48 lines
2.3 KiB
Plaintext
48 lines
2.3 KiB
Plaintext
---
|
|
title: Respecting Access Control with Local API Operations
|
|
label: Access Control
|
|
order: 40
|
|
desc: Learn how to implement and enforce access control in Payload's Local API operations, ensuring that the right permissions are respected during data manipulation.
|
|
keywords: server functions, local API, Payload, CMS, access control, permissions, user context, server-side logic, custom workflows, data management, headless CMS, TypeScript, Node.js, backend
|
|
---
|
|
|
|
In Payload, local API operations **override access control by default**. This means that operations will run without checking if the current user has permission to perform the action. This is useful in certain scenarios where access control is not necessary, but it is important to be aware of when to enforce it for security reasons.
|
|
|
|
### Default Behavior: Access Control Skipped
|
|
|
|
By default, **local API operations skip access control**. This allows operations to execute without the system checking if the current user has appropriate permissions. This might be helpful in admin or server-side scripts where the user context is not required to perform the operation.
|
|
|
|
#### For example:
|
|
|
|
```ts
|
|
// Access control is this operation would be skipped by default
|
|
const test = await payload.create({
|
|
collection: 'users',
|
|
data: {
|
|
email: 'test@test.com',
|
|
password: 'test',
|
|
},
|
|
})
|
|
```
|
|
|
|
### Respecting Access Control
|
|
|
|
If you want to respect access control and ensure that the operation is performed only if the user has appropriate permissions, you need to explicitly pass the `user` object and set the `overrideAccess` option to `false`.
|
|
|
|
- `overrideAccess: false`: This ensures that access control is **not skipped** and the operation respects the current user's permissions.
|
|
- `user`: Pass the authenticated user context to the operation. This ensures the system checks whether the user has the right permissions to perform the action.
|
|
|
|
```ts
|
|
const authedCreate = await payload.create({
|
|
collection: 'users',
|
|
overrideAccess: false, // This ensures access control will be applied
|
|
user, // Pass the authenticated user to check permissions
|
|
data: {
|
|
email: 'test@test.com',
|
|
password: 'test',
|
|
},
|
|
})
|
|
```
|
|
|
|
This example will only allow the document to be created if the `user` we passed has the appropriate access control permissions.
|