Keep original request and add properties to it, instead of copy

test/access-control/config.ts

@@ -9,6 +9,7 @@ export const readOnlySlug = 'read-only-collection';
 export const restrictedSlug = 'restricted';
 export const restrictedVersionsSlug = 'restricted-versions';
 export const siblingDataSlug = 'sibling-data';
+export const relyOnRequestHeadersSlug = 'rely-on-request-headers';
 
 const openAccess = {
   create: () => true,
@@ -24,6 +25,11 @@ const PublicReadabilityAccess: FieldAccess = ({ req: { user }, siblingData }) =>
   return false;
 };
 
+export const requestHeaders = {authorization: 'Bearer testBearerToken'};
+const UseRequestHeadersAccess: FieldAccess = ({ req: { headers } }) => {
+  return !!headers && headers.authorization === requestHeaders.authorization;
+};
+
 export default buildConfig({
   collections: [
     {
@@ -115,6 +121,21 @@ export default buildConfig({
         },
       ],
     },
+    {
+      slug: relyOnRequestHeadersSlug,
+      access: {
+        create: UseRequestHeadersAccess,
+        read: UseRequestHeadersAccess,
+        update: UseRequestHeadersAccess,
+        delete: UseRequestHeadersAccess,
+      },
+      fields: [
+        {
+          name: 'name',
+          type: 'text',
+        },
+      ],
+    },
   ],
   onInit: async (payload) => {
     await payload.create({

test/access-control/int.spec.ts

@@ -1,9 +1,11 @@
 import mongoose from 'mongoose';
 import payload from '../../src';
+import type { Options as CreateOptions } from '../../src/collections/operations/local/create';
 import { Forbidden } from '../../src/errors';
+import type { PayloadRequest } from '../../src/types';
 import { initPayloadTest } from '../helpers/configHelpers';
-import { restrictedSlug, siblingDataSlug, slug } from './config';
-import type { Restricted, Post, SiblingDatum } from './payload-types';
+import { relyOnRequestHeadersSlug, requestHeaders, restrictedSlug, siblingDataSlug, slug } from './config';
+import type { Restricted, Post, SiblingDatum, RelyOnRequestHeader } from './payload-types';
 import { firstArrayText, secondArrayText } from './shared';
 
 describe('Access Control', () => {
@@ -74,7 +76,7 @@ describe('Access Control', () => {
   describe('Collections', () => {
     describe('restricted collection', () => {
       it('field without read access should not show', async () => {
-        const { id } = await createDoc({ restrictedField: 'restricted' });
+        const { id } = await createDoc<Post>({ restrictedField: 'restricted' });
 
         const retrievedDoc = await payload.findByID({ collection: slug, id, overrideAccess: false });
 
@@ -82,7 +84,7 @@ describe('Access Control', () => {
       });
 
       it('field without read access should not show when overrideAccess: true', async () => {
-        const { id, restrictedField } = await createDoc({ restrictedField: 'restricted' });
+        const { id, restrictedField } = await createDoc<Post>({ restrictedField: 'restricted' });
 
         const retrievedDoc = await payload.findByID({ collection: slug, id, overrideAccess: true });
 
@@ -90,13 +92,59 @@ describe('Access Control', () => {
       });
 
       it('field without read access should not show when overrideAccess default', async () => {
-        const { id, restrictedField } = await createDoc({ restrictedField: 'restricted' });
+        const { id, restrictedField } = await createDoc<Post>({ restrictedField: 'restricted' });
 
         const retrievedDoc = await payload.findByID({ collection: slug, id });
 
         expect(retrievedDoc.restrictedField).toEqual(restrictedField);
       });
     });
+    describe('non-enumerated request properties passed to access control', () => {
+      it('access control ok when passing request headers', async () => {
+        const req = Object.defineProperty({}, 'headers', {
+          value: requestHeaders,
+          enumerable: false,
+        }) as PayloadRequest;
+        const name = 'name';
+        const overrideAccess = false;
+
+        const { id } = await createDoc<RelyOnRequestHeader>({ name }, relyOnRequestHeadersSlug, { req, overrideAccess });
+        const docById = await payload.findByID({ collection: relyOnRequestHeadersSlug, id, req, overrideAccess });
+        const { docs: docsByName } = await payload.find({
+          collection: relyOnRequestHeadersSlug,
+          where: {
+            name: {
+              equals: name,
+            },
+          },
+          req,
+          overrideAccess,
+        });
+
+        expect(docById).not.toBeUndefined();
+        expect(docsByName.length).toBeGreaterThan(0);
+      });
+
+      it('access control fails when omitting request headers', async () => {
+        const name = 'name';
+        const overrideAccess = false;
+
+        await expect(() => createDoc<RelyOnRequestHeader>({ name }, relyOnRequestHeadersSlug, { overrideAccess })).rejects.toThrow(Forbidden);
+        const { id } = await createDoc<RelyOnRequestHeader>({ name }, relyOnRequestHeadersSlug);
+
+        await expect(() => payload.findByID({ collection: relyOnRequestHeadersSlug, id, overrideAccess })).rejects.toThrow(Forbidden);
+
+        await expect(() => payload.find({
+          collection: relyOnRequestHeadersSlug,
+          where: {
+            name: {
+              equals: name,
+            },
+          },
+          overrideAccess,
+        })).rejects.toThrow(Forbidden);
+      });
+    });
   });
 
   describe('Override Access', () => {
@@ -172,9 +220,10 @@ describe('Access Control', () => {
   });
 });
 
-async function createDoc(data: Partial<Post>): Promise<Post> {
-  return payload.create({
-    collection: slug,
+async function createDoc<Collection>(data: Partial<Collection>, overrideSlug = slug, options?: Partial<CreateOptions<Collection>>): Promise<Collection> {
+  return payload.create<Collection>({
+    ...options,
+    collection: overrideSlug,
     data: data ?? {},
   });
 }

test/access-control/payload-types.ts

@@ -60,6 +60,16 @@ export interface SiblingDatum {
   createdAt: string;
   updatedAt: string;
 }
+/**
+ * This interface was referenced by `Config`'s JSON-Schema
+ * via the `definition` "rely-on-request-headers".
+ */
+export interface RelyOnRequestHeader {
+  id: string;
+  name?: string;
+  createdAt: string;
+  updatedAt: string;
+}
 /**
  * This interface was referenced by `Config`'s JSON-Schema
  * via the `definition` "users".