Can the local API use the user token for access control?

[payloadcms]

Can the local API use the user token for access control?

[jmikrut]

Hey @ahaasler — yes, this is totally possible. But, our local API does not accept token as an argument. Instead, it accepts a full user.

We would certainly accept a PR that exposes a new property to our local API called userToken or similar, that will accept a string JWT and attempt to verify / decode it for use as a user, but right now, we only accept a user.

To decode the token and pass it as a user to the payload.find local API method, you would do something like this:

import jwt from 'jsonwebtoken';
import { notFound } from "next/navigation";
import { getPayloadClient } from "@/content/payloadClient";
import { Post } from "@/content/types";
import RichText from "@/components/RichText";
import { cookies } from 'next/headers'


async function getPostBySlug(slug: string): Promise<Post> {
  const payload = await getPayloadClient();
  const cookieStore = cookies()
  // new line to verify JWT using cookie value and payload secret
  const user = jwt.verify(cookieStore.get('payload-token').value, payload.secret)

  const posts = await payload.find({
    collection: "posts",
    overrideAccess: false,
    // just pass the user
    user,
    where: {
      slug: {
        equals: slug,
      },
    },
  });
  return posts.docs[0];
}

I haven't tested the above, but this should work just fine!

Give it a shot?

[ahaasler]

Hi @jmikrut, thanks for your help. It almost works out of the box.

When using roles, the user document in the token does not work for access control without including said roles.

If the role can be inferred from the email the solution is pretty easy:

if (user?.email === "[email protected]") {
	user.roles = ["admin"]
}

If that is not possible, a user search solves it:

const userWithRoles = await payload.findByID({
	collection: "users",
	id: user?.id
})

But the best solution is to modify the user collection so that the roles are stored on the token with saveToJWT: true,:

import type { CollectionConfig } from 'payload/types'

export const Users: CollectionConfig = {
	slug: 'users',
	auth: true,
	admin: {
		...
	},
	access: {
		...
	},
	fields: [
		...
		{
			name: 'roles',
			type: 'select',
			hasMany: true,
			saveToJWT: true,
			defaultValue: ['public'],
			required: true,
			access: {
				...
			},
			options: ['admin', 'public'],
		},
	],
}