@delmaredigital/payload-experiments 0.1.0-rc.6 → 0.1.0-rc.7

package/dist/collections/experiments/flagControlParams.js

@@ -6,20 +6,14 @@ export const flagControlParams = async ({ data, originalDoc, operation, req })=>
     const pointId = data.flagPoint ?? originalDoc?.flagPoint;
     const point = xpOptionsFromReq(req).flagPoints?.find((point)=>point.id === pointId);
     if (!point) return data;
-    let params = point.defaultParams;
-    try {
-        const state = await req.payload.findGlobal({
-            slug: 'xp-state',
-            req,
-            overrideAccess: false
-        });
-        const defaults = state.flagDefaults;
-        params = defaults?.[point.id]?.params ?? params;
-    } catch (cause) {
-        const error = cause;
-        if (error?.status !== 403 && error?.name !== 'Forbidden') throw cause;
-    // A refused state read must not prevent using the registered point defaults.
-    }
+    // the caller's write already passed experiments manage access; a second gate inside its hook would kill the caller's transaction on Forbidden (Payload killTransaction)
+    const state = await req.payload.findGlobal({
+        slug: 'xp-state',
+        req,
+        overrideAccess: true
+    });
+    const defaults = state.flagDefaults;
+    const params = defaults?.[point.id]?.params ?? point.defaultParams;
     const arms = data.arms ?? originalDoc?.arms;
     if (!arms) return data;
     return {

package/dist/collections/layers.js

@@ -58,6 +58,7 @@ export function layersCollection(options) {
         hooks: {
             beforeDelete: [
                 async ({ id, req })=>{
+                    // The delete already passed layers access; a refused nested read would kill the caller's transaction (Payload killTransaction) and could hide a referencing experiment.
                     const references = await req.payload.find({
                         collection: 'xp-experiments',
                         where: {
@@ -66,7 +67,7 @@ export function layersCollection(options) {
                             }
                         },
                         limit: 1,
-                        overrideAccess: false,
+                        overrideAccess: true,
                         req
                     });
                     if (references.docs.length) throw new XpRefusal('invalid-status', 'This layer is still referenced by an experiment.', undefined, 409);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-experiments",
-  "version": "0.1.0-rc.6",
+  "version": "0.1.0-rc.7",
   "description": "No-code A/B testing for Payload CMS and Next.js: block, page and flag experiments with holdouts, layers, exposure logging and honest statistics inside the admin — no vendor",
   "type": "module",
   "license": "MIT",