Payload RBAC

[teunmooij]

Version 1 of payload-rbac is now available.

It includes:

• plugin to extend your auth collection(s) with a roles property
• lots of predefined access control functions
• tools to combine access control functions to support more complex situations
• fully compatible with any custom access control functions you might already have
• powerful filtering options built on top of Payloads query system

And can be used like this:

const compositeAccess = requireOne(
  requireAll(
    allowAnyUser(), // logged in users can access documents that are
    requireOne(
      allowPublished(), // either published
      filter({ author: { equals: ({ req }) => req.user.id } }), // or for which they are the author
    ),
  ),
  allowUserWithRole('editor'), // editors can access all documents
);