fix: scopes preferences queries and mutations by user (#7534)

Fixes https://github.com/payloadcms/payload/issues/7530

Properly scopes preferences queries/mutations by user.

packages/next/src/views/List/index.tsx

@@ -57,9 +57,23 @@ export const ListView: React.FC<AdminViewProps> = async ({
         req,
         user,
         where: {
-          key: {
+          and: [
-            equals: preferenceKey,
+            {
-          },
+              key: {
+                equals: preferenceKey,
+              },
+            },
+            {
+              'user.relationTo': {
+                equals: user.collection,
+              },
+            },
+            {
+              'user.value': {
+                equals: user?.id,
+              },
+            },
+          ],
         },
       })
       ?.then((res) => res?.docs?.[0]?.value)) as ListPreferences

packages/ui/src/utilities/buildFormState.ts

@@ -115,9 +115,23 @@ export const buildFormState = async ({ req }: { req: PayloadRequest }): Promise<
           depth: 0,
           limit: 1,
           where: {
-            key: {
+            and: [
-              equals: preferencesKey,
+              {
-            },
+                key: {
+                  equals: preferencesKey,
+                },
+              },
+              {
+                'user.relationTo': {
+                  equals: req.user.collection,
+                },
+              },
+              {
+                'user.value': {
+                  equals: req.user.id,
+                },
+              },
+            ],
           },
         })) as unknown as { docs: { value: DocumentPreferences }[] }
 

test/auth/int.spec.ts

@@ -367,7 +367,21 @@ describe('Auth', () => {
             collection: 'payload-preferences',
             depth: 0,
             where: {
-              key: { equals: key },
+              and: [
+                {
+                  key: { equals: key },
+                },
+                {
+                  'user.relationTo': {
+                    equals: 'users',
+                  },
+                },
+                {
+                  'user.value': {
+                    equals: loggedInUser.id,
+                  },
+                },
+              ],
             },
           })
 
@@ -390,7 +404,21 @@ describe('Auth', () => {
             collection: 'payload-preferences',
             depth: 0,
             where: {
-              key: { equals: key },
+              and: [
+                {
+                  key: { equals: key },
+                },
+                {
+                  'user.relationTo': {
+                    equals: 'users',
+                  },
+                },
+                {
+                  'user.value': {
+                    equals: loggedInUser.id,
+                  },
+                },
+              ],
             },
           })