@delmaredigital/payload-puck 0.8.2 → 0.9.0

package/dist/api/types.d.ts

@@ -2,17 +2,54 @@ import type { NextRequest } from 'next/server';
 import type { Data as PuckData } from '@puckeditor/core';
 /**
  * Authenticated user from the auth system
+ *
+ * This is deliberately loose: `authenticate` may return a Better Auth session
+ * user, a NextAuth user, a decoded JWT payload, or a Payload user. It is used
+ * for the `canX` route-gating hooks.
+ *
+ * It is **not** what Payload evaluates access control against — see
+ * {@link PayloadUser}.
  */
 export interface AuthenticatedUser {
     id: string;
     [key: string]: unknown;
 }
+/**
+ * A Payload user document, as Payload's access-control functions expect to
+ * receive it on `req.user`.
+ *
+ * The `collection` property is what distinguishes a real Payload user from an
+ * arbitrary session object — Payload stamps it onto the user during
+ * authentication (`BaseUser` in `payload/auth/types`). Access rules such as
+ * `({ req }) => req.user?.role === 'admin'` are evaluated against this document.
+ */
+export interface PayloadUser {
+    id: string | number;
+    collection: string;
+    [key: string]: unknown;
+}
 /**
  * Result of an authentication check
  */
 export interface AuthResult {
     authenticated: boolean;
     user?: AuthenticatedUser;
+    /**
+     * The Payload user document this request should act as when Payload evaluates
+     * collection and field access control.
+     *
+     * Set this when `authenticate` already knows the Payload user — it saves the
+     * route factory a second lookup via {@link PuckApiAuthHooks.toPayloadUser}.
+     *
+     * - A user document → access control is evaluated as that user.
+     * - `null` → access control is evaluated as an anonymous/public request.
+     * - Omitted (`undefined`) → the factory falls back to `toPayloadUser`, then to
+     *   `user` if it is structurally a Payload user, and otherwise fails closed.
+     *
+     * If `authenticate` returns a Payload user as `user` (i.e. the result of
+     * `payload.auth()`), you do not need to set this at all.
+     */
+    payloadUser?: PayloadUser | null;
     error?: string;
 }
 /**
@@ -30,53 +67,86 @@ export interface PermissionResult {
  *
  * @example
  * ```typescript
- * // Example with Better Auth
+ * // The recommended wiring for EVERY auth system, including Better Auth,
+ * // NextAuth and Clerk. `payload.auth()` runs whatever auth strategies your
+ * // Payload config registers and returns a real Payload user — already carrying
+ * // `collection` plus any fields the strategy decorates onto it.
  * const authHooks: PuckApiAuthHooks = {
  *   authenticate: async (request) => {
- *     const session = await auth.api.getSession({ headers: await headers() })
- *     if (!session?.user) return { authenticated: false }
- *     return { authenticated: true, user: session.user }
- *   },
- *   canEdit: async (user, pageId) => {
- *     return { allowed: hasRole(user, 'editor') }
+ *     const payload = await getPayload({ config })
+ *     const { user } = await payload.auth({ headers: request.headers })
+ *     if (!user) return { authenticated: false }
+ *     return { authenticated: true, user }
  *   },
+ *   canPublish: async (user) => ({ allowed: user.role === 'admin' }),
  * }
  * ```
- */
+ *
+ * Do **not** call your auth library directly and return its session user
+ * (`auth.api.getSession()`, `getServerSession()`, a decoded JWT). Those objects
+ * are not Payload users, and mapping one back by email returns the bare row —
+ * silently dropping the tenant and scope context your access rules read. With
+ * Better Auth that means losing `activeOrganizationId`, `organizationRole`,
+ * `apiKeyScopes` and `oauthScopes`, and an API-key caller can then be judged as
+ * an ordinary session.
+  */
 export interface PuckApiAuthHooks {
     /**
      * Authenticate the incoming request
      * Should return the authenticated user or authentication failure
      */
     authenticate: (request: NextRequest) => Promise<AuthResult>;
+    /**
+     * Escape hatch for callers that have **no** corresponding Payload user.
+     *
+     * Prefer building `authenticate` on `payload.auth({ headers })`, which returns
+     * a Payload user directly and needs none of this. Reach for `toPayloadUser`
+     * only when your caller genuinely cannot be resolved that way.
+     *
+     * Whatever you return *is* the principal Payload evaluates access control
+     * against, so it must carry every field your access rules read. Looking the
+     * user up by email and returning the bare collection row is the common
+     * mistake: it drops the fields an auth strategy decorates onto the user, and
+     * access rules that read them will reach the wrong decision.
+     *
+     * Return `null` to deliberately evaluate access control as an anonymous
+     * (public) request.
+     */
+    toPayloadUser?: (user: AuthenticatedUser, request: NextRequest) => Promise<PayloadUser | null> | PayloadUser | null;
     /**
      * Check if user can list pages
-     * @default Always allowed for authenticated users
+     *
+     * This is coarse route gating layered *on top of* Payload's collection access
+     * rules, which are always enforced (unless explicitly disabled via
+     * `dangerouslyDisableCollectionAccessControl`). Omitting it does not grant
+     * access Payload itself would deny.
+     *
+     * @default No additional restriction beyond Payload collection access
      */
     canList?: (user: AuthenticatedUser) => Promise<PermissionResult> | PermissionResult;
     /**
      * Check if user can view a specific page
-     * @default Always allowed for authenticated users
+     * @default No additional restriction beyond Payload collection access
      */
     canView?: (user: AuthenticatedUser, pageId: string) => Promise<PermissionResult> | PermissionResult;
     /**
      * Check if user can create new pages
-     * @default Always allowed for authenticated users
+     * @default No additional restriction beyond Payload collection access
      */
     canCreate?: (user: AuthenticatedUser) => Promise<PermissionResult> | PermissionResult;
     /**
      * Check if user can edit a specific page
-     * @default Always allowed for authenticated users
+     * @default No additional restriction beyond Payload collection access
      */
     canEdit?: (user: AuthenticatedUser, pageId: string) => Promise<PermissionResult> | PermissionResult;
     /**
      * Check if user can publish a specific page (change status to published)
-     * @default Same as canEdit
+     * @default Falls back to canEdit, then to Payload collection access
      */
     canPublish?: (user: AuthenticatedUser, pageId: string) => Promise<PermissionResult> | PermissionResult;
     /**
      * Check if user can delete a specific page
-     * @default Always allowed for authenticated users
+     * @default No additional restriction beyond Payload collection access
      */
     canDelete?: (user: AuthenticatedUser, pageId: string) => Promise<PermissionResult> | PermissionResult;
 }
@@ -187,6 +257,23 @@ export interface PuckApiRoutesConfig {
      * Custom error handler for logging/monitoring
      */
     onError?: (error: unknown, context: ErrorContext) => void;
+    /**
+     * **SECURITY — do not enable without understanding the consequence.**
+     *
+     * Restores the pre-0.9.0 behaviour in which these routes called Payload's
+     * Local API with `overrideAccess: true`, so collection `access` rules and
+     * field-level access are **not** evaluated. Your `canX` hooks become the only
+     * authorization in front of read, create, update, publish, delete and version
+     * restore.
+     *
+     * This was the vulnerability described in GHSA-957g-hmmp-rchg. The only
+     * legitimate reason to set it is an emergency rollback while you wire up
+     * {@link PuckApiAuthHooks.toPayloadUser}. Setting it logs a warning once per
+     * route factory.
+     *
+     * @default false
+     */
+    dangerouslyDisableCollectionAccessControl?: true;
 }
 /**
  * Context passed to Next.js App Router route handlers

package/dist/api/utils/access.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Access-control resolution for the standalone Next.js route factories.
+ *
+ * ## Why this exists
+ *
+ * Payload's Local API defaults to `overrideAccess: true`, which skips collection
+ * and field access control entirely. The route factories in `src/api/` call the
+ * Local API directly (they hold a `Payload` instance, not a `PayloadRequest`), so
+ * without an explicit opt-in every operation ran unauthorized. `authenticate` and
+ * the `canX` hooks are *authentication* plus coarse route gating — they are not a
+ * substitute for the collection's own `access` rules.
+ *
+ * This module is the single place that decides what `{ overrideAccess, user }` a
+ * Local API call receives. Every sink in every factory spreads its result, so the
+ * invariant is enforced in one place rather than at eleven call sites.
+ *
+ * ## The problem it has to solve
+ *
+ * `PuckApiAuthHooks.authenticate` is deliberately bring-your-own: it may return a
+ * Better Auth session user, a NextAuth user, or a decoded JWT payload. Payload's
+ * access functions expect a Payload user document. Handing them a foreign-shaped
+ * object produces silently wrong authorization, which is worse than none.
+ *
+ * So the resolution is explicit and fails closed — see {@link resolvePayloadUser}.
+ */
+import type { NextRequest } from 'next/server';
+import type { AuthResult, PayloadUser, PuckApiAuthHooks } from '../types.js';
+/**
+ * The slice of a route config the resolver needs. Kept structural so any factory
+ * carrying auth hooks can use it without depending on one config interface.
+ */
+export interface AccessResolverConfig {
+    auth: PuckApiAuthHooks;
+    dangerouslyDisableCollectionAccessControl?: true;
+}
+/**
+ * Arguments spread into every Payload Local API call made by the route factories.
+ *
+ * `user` is intentionally always present (possibly `null`) when access control is
+ * on: `null` means "evaluate as an anonymous request", which is a deliberate
+ * state, not a missing value.
+ *
+ * `req` carries the *original request headers*. Access rules routinely read them
+ * — an API-key scope check cannot see its own key otherwise — and `createLocalReq`
+ * substitutes an empty `Headers` when no `req` is passed, which makes such a rule
+ * silently misjudge the request. For an API-key caller that can fail **open**.
+ */
+export type PayloadAccessArgs = {
+    overrideAccess: false;
+    user: PayloadUser | null;
+    req: {
+        headers: Headers;
+    };
+} | {
+    overrideAccess: true;
+};
+/**
+ * Mints the arguments for one Local API call.
+ *
+ * This is a factory rather than a value on purpose. `createLocalReq` **mutates**
+ * the `req` it is given (assigning `locale`, `context`, `payload`, `user`, a
+ * dataloader) and returns it. Sharing one object across the several sinks in a
+ * handler would let those assignments leak between operations. Each call gets a
+ * fresh object.
+ */
+export type AccessArgsFactory = () => PayloadAccessArgs;
+/**
+ * Thrown when the route factory cannot determine which Payload user to evaluate
+ * access control against.
+ *
+ * This is a configuration fault, not a request fault. It is surfaced as a 500
+ * with an actionable message rather than being papered over, because both of the
+ * alternatives are bugs: evaluating as anonymous silently downgrades every
+ * request, and skipping access control reintroduces the vulnerability.
+ */
+export declare class PuckApiAccessError extends Error {
+    readonly name = "PuckApiAccessError";
+    constructor(message: string);
+}
+/**
+ * Structural check for "this is a Payload user document".
+ *
+ * Payload stamps `collection` onto the authenticated user (`BaseUser` in
+ * `payload/auth/types`), and nothing else in the auth pipeline does. Combined
+ * with an `id`, it is a reliable discriminator between a Payload user and an
+ * arbitrary session object, and it is what lets the recommended wiring —
+ * `authenticate` built on `payload.auth()` — work with no extra configuration.
+ *
+ * Deliberately *stricter* than Payload itself, which tolerates a missing
+ * `collection` by silently defaulting it. That tolerance is the footgun;
+ * refusing the input is the point.
+ */
+export declare function isPayloadUser(value: unknown): value is PayloadUser;
+/**
+ * Resolve the Payload user that access control should be evaluated against.
+ *
+ * Resolution order — first match wins, and every branch is an explicit signal
+ * from the integrator rather than a guess:
+ *
+ * 1. `auth.toPayloadUser` — the explicit mapping hook. Its return value is used
+ *    verbatim, including `null`, which means "evaluate as anonymous".
+ * 2. `authResult.payloadUser` — set by `authenticate` itself when it already did
+ *    the lookup. `null` is honoured the same way.
+ * 3. `authResult.user`, when it structurally *is* a Payload user. This is the
+ *    zero-config path for Payload-auth integrators.
+ * 4. Otherwise: throw. We cannot tell whether the session maps to a privileged
+ *    user or to nobody, and guessing either way is a security bug.
+ *
+ * There is deliberately **no** automatic `payload.auth()` fallback at step 4.
+ * It would re-run the auth pipeline on every request: for an API-key caller that
+ * double-decrements the key's remaining quota and rate-limit budget (and Better
+ * Auth deletes keys on exhaustion), and it can resolve a *different* principal
+ * than the one the `canX` hooks already gated — a confused deputy. The zero-cost
+ * path is for `authenticate` itself to call `payload.auth()`, which step 3 then
+ * accepts.
+ *
+ * @throws {PuckApiAccessError} when no branch matches.
+ */
+export declare function resolvePayloadUser(auth: PuckApiAuthHooks, authResult: AuthResult, request: NextRequest): Promise<PayloadUser | null>;
+/**
+ * Build the access resolver for one route factory.
+ *
+ * Returns a function that resolves the acting user once per request and hands
+ * back an {@link AccessArgsFactory} to mint per-sink arguments. The closure holds
+ * the "already warned" flag, so the opt-out warning is emitted once per factory
+ * rather than once per request.
+ */
+export declare function createAccessResolver(routeConfig: AccessResolverConfig): (authResult: AuthResult, request: NextRequest) => Promise<AccessArgsFactory>;
+/**
+ * Map a thrown {@link PuckApiAccessError} onto a response.
+ *
+ * Returns `null` for every other error so callers can fall through to their
+ * existing handling. Without this, the factories' generic `catch` blocks would
+ * flatten a misconfiguration into "Failed to list pages", which is the hardest
+ * possible thing to debug.
+ */
+export declare function accessMisconfigurationResponse(error: unknown): Response | null;

package/dist/api/utils/access.js

@@ -0,0 +1,180 @@
+/**
+ * Access-control resolution for the standalone Next.js route factories.
+ *
+ * ## Why this exists
+ *
+ * Payload's Local API defaults to `overrideAccess: true`, which skips collection
+ * and field access control entirely. The route factories in `src/api/` call the
+ * Local API directly (they hold a `Payload` instance, not a `PayloadRequest`), so
+ * without an explicit opt-in every operation ran unauthorized. `authenticate` and
+ * the `canX` hooks are *authentication* plus coarse route gating — they are not a
+ * substitute for the collection's own `access` rules.
+ *
+ * This module is the single place that decides what `{ overrideAccess, user }` a
+ * Local API call receives. Every sink in every factory spreads its result, so the
+ * invariant is enforced in one place rather than at eleven call sites.
+ *
+ * ## The problem it has to solve
+ *
+ * `PuckApiAuthHooks.authenticate` is deliberately bring-your-own: it may return a
+ * Better Auth session user, a NextAuth user, or a decoded JWT payload. Payload's
+ * access functions expect a Payload user document. Handing them a foreign-shaped
+ * object produces silently wrong authorization, which is worse than none.
+ *
+ * So the resolution is explicit and fails closed — see {@link resolvePayloadUser}.
+ */ /**
+ * Thrown when the route factory cannot determine which Payload user to evaluate
+ * access control against.
+ *
+ * This is a configuration fault, not a request fault. It is surfaced as a 500
+ * with an actionable message rather than being papered over, because both of the
+ * alternatives are bugs: evaluating as anonymous silently downgrades every
+ * request, and skipping access control reintroduces the vulnerability.
+ */ export class PuckApiAccessError extends Error {
+    name = 'PuckApiAccessError';
+    constructor(message){
+        super(message);
+        // Preserve the prototype chain when compiled down to ES5-era output.
+        Object.setPrototypeOf(this, PuckApiAccessError.prototype);
+    }
+}
+const MISCONFIGURED_MESSAGE = [
+    '[payload-puck] Cannot resolve a Payload user for this request, so collection',
+    'access control cannot be evaluated. The route factory refuses to run the',
+    'operation rather than bypass authorization.',
+    '',
+    'THE FIX, for almost every case: build `authenticate` on `payload.auth()`',
+    'rather than on your auth library directly. It runs whatever auth strategies',
+    'your Payload config registers — Better Auth, Clerk, custom strategies — and',
+    'returns a real Payload user:',
+    '',
+    '    authenticate: async (request) => {',
+    '      const payload = await getPayload({ config })',
+    '      const { user } = await payload.auth({ headers: request.headers })',
+    '      if (!user) return { authenticated: false }',
+    '      return { authenticated: true, user }',
+    '    }',
+    '',
+    'This is the recommended wiring even when your session comes from Better Auth',
+    'or NextAuth. Do NOT look the user up by email and return the bare row: that',
+    'silently drops the fields your auth strategy decorates onto the user (for',
+    'Better Auth: activeOrganizationId, organizationRole, apiKeyScopes,',
+    'oauthScopes), and access rules that read them then reach the wrong decision —',
+    'in the API-key case, potentially a permissive one.',
+    '',
+    'Only if your caller genuinely has no corresponding Payload user:',
+    '',
+    '  - Return `payloadUser` from `authenticate`, or implement `toPayloadUser`, if',
+    '    you can construct the equivalent Payload user yourself — including every',
+    '    field your access rules read.',
+    '  - Use `toPayloadUser: () => null` to deliberately evaluate access control as',
+    '    an anonymous (public) request.',
+    '',
+    'As a last resort you may set `dangerouslyDisableCollectionAccessControl: true`',
+    'on the route config. That restores the pre-fix behaviour in which Payload',
+    'collection and field access rules are NOT enforced on these routes, leaving the',
+    '`canX` hooks as your only authorization. See GHSA-957g-hmmp-rchg.'
+].join('\n');
+/**
+ * Structural check for "this is a Payload user document".
+ *
+ * Payload stamps `collection` onto the authenticated user (`BaseUser` in
+ * `payload/auth/types`), and nothing else in the auth pipeline does. Combined
+ * with an `id`, it is a reliable discriminator between a Payload user and an
+ * arbitrary session object, and it is what lets the recommended wiring —
+ * `authenticate` built on `payload.auth()` — work with no extra configuration.
+ *
+ * Deliberately *stricter* than Payload itself, which tolerates a missing
+ * `collection` by silently defaulting it. That tolerance is the footgun;
+ * refusing the input is the point.
+ */ export function isPayloadUser(value) {
+    if (typeof value !== 'object' || value === null) return false;
+    const candidate = value;
+    const hasId = typeof candidate.id === 'string' || typeof candidate.id === 'number';
+    return hasId && typeof candidate.collection === 'string';
+}
+/**
+ * Resolve the Payload user that access control should be evaluated against.
+ *
+ * Resolution order — first match wins, and every branch is an explicit signal
+ * from the integrator rather than a guess:
+ *
+ * 1. `auth.toPayloadUser` — the explicit mapping hook. Its return value is used
+ *    verbatim, including `null`, which means "evaluate as anonymous".
+ * 2. `authResult.payloadUser` — set by `authenticate` itself when it already did
+ *    the lookup. `null` is honoured the same way.
+ * 3. `authResult.user`, when it structurally *is* a Payload user. This is the
+ *    zero-config path for Payload-auth integrators.
+ * 4. Otherwise: throw. We cannot tell whether the session maps to a privileged
+ *    user or to nobody, and guessing either way is a security bug.
+ *
+ * There is deliberately **no** automatic `payload.auth()` fallback at step 4.
+ * It would re-run the auth pipeline on every request: for an API-key caller that
+ * double-decrements the key's remaining quota and rate-limit budget (and Better
+ * Auth deletes keys on exhaustion), and it can resolve a *different* principal
+ * than the one the `canX` hooks already gated — a confused deputy. The zero-cost
+ * path is for `authenticate` itself to call `payload.auth()`, which step 3 then
+ * accepts.
+ *
+ * @throws {PuckApiAccessError} when no branch matches.
+ */ export async function resolvePayloadUser(auth, authResult, request) {
+    if (auth.toPayloadUser) {
+        const mapped = await auth.toPayloadUser(authResult.user, request);
+        return mapped ?? null;
+    }
+    if (authResult.payloadUser !== undefined) {
+        return authResult.payloadUser ?? null;
+    }
+    if (isPayloadUser(authResult.user)) {
+        return authResult.user;
+    }
+    throw new PuckApiAccessError(MISCONFIGURED_MESSAGE);
+}
+/**
+ * Build the access resolver for one route factory.
+ *
+ * Returns a function that resolves the acting user once per request and hands
+ * back an {@link AccessArgsFactory} to mint per-sink arguments. The closure holds
+ * the "already warned" flag, so the opt-out warning is emitted once per factory
+ * rather than once per request.
+ */ export function createAccessResolver(routeConfig) {
+    const { auth, dangerouslyDisableCollectionAccessControl } = routeConfig;
+    let warned = false;
+    return async function resolveAccess(authResult, request) {
+        if (dangerouslyDisableCollectionAccessControl === true) {
+            if (!warned) {
+                warned = true;
+                console.warn('[payload-puck] SECURITY: `dangerouslyDisableCollectionAccessControl` is ' + 'enabled on a Puck API route. Payload collection and field access rules ' + 'are NOT enforced on these routes; the `canX` hooks are the only ' + 'authorization in effect. See GHSA-957g-hmmp-rchg.');
+            }
+            return ()=>({
+                    overrideAccess: true
+                });
+        }
+        const user = await resolvePayloadUser(auth, authResult, request);
+        return ()=>({
+                overrideAccess: false,
+                user,
+                // Fresh per call — createLocalReq mutates whatever it is given.
+                req: {
+                    headers: request.headers
+                }
+            });
+    };
+}
+/**
+ * Map a thrown {@link PuckApiAccessError} onto a response.
+ *
+ * Returns `null` for every other error so callers can fall through to their
+ * existing handling. Without this, the factories' generic `catch` blocks would
+ * flatten a misconfiguration into "Failed to list pages", which is the hardest
+ * possible thing to debug.
+ */ export function accessMisconfigurationResponse(error) {
+    if (!(error instanceof PuckApiAccessError)) return null;
+    console.error(error.message);
+    return Response.json({
+        error: 'Server misconfiguration: Puck API routes cannot resolve a Payload user ' + 'for access control. See the server logs for the fix.',
+        code: 'PUCK_ACCESS_MISCONFIGURED'
+    }, {
+        status: 500
+    });
+}

package/dist/endpoints/ai.js

@@ -15,9 +15,21 @@ import { pagePatternSystemContext } from '../ai/presets/index.js';
         if (!hasContextCollection) {
             return undefined;
         }
-        // Fetch enabled context entries, sorted by order
+        // Fetch enabled context entries, sorted by order.
+        //
+        // `overrideAccess: true` is deliberate here, and is the one sink in the
+        // request path that keeps it. This is a trusted server-side read that builds
+        // the AI system prompt; it is never returned to the caller as data. The
+        // prompt must be identical for every operator allowed to invoke generation,
+        // otherwise output would silently vary with each user's read permissions on
+        // the context collection. Authorization for *using* AI generation is enforced
+        // by the endpoint's own `req.user` gate, above this call.
+        //
+        // Contrast with endpoints/context.ts, where the same collection is exposed
+        // as user-facing CRUD and is access-controlled (GHSA-rrx7-m589-5wfq).
         const result = await req.payload.find({
             collection: AI_CONTEXT_COLLECTION,
+            overrideAccess: true,
             where: {
                 enabled: {
                     equals: true
@@ -192,6 +204,10 @@ import { pagePatternSystemContext } from '../ai/presets/index.js';
             if (options.tools && Object.keys(options.tools).length > 0) {
                 const toolContext = {
                     payload: req.payload,
+                    // Tools read on behalf of the operator, so they must be evaluated
+                    // against that user's access rules — otherwise a low-privilege editor
+                    // can have the model read documents they cannot, and echo the content
+                    // back through generated output.
                     user: req.user
                 };
                 // Create wrapped tools that inject the context

package/dist/endpoints/context.js

@@ -1,4 +1,11 @@
+import { payloadErrorStatus } from '../utils/payloadErrors.js';
 /**
+ * Access control: every handler passes `overrideAccess: false` and `req` to
+ * Payload's local API, so the collection's own `access` rules and field-level
+ * access are enforced against the calling user. The `if (!req.user)` gate is
+ * authentication only — it is not a substitute for authorization, and relying on
+ * it alone was the bug in GHSA-rrx7-m589-5wfq.
+ */ /**
  * Collection slug for AI context
  * Matches the auto-generated collection from createPuckPlugin
  */ const COLLECTION = 'puck-ai-context';
@@ -22,6 +29,8 @@
             const includeAll = req.query?.all === 'true';
             const result = await req.payload.find({
                 collection: COLLECTION,
+                req,
+                overrideAccess: false,
                 sort: 'order',
                 limit: 100,
                 where: includeAll ? {} : {
@@ -36,7 +45,7 @@
             return Response.json({
                 error: e instanceof Error ? e.message : 'Failed to list context'
             }, {
-                status: 500
+                status: payloadErrorStatus(e) ?? 500
             });
         }
     };
@@ -66,6 +75,8 @@
             }
             const doc = await req.payload.create({
                 collection: COLLECTION,
+                req,
+                overrideAccess: false,
                 data
             });
             return Response.json(doc);
@@ -74,7 +85,7 @@
             return Response.json({
                 error: e instanceof Error ? e.message : 'Failed to create context'
             }, {
-                status: 500
+                status: payloadErrorStatus(e) ?? 500
             });
         }
     };
@@ -112,6 +123,8 @@
             }
             const doc = await req.payload.update({
                 collection: COLLECTION,
+                req,
+                overrideAccess: false,
                 id,
                 data
             });
@@ -121,7 +134,7 @@
             return Response.json({
                 error: e instanceof Error ? e.message : 'Failed to update context'
             }, {
-                status: 500
+                status: payloadErrorStatus(e) ?? 500
             });
         }
     };
@@ -150,6 +163,8 @@
         try {
             await req.payload.delete({
                 collection: COLLECTION,
+                req,
+                overrideAccess: false,
                 id
             });
             return Response.json({
@@ -160,7 +175,7 @@
             return Response.json({
                 error: e instanceof Error ? e.message : 'Failed to delete context'
             }, {
-                status: 500
+                status: payloadErrorStatus(e) ?? 500
             });
         }
     };