feat(cms): add public read access and draft mode support - #35
Conversation
There was a problem hiding this comment.
@ASPactores Do you think we should add some sort of authorizer here to check the tokens?
There was a problem hiding this comment.
- Provide a sample scenario or model where this access pattern will be used for.
- Provide tests for this collection access function. Just provide screenshots that it works for unauthenticated
There was a problem hiding this comment.
Let's revisit this for endpoint once all models for the durianpy website CMS integration is done, so we can check if all types are generated properly
There was a problem hiding this comment.
If this is a needed change for the other tickets, then we can move this file change to a separate PR, or move the change for the endpoints/durianpy-website-types in another separate PR
- add `anyone` access control function with draft-token bypass for unpublished/draft documents - generate and wire up CMS_DRAFT_SECRET_TOKEN for draft mode auth - add custom /durianpy-website-types endpoint to sync only relevant collection types to the website repo
Extend the `anyone` access function to handle global reads, which require a boolean return instead of a where clause. Detects global requests via routeParams/pathname and gates access on the `draft` query param so unpublished draft content isn't exposed to anonymous requests.
11c90a9 to
fa42c07
Compare
…cess util to type endpoint
There was a problem hiding this comment.
Kindly do:
git fetch origin
git checkout 15-cms-migrate-setup-cms-api-client-type-sync-draft-mode
git rebase origin/15-cms-migrate-setup-cms-api-client-type-sync-draft-mode -X ours
Then perform some tests to our API security. To do this, you may create a service account through the service account collection in the PayloadCMS admin console and then apply different combination of permissions to the service account. Sample curl request:
curl --location 'http://localhost:3000/api/durianpy-website-types' \
--header 'Authorization: service-accounts API-Key <generate one from the service account collection>'
You may perform this test case:
#57
3 participants
📝 Overview
What does this PR do? Briefly describe the changes and the goal of this PR.
🚀 Type of Change
🧱 CMS & Database Changes
Skip this section if no CMS or database changes were made.
payload migrate:createand saved the file.📊 Data Structure
Describe the new fields/tables or drag-and-drop a screenshot here:
🧪 Testing & Validation
📸 Visual Evidence (Mandatory)
Important
Visual proof is required to demonstrate that the approved test cases from the issue were successfully met.
Please provide screenshots, screen recordings (GIFs/Videos), or sample API outputs proving that the feature satisfies all approved test cases and do not introduce regressions.
cms client
type sync
collection with draft
collection without draft
📋 Final Checklist
mainand resolved conflicts.🧠 Extra Notes / Questions
Add any additional context or questions for the reviewers here.