Merge branch 'master' of https://github.com/payloadcms/payload into fix/me-access-control

test/auth/config.ts

@@ -36,6 +36,14 @@ export default buildConfig({
           saveToJWT: true,
           hasMany: true,
         },
+        {
+          name: 'name',
+          type: 'text',
+          defaultValue: 'Dev',
+          access: {
+            read: () => false,
+          },
+        },
       ],
     },
     {

test/auth/int.spec.ts

@@ -261,6 +261,36 @@ describe('Auth', () => {
           expect(lockUntil).toBeDefined();
         });
 
+        it('should exclude access controlled field from [collection-name]/me', async () => {
+          const apiKey = '0123456789ABCDEFGH';
+          const user = await payload.create({
+            collection: slug,
+            data: {
+              email: 'test@example.com',
+              password: 'test',
+              apiKey,
+            },
+          });
+
+          const retrievedUser = await payload.findByID({
+            collection: slug,
+            id: user.id,
+          });
+
+          const response = await fetch(`${apiUrl}/${slug}/me`, {
+            headers: {
+              ...headers,
+              Authorization: `${slug} API-Key ${user.apiKey}`,
+            },
+          });
+
+          const data = await response.json();
+
+          expect(retrievedUser.name).toBeDefined();
+          expect(response.status).toBe(200);
+          expect(data.user.name).toBeUndefined();
+        });
+
         it('should unlock account once lockUntil period is over', async () => {
           // Lock user
           await tryLogin();