Access Control and Relationships

[imphillipzissou]

Hi folks,

Apologies if this isn't the correct location to post. Running into a situation with Access Control and Relationships. I'm unable to create a document with a relationship to a collection with Create Access Controls enabled.

For example: If there are Collection Access Controls enabled on Collection A which prevent a user from creating a new Document in Collection A. There are no Collection Access Controls on Collection B. Collection B has a relationship to Collection A. Upon creating a new Collection B Document, the relationship field will be disabled. If the relationship is required, a Collection B document cannot be created.

CollectionA.ts

import { CollectionConfig } from 'payload/types';

const CollectionA : CollectionConfig = {
  slug: 'collectionA',
  access: {
    create: () => false,
  },
  admin: {
    useAsTitle: 'name',
  },
  fields: [
    {
      name: 'name',
      type: 'text',
      required: true,
    },
  ],
};

export default CollectionA;

CollectionB.ts

const CollectionB : CollectionConfig = {
  slug: 'collectionB',
  access: {
    create: () => true,
  },
  admin: {
    useAsTitle: 'name',
  },
  fields: [
    {
      name: 'name',
      type: 'text',
      required: true,
    },
    {
      name: 'collectionA',
      type: 'relationship',
      relationTo: 'collectionA',
      hasMany: false,
      required: true,
      admin: {
        position: 'sidebar'
      },
    },
  ],
};

export default CollectionB;

I've tried using field level access controls to allow a CollectionB relationship but this didn't appear to work either. I might not be understanding something but thought this behavior was unexpected since this wouldn't be "creating" a document in Collection A. Any thoughts?
Thanks!

[jmikrut]

Hey @imphillipzissou — I have not yet had time to replicate your scenario, but if my understanding of your issue is correct, my quick reaction is that create access control for CollectionA should have absolutely no effect on the relationship field within CollectionB. That is to say, unless you have restricted read access to CollectionA. In that case, if the logged in user fails to pass read access for CollectionA, I'd expect your admin UI to show a usable relationship field within CollectionB, but no available relations to CollectionA in the dropdown.

Basically - this is unexpected. Your create access control constraint on CollectionA should have no impact against your relationship field on CollectionB.

Do you happen to have a repo available for us to look at? Otherwise we can try and replicate ASAP.

[imphillipzissou]

Hey! @jmikrut Thanks for getting back with me! Really enjoying the project so far! (edit: also shoutout to a fellow michigander lol)

Interesting! I had to made a couple changes to the quick collections shared above but seem to be able to reproduce with these steps:

1. Created new Typescript project with npx create-payload-app
   1.1 Modified serverURL and mongoOptions in server.ts for my environment.

2. Created two new Collections:

./collections/CollectionA.ts

import { CollectionConfig } from 'payload/types';
const CollectionA : CollectionConfig = {
  slug: 'collection-a',
  access: {
    create: () => false,
  },
  admin: {
    useAsTitle: 'name',
  },
  fields: [
    {
      name: 'name',
      type: 'text',
      required: true,
    },
  ],
};
export default CollectionA;

./collections/CollectionB.ts

import { CollectionConfig } from 'payload/types';
const CollectionB : CollectionConfig = {
  slug: 'collection-b',
  access: {
    create: () => true,
  },
  admin: {
    useAsTitle: 'name',
  },
  fields: [
    {
      name: 'name',
      type: 'text',
      required: true,
    },
    {
      name: 'collectionA',
      type: 'relationship',
      relationTo: 'collection-a',
      hasMany: false,
      required: true,
      admin: {
        position: 'sidebar'
      },
    },
  ],
};
export default CollectionB;

4. Added Collections to payload.config.ts

import { buildConfig } from 'payload/config';
import path from 'path';
import Users from './collections/Users';
import CollectionA from './collections/CollectionA';
import CollectionB from './collections/CollectionB';
export default buildConfig({
  serverURL: process.env.PAYLOAD_PUBLIC_SERVER_URL || "http://localhost:3000",
  admin: {
    user: Users.slug,
  },
  collections: [
    Users,
    CollectionA,
    CollectionB,
  ],
  typescript: {
    outputFile: path.resolve(__dirname, 'payload-types.ts')
  },
});

Results with CollectionA correctly having Access Controls prevent creation. However also prevents CollectionB from setting a relationship to CollectionA.

Appreciate the help looking into this! I'll try to find some time tomorrow to dig into the source to take a crack at finding the issue. Thanks again!

[jmikrut]

Hey @imphillipzissou — I just recreated this!

It's a bug. We are going to release a fix either later tonight or tomorrow. Will update here once we have it in place.

Thanks for bringing this up!