feat!: remove properties without access from /access endpoint #6881

paulpopus · 2024-06-20T19:24:24Z

Removes any properties that result in false or an empty object {} from the /api/access endpoint

Improves security by not leaking out names of hidden or private collections

// before
{
  "canAccessAdmin": false,
  "collections": {
    "posts": {
      "fields": {
        "text": {
          "create": {
            "permission": false
          },
          "read": {
            "permission": true
          },
          "update": {
            "permission": false
          },
          "delete": {
            "permission": false
          },
          "readVersions": {
            "permission": false
          }
          // ...

// current
{
  "collections": {
    "posts": {
      "fields": {
        "text": {
          "read": {
            "permission": true
          },
          // ...

paulpopus · 2024-07-17T15:36:39Z

add unit tests

## Description Adds `loginWithUsername` option to auth config. When set to true, it will inject an `username` field into the collection config which replaces the `email` field in the UI. The `email` field is still required but not unique. The `username` field can be extended by passing a field named `username` to your auth collection. Anything added to this field will be combined with the initial field. - [X] I have read and understand the [CONTRIBUTING.md](https://github.com/payloadcms/payload/blob/main/CONTRIBUTING.md) document in this repository. ## Type of change - [X] New feature (non-breaking change which adds functionality) ## Checklist: - [X] Existing test suite passes locally with my changes --------- Co-authored-by: Jarrod Flesch <[email protected]>

…elds & config, add generated types for json field (#6984) - Improves type for `jsonSchema` property of JSON field - Adds type generation of JSON field with `jsonSchema` - Adds `typescriptSchema` property to fields that allows you override default field type generation by providing a JSON schema. - Adds `typescript.schema` property in payload config, to allow for any modifications of the type schemas --------- Co-authored-by: Alessio Gravili <[email protected]>

Ports over facebook/lexical#6146

…#6647) ## Description Adds the ability to filter by fields within a `group` or **named** `tab` via the list controls. Note: added missing translations for the `within` and `intersects` operator options, these are displayed in the filters for `point` and `JSON` fields. - [X] I have read and understand the [CONTRIBUTING.md](https://github.com/payloadcms/payload/blob/main/CONTRIBUTING.md) document in this repository. ## Type of change - [X] New feature (non-breaking change which adds functionality) ## Checklist: - [X] Existing test suite passes locally with my changes

) `req.headers` was missing when admin views fetched data to render. This threads headers through inside of initPage.

…eatures to register providers (#7010)

…ema map paths and field names (#7042)

… filters in list view (#7044) Closes #7020 Now supports deeply nested tabs, groups, collapsibles and rows in the where filters in list view including localised labels. --------- Co-authored-by: Anders Semb Hermansen <[email protected]>

## Description - [x] I have read and understand the [CONTRIBUTING.md](https://github.com/payloadcms/payload/blob/main/CONTRIBUTING.md) document in this repository. ## Type of change - [x] Chore (non-breaking change which does not add functionality) --------- Co-authored-by: Alessio Gravili <[email protected]>

…assed to Client Document Views (#7026) **BREAKING:** The minimum required Next.js version has been bumped from `15.0.0-rc.0` to `15.0.0-canary.53`. This is because the way client components are represented changed somewhere between those versions, and it is not feasible to support both versions in our RSC detection logic.

## Description BREAKING CHANGE: Color values have changed and will have different contrasts. If you use any of Payload's colors in your apps, you may need to adjust your use of them to maintain proper styling/accessibility. Colors palettes changed: - `--theme-success-*` - `--theme-error-*` - `--theme-warning-*` - `--color-success-*` - `--color-error-*` - `--color-warning-*` - `--color-blue-*` Updates the color palette used throughout Payload to be more consistent between dark and light values. Contrast values are now more in line with the `theme-elevation` contrasts. Some adjustments to the Toast components as well to match light/dark mode better. - [x] I have read and understand the [CONTRIBUTING.md](https://github.com/payloadcms/payload/blob/main/CONTRIBUTING.md) document in this repository. ## Type of change  - [x] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [x] Change to the [templates](https://github.com/payloadcms/payload/tree/main/templates) directory (does not affect core functionality) - [x] Change to the [examples](https://github.com/payloadcms/payload/tree/main/examples) directory (does not affect core functionality) ## Checklist: - [ ] I have added tests that prove my fix is effective or that my feature works - [ ] Existing test suite passes locally with my changes - [ ] I have made corresponding changes to the documentation

…improving live preview speed (#7201) Now has a minimum animation time for the autosave but it fires off the send events sooner to improve the live preview timing.

- When autoLogin is enabled, it will no longer flash an unresponsive "login" screen. Instead, it will straight up open the admin panel. That's because, on the server, we will now always & immediately see the user as authenticated, thus no initial login view is pushed to the client until the client component sends the auth request anymore. Less useless requests. Additionally, jwt verification is now completely skipped - No more auto-login related frontend code. autoLogin handling has been removed from the frontend `Auth` component - less code to maintain, this is way simpler now **For reviewers:** - The new logic for autoFill without prefillOnly is here: [jwt auth strategy](https://github.com/payloadcms/payload/pull/7224/files#diff-7d40839079a8b2abb58233e5904513ab321023a70538229dfaf1dfee067dc8bfR21) - The new logic for autoFill with prefillOnly is here: [Server Login View](https://github.com/payloadcms/payload/pull/7224/files#diff-683770104f196196743398a698fbf8987f00e4426ca1c0ace3658d18ab80e82dL72) => [Client Login Form](https://github.com/payloadcms/payload/pull/7224/files#diff-ac3504d3b3b0489455245663649bef9e84477bf0c1185da5a4d3a612450f01eeL20) **BREAKING** `autoLogin` without `prefillOnly` set now also affects graphQL/Rest operations. Only the user specified in `autoLogin` will be returned. Within the graphQL/Rest/Local API, this should still allow you to authenticate with a different user, as the autoLogin user is only used if no token is set.

Fixes #7275

…ying, type improvements (#7272) **BREAKING:** - The `deepMerge` exported from payload now handles more complex data and is slower. The old, simple deepMerge is now exported as `deepMergeSimple` - `combineMerge` is no longer exported. You can use `deepMergeWithCombinedArrays` instead - The behavior of the exported `deepCopyObject` and `isPlainObject` may be different and more reliable, as the underlying algorithm has changed

@ts-expect-error

We do not really need runtime joi schema validation - this is what TypeScript is for. If people are ignoring TypeScript errors in your schema, or JavaScript errors, that is their fault and does not warrant an extra dependency (joi), lots of code to maintain, as well as slower startups. If we wanna keep runtime schema validation, we should switch to zod so that we can generate TypeScript types based on the schema and do not have to manually maintain config properties in 2 different places (types & schema). **joi PROs:** - Safety for JavaScript-only evangelists messing up their schema - Safety for people putting @ts-expect-error or `as any` everywhere in their code **joi CONs:** - Larger bundle size - More Modules - Slower Compilation Speed in dev. Worse DX - Slower Startup (it needs to validate) in dev. Worse DX - More code to maintain. For every schema change we'll have to change the types AND the joi schema - TypeScript already throws proper errors if you mess up your schema. Why have runtime errors? - The errors are bad. They might tell you what field has an issue, but they do not tell you what exactly is wrong. You have probably seen those "Field XY, value is incorrect" errors - and value could mean anything. Worse DX - Having extra properties in your schema, even if they are useless, doesn't cause any harm Cons outweigh the pros

Closes #7163

…IDs (#7281)

…lates and core (#7283) Some package.json's were on older or mismatching Next.js / React versions. This includes other Next.js packages like @next/env

Doesn't look like those hacky esm-cjs imports are needed anymore. These major pino releases only drop Node.js version support for versions which payload doesn't support anyways.

…7297) Adjust logic for determining package manager. Needed to move command exists logic to be evaluated only after other possibilities were exhausted. Closes #7290

…al chars in sort (#7294) ## Description V2 PR [here](#6923) - [x] I have read and understand the [CONTRIBUTING.md](https://github.com/payloadcms/payload/blob/main/CONTRIBUTING.md) document in this repository. ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## Checklist: - [x] I have added tests that prove my fix is effective or that my feature works - [x] Existing test suite passes locally with my changes

## Description The first version document throws an error because `latestPublished` and `latestDraft` are undefined. - [X] I have read and understand the [CONTRIBUTING.md](https://github.com/payloadcms/payload/blob/main/CONTRIBUTING.md) document in this repository. ## Type of change - [X] Bug fix (non-breaking change which fixes an issue) ## Checklist: - [X] Existing test suite passes locally with my changes

Fixes #7204

) Adds test as well for the email field

- improves types - fixes create-first-user fields

feat!: Remove properties without access from /access endpoint

a5d6d1e

github-actions bot added the created-by: Contributor label Jun 20, 2024

paulpopus changed the title ~~feat!: Remove properties without access from /access endpoint~~ feat!: remove properties without access from /access endpoint Jun 20, 2024

paulpopus added 3 commits June 20, 2024 15:47

fix test

a579c07

Merge branch 'beta' into feat/remove-bad-perms-from-access

e411673

update function

831dc3d

JessChowdhury and others added 23 commits July 24, 2024 10:11

feat(richtext-lexical)!: upgrade lexical from 0.16.0 to 0.16.1

71cff68

fix(richtext-lexical): auto link node escapes on second "."

539ad16

Ports over facebook/lexical#6146

chore(release): v3.0.0-beta.57 [skip ci]

9a1a6ea

docs: rewrites field admin docs to 3.0 (#7002)

53b9165

fix: ensures req has headers, passes it through in view rendering (#7012

d869936

) `req.headers` was missing when admin views fetched data to render. This threads headers through inside of initPage.

feat(richtext-lexical): add EXPERIMENTAL_TableFeature, allow Client F…

7f2a41f

…eatures to register providers (#7010)

docs: root-level routes require directory rename (#7023)

9ff9f5c

chore(release): v3.0.0-beta.58 [skip ci]

4d2c418

chore: clean up packages (#7027)

80f7569

docs: fix typo in storage-adapters.mdx (#7040)

fbbd6c4

fix(richtext-lexical): avoid conflicts between internal component/sch…

a3039fc

…ema map paths and field names (#7042)

chore: upgrade @lexical/eslint-plugin and @types/uuid (#7043)

a78b654

feat: avoid unnecessary config await in getPayloadHMR (#7045)

55a8d35

chore(release): v3.0.0-beta.59 [skip ci]

40be15d

chore(docs): update docs on importing scss variables (#7060)

ab7714f

fix(plugin-redirects): make fields optional type in overrides (#7061)

f357065

paulpopus and others added 25 commits July 24, 2024 10:11

feat(ui): change autosave logic to send updates as soon as possible, …

bd7a8f1

…improving live preview speed (#7201) Now has a minimum animation time for the autosave but it fires off the send events sooner to improve the live preview timing.

chore: add custom ID warning about forbidden characters (#7268)

579f241

fix(payload): resizes images first before applying focal point (#7277)

628aa51

Fixes #7275

chore: make ui bundle script windows compatible (#7197)

358751f

chore: add index to status for versions (#6257)

b073663

fix(ui): not updating permissions when locale changes (#7245)

b6040c8

Closes #7163

fix(templates): website template building error with postgres number …

fa6fe79

…IDs (#7281)

chore: ensure the correct next & react versions are installed in temp…

5c1208b

…lates and core (#7283) Some package.json's were on older or mismatching Next.js / React versions. This includes other Next.js packages like @next/env

feat: upgrade pino and pino-pretty, clean up hacky esm imports (#7291)

10d817f

Doesn't look like those hacky esm-cjs imports are needed anymore. These major pino releases only drop Node.js version support for versions which payload doesn't support anyways.

fix: search plugin localized fields (#7292)

be412b5

chore(release): v3.0.0-beta.68 [skip ci]

05104b8

chore(scripts): delete-recursively output spacing

a5ca11e

fix(cpa): check cmd exists after first checking flag and lock file (#…

f2bd486

…7297) Adjust logic for determining package manager. Needed to move command exists logic to be evaluated only after other possibilities were exhausted. Closes #7290

docs: cleanup to individual field docs (#7202)

011d9de

fix(ui): Where query selectors for checkboxes are now translated (#7309)

617c485

Fixes #7204

feat(next): root admin (#7276)

b590bc1

fix(plugin-stripe): properly types async webhooks (#7317)

40b6cdb

fix(ui): email field now correctly renders autocomplete attribute (#7322

1d6c977

) Adds test as well for the email field

fix: misc issues with loginWithUsername (#7311)

0b6fd06

- improves types - fixes create-first-user fields

feat: adds @payloadcms/live-preview-vue to release pipeline (#7328)

9702937

paulpopus requested review from denolfe, jacobsfletch, AlessioGr and jmikrut as code owners July 24, 2024 14:11

paulpopus closed this Jul 24, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat!: remove properties without access from /access endpoint #6881

feat!: remove properties without access from /access endpoint #6881

paulpopus commented Jun 20, 2024 •

edited

Loading

paulpopus commented Jul 17, 2024

feat!: remove properties without access from /access endpoint #6881

feat!: remove properties without access from /access endpoint #6881

Conversation

paulpopus commented Jun 20, 2024 • edited Loading

paulpopus commented Jul 17, 2024

paulpopus commented Jun 20, 2024 •

edited

Loading