Skip to content

Commit a539f5b

Browse files
nathanlentzvansh17June
nathanlentz
and
vansh17June
authored
fix: pass id to delete access control on soft delete in updateByID (#17529)
Backport of #17453 to `3.x`. ### What? Fixes a missing `id` in the `access.delete` control callback when a document is soft-deleted (trashed) via the `updateByID` operation. ### Why? When a collection has `trash: true`, soft-deleting a document goes through the `updateByID` operation. The `access.update` callback correctly receives `{ id, data, req }`, but the `access.delete` callback (called right below it for the trash check) only received `{ data, req }` — `id` was missing. This makes it impossible for a `delete` access control function to reliably identify which document is being trashed, forcing developers to rely on `data.deletedAt` alone. ### How? One-line fix in `packages/payload/src/collections/operations/updateByID.ts` — `id` was already destructured and in scope at that point in the function, so it just needed to be passed through: ```diff - const deleteAccessResult = await executeAccess({ data, req }, collectionConfig.access.delete) + const deleteAccessResult = await executeAccess({ id, data, req }, collectionConfig.access.delete) ``` Fixes #17452 Co-authored-by: vansh <devlopervansh@gmail.com>
1 parent bf72bda commit a539f5b

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

‎packages/payload/src/collections/operations/updateByID.ts‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,10 @@ export const updateByIDOperation = async <
138138

139139
if (isTrashAttempt && !overrideAccess) {
140140
// Pass data so access function can check data.deletedAt to know it's a trash attempt
141-
const deleteAccessResult = await executeAccess({ data, req }, collectionConfig.access.delete)
141+
const deleteAccessResult = await executeAccess(
142+
{ id, data, req },
143+
collectionConfig.access.delete,
144+
)
142145
fullWhere = combineQueries(fullWhere, deleteAccessResult)
143146
}
144147

0 commit comments

Comments
 (0)