '../access/isAdmin';

export const TestConfig1: CollectionConfig = {
  slug: 'testconfig1',
  admin:{
    group: 'testGroup'
  },
  access: {
    create: isEmployee,
    read: isAdminOrSelf,
    update: isAdminOrSelf,
  },
  fields: [
    {
      type:'text',
      name:'test',
    },
  ],
};

export const TestConfig2: CollectionConfig = {
  slug: 'testconfig2',
  admin:{
    group: 'testGroup'
  },
  access: {
    create: isCustomer,
    update: isAdminOrSelf,
  },
  fields: [
    {
      type:'text',
      name:'test',
    },
  ],
};

export const TestConfig2: CollectionConfig = {
  slug: 'testconfig2',
  admin:{
    group: 'testGroup'
  },
  fields: [
    {
      type:'text',
      name:'test',
    },
  ],
};

export const TestGroup: GroupConfig = {
  slug:'testGroup',
  access: {
    create: isAdminEmployeePartnerOrCustomer,
    read: isAdminEmployeePartnerOrCustomer,
    update: isAdminEmployeePartnerOrCustomer,
    delete: () => false,
  },
}

I may have a backwards thought process while developing, however, I tend to think big picture first. I know what kinds of data I need; such as Business Management, Partner Management, Shop Products, Application Forms, etc, then the groups of users that need to access those groups of data, then I define the data that is within those groups, and finally what pieces of data each user would need access to. This feature request follows that top down philosophy.