Prevents an accidental lockout of query preset documents. An "accidental lockout" occurs when the user sets access control on a preset and excludes themselves. This can happen in a variety of scenarios, including: - You select `specificUsers` without specifying yourself - You select `specificRoles` without specifying a role that you are a part of - Etc. #### How it works To make this happen, we use a custom validation function that executes access against the user's proposed changes. If those changes happen to remove access for them, we throw a validation error and prevent that change from ever taking place. This means that only a user with proper access can remove another user from the preset. You cannot remove yourself. To do this, we create a temporary record in the database that we can query against. We use transactions to ensure that the temporary record is not persisted once our work is completed. Since not all Payload projects have transactions enabled, we flag these temporary records with the `isTemp` field. Once created, we query the temp document to determine its permissions. If any of the operations throw an error, this means the user can no longer act on them, and we throw a validation error. #### Alternative Approach A previous approach that was explored was to add an `owner` field to the presets collection. This way, the "owner" of the preset would be able to completely bypass all access control, effectively eliminating the possibility of a lockout event. But this doesn't work for other users who may have update access. E.g. they could still accidentally remove themselves from the read or update operation, preventing them from accessing that preset after submitting the form. We need a solution that works for all users, not just the owner.
387 lines
8.7 KiB
TypeScript
387 lines
8.7 KiB
TypeScript
/* tslint:disable */
|
|
/* eslint-disable */
|
|
/**
|
|
* This file was automatically generated by Payload.
|
|
* DO NOT MODIFY IT BY HAND. Instead, modify your source Payload config,
|
|
* and re-run `payload generate:types` to regenerate this file.
|
|
*/
|
|
|
|
/**
|
|
* Supported timezones in IANA format.
|
|
*
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "supportedTimezones".
|
|
*/
|
|
export type SupportedTimezones =
|
|
| 'Pacific/Midway'
|
|
| 'Pacific/Niue'
|
|
| 'Pacific/Honolulu'
|
|
| 'Pacific/Rarotonga'
|
|
| 'America/Anchorage'
|
|
| 'Pacific/Gambier'
|
|
| 'America/Los_Angeles'
|
|
| 'America/Tijuana'
|
|
| 'America/Denver'
|
|
| 'America/Phoenix'
|
|
| 'America/Chicago'
|
|
| 'America/Guatemala'
|
|
| 'America/New_York'
|
|
| 'America/Bogota'
|
|
| 'America/Caracas'
|
|
| 'America/Santiago'
|
|
| 'America/Buenos_Aires'
|
|
| 'America/Sao_Paulo'
|
|
| 'Atlantic/South_Georgia'
|
|
| 'Atlantic/Azores'
|
|
| 'Atlantic/Cape_Verde'
|
|
| 'Europe/London'
|
|
| 'Europe/Berlin'
|
|
| 'Africa/Lagos'
|
|
| 'Europe/Athens'
|
|
| 'Africa/Cairo'
|
|
| 'Europe/Moscow'
|
|
| 'Asia/Riyadh'
|
|
| 'Asia/Dubai'
|
|
| 'Asia/Baku'
|
|
| 'Asia/Karachi'
|
|
| 'Asia/Tashkent'
|
|
| 'Asia/Calcutta'
|
|
| 'Asia/Dhaka'
|
|
| 'Asia/Almaty'
|
|
| 'Asia/Jakarta'
|
|
| 'Asia/Bangkok'
|
|
| 'Asia/Shanghai'
|
|
| 'Asia/Singapore'
|
|
| 'Asia/Tokyo'
|
|
| 'Asia/Seoul'
|
|
| 'Australia/Brisbane'
|
|
| 'Australia/Sydney'
|
|
| 'Pacific/Guam'
|
|
| 'Pacific/Noumea'
|
|
| 'Pacific/Auckland'
|
|
| 'Pacific/Fiji';
|
|
|
|
export interface Config {
|
|
auth: {
|
|
users: UserAuthOperations;
|
|
};
|
|
blocks: {};
|
|
collections: {
|
|
pages: Page;
|
|
posts: Post;
|
|
users: User;
|
|
'payload-locked-documents': PayloadLockedDocument;
|
|
'payload-preferences': PayloadPreference;
|
|
'payload-migrations': PayloadMigration;
|
|
'payload-query-presets': PayloadQueryPreset;
|
|
};
|
|
collectionsJoins: {};
|
|
collectionsSelect: {
|
|
pages: PagesSelect<false> | PagesSelect<true>;
|
|
posts: PostsSelect<false> | PostsSelect<true>;
|
|
users: UsersSelect<false> | UsersSelect<true>;
|
|
'payload-locked-documents': PayloadLockedDocumentsSelect<false> | PayloadLockedDocumentsSelect<true>;
|
|
'payload-preferences': PayloadPreferencesSelect<false> | PayloadPreferencesSelect<true>;
|
|
'payload-migrations': PayloadMigrationsSelect<false> | PayloadMigrationsSelect<true>;
|
|
'payload-query-presets': PayloadQueryPresetsSelect<false> | PayloadQueryPresetsSelect<true>;
|
|
};
|
|
db: {
|
|
defaultIDType: string;
|
|
};
|
|
globals: {};
|
|
globalsSelect: {};
|
|
locale: null;
|
|
user: User & {
|
|
collection: 'users';
|
|
};
|
|
jobs: {
|
|
tasks: unknown;
|
|
workflows: unknown;
|
|
};
|
|
}
|
|
export interface UserAuthOperations {
|
|
forgotPassword: {
|
|
email: string;
|
|
password: string;
|
|
};
|
|
login: {
|
|
email: string;
|
|
password: string;
|
|
};
|
|
registerFirstUser: {
|
|
email: string;
|
|
password: string;
|
|
};
|
|
unlock: {
|
|
email: string;
|
|
password: string;
|
|
};
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "pages".
|
|
*/
|
|
export interface Page {
|
|
id: string;
|
|
text?: string | null;
|
|
updatedAt: string;
|
|
createdAt: string;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "posts".
|
|
*/
|
|
export interface Post {
|
|
id: string;
|
|
text?: string | null;
|
|
updatedAt: string;
|
|
createdAt: string;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "users".
|
|
*/
|
|
export interface User {
|
|
id: string;
|
|
name?: string | null;
|
|
roles?: ('admin' | 'editor' | 'user')[] | null;
|
|
updatedAt: string;
|
|
createdAt: string;
|
|
email: string;
|
|
resetPasswordToken?: string | null;
|
|
resetPasswordExpiration?: string | null;
|
|
salt?: string | null;
|
|
hash?: string | null;
|
|
loginAttempts?: number | null;
|
|
lockUntil?: string | null;
|
|
password?: string | null;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "payload-locked-documents".
|
|
*/
|
|
export interface PayloadLockedDocument {
|
|
id: string;
|
|
document?:
|
|
| ({
|
|
relationTo: 'pages';
|
|
value: string | Page;
|
|
} | null)
|
|
| ({
|
|
relationTo: 'posts';
|
|
value: string | Post;
|
|
} | null)
|
|
| ({
|
|
relationTo: 'users';
|
|
value: string | User;
|
|
} | null);
|
|
globalSlug?: string | null;
|
|
user: {
|
|
relationTo: 'users';
|
|
value: string | User;
|
|
};
|
|
updatedAt: string;
|
|
createdAt: string;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "payload-preferences".
|
|
*/
|
|
export interface PayloadPreference {
|
|
id: string;
|
|
user: {
|
|
relationTo: 'users';
|
|
value: string | User;
|
|
};
|
|
key?: string | null;
|
|
value?:
|
|
| {
|
|
[k: string]: unknown;
|
|
}
|
|
| unknown[]
|
|
| string
|
|
| number
|
|
| boolean
|
|
| null;
|
|
updatedAt: string;
|
|
createdAt: string;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "payload-migrations".
|
|
*/
|
|
export interface PayloadMigration {
|
|
id: string;
|
|
name?: string | null;
|
|
batch?: number | null;
|
|
updatedAt: string;
|
|
createdAt: string;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "payload-query-presets".
|
|
*/
|
|
export interface PayloadQueryPreset {
|
|
id: string;
|
|
title: string;
|
|
isShared?: boolean | null;
|
|
access?: {
|
|
read?: {
|
|
constraint?: ('everyone' | 'onlyMe' | 'specificUsers' | 'specificRoles' | 'noone') | null;
|
|
users?: (string | User)[] | null;
|
|
roles?: ('admin' | 'editor' | 'user')[] | null;
|
|
};
|
|
update?: {
|
|
constraint?: ('everyone' | 'onlyMe' | 'specificUsers' | 'specificRoles') | null;
|
|
users?: (string | User)[] | null;
|
|
roles?: ('admin' | 'editor' | 'user')[] | null;
|
|
};
|
|
delete?: {
|
|
constraint?: ('everyone' | 'onlyMe' | 'specificUsers') | null;
|
|
users?: (string | User)[] | null;
|
|
};
|
|
};
|
|
where?:
|
|
| {
|
|
[k: string]: unknown;
|
|
}
|
|
| unknown[]
|
|
| string
|
|
| number
|
|
| boolean
|
|
| null;
|
|
columns?:
|
|
| {
|
|
[k: string]: unknown;
|
|
}
|
|
| unknown[]
|
|
| string
|
|
| number
|
|
| boolean
|
|
| null;
|
|
relatedCollection: 'pages' | 'posts';
|
|
/**
|
|
* This is a tempoary field used to determine if updating the preset would remove the user's access to it. When `true`, this record will be deleted after running the preset's `validate` function.
|
|
*/
|
|
isTemp?: boolean | null;
|
|
updatedAt: string;
|
|
createdAt: string;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "pages_select".
|
|
*/
|
|
export interface PagesSelect<T extends boolean = true> {
|
|
text?: T;
|
|
updatedAt?: T;
|
|
createdAt?: T;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "posts_select".
|
|
*/
|
|
export interface PostsSelect<T extends boolean = true> {
|
|
text?: T;
|
|
updatedAt?: T;
|
|
createdAt?: T;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "users_select".
|
|
*/
|
|
export interface UsersSelect<T extends boolean = true> {
|
|
name?: T;
|
|
roles?: T;
|
|
updatedAt?: T;
|
|
createdAt?: T;
|
|
email?: T;
|
|
resetPasswordToken?: T;
|
|
resetPasswordExpiration?: T;
|
|
salt?: T;
|
|
hash?: T;
|
|
loginAttempts?: T;
|
|
lockUntil?: T;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "payload-locked-documents_select".
|
|
*/
|
|
export interface PayloadLockedDocumentsSelect<T extends boolean = true> {
|
|
document?: T;
|
|
globalSlug?: T;
|
|
user?: T;
|
|
updatedAt?: T;
|
|
createdAt?: T;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "payload-preferences_select".
|
|
*/
|
|
export interface PayloadPreferencesSelect<T extends boolean = true> {
|
|
user?: T;
|
|
key?: T;
|
|
value?: T;
|
|
updatedAt?: T;
|
|
createdAt?: T;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "payload-migrations_select".
|
|
*/
|
|
export interface PayloadMigrationsSelect<T extends boolean = true> {
|
|
name?: T;
|
|
batch?: T;
|
|
updatedAt?: T;
|
|
createdAt?: T;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "payload-query-presets_select".
|
|
*/
|
|
export interface PayloadQueryPresetsSelect<T extends boolean = true> {
|
|
title?: T;
|
|
isShared?: T;
|
|
access?:
|
|
| T
|
|
| {
|
|
read?:
|
|
| T
|
|
| {
|
|
constraint?: T;
|
|
users?: T;
|
|
roles?: T;
|
|
};
|
|
update?:
|
|
| T
|
|
| {
|
|
constraint?: T;
|
|
users?: T;
|
|
roles?: T;
|
|
};
|
|
delete?:
|
|
| T
|
|
| {
|
|
constraint?: T;
|
|
users?: T;
|
|
};
|
|
};
|
|
where?: T;
|
|
columns?: T;
|
|
relatedCollection?: T;
|
|
isTemp?: T;
|
|
updatedAt?: T;
|
|
createdAt?: T;
|
|
}
|
|
/**
|
|
* This interface was referenced by `Config`'s JSON-Schema
|
|
* via the `definition` "auth".
|
|
*/
|
|
export interface Auth {
|
|
[k: string]: unknown;
|
|
}
|
|
|
|
|
|
declare module 'payload' {
|
|
// @ts-ignore
|
|
export interface GeneratedTypes extends Config {}
|
|
} |