@delmaredigital/payload-puck 0.9.0 → 0.9.1

package/README.md

@@ -10,6 +10,13 @@ A PayloadCMS plugin for integrating [Puck](https://puckeditor.com) visual page b
   <a href="https://vercel.com/new/clone?repository-url=https%3A%2F%2Fgithub.com%2Fdelmaredigital%2Fdd-starter&project-name=my-payload-site&build-command=pnpm%20run%20ci&env=PAYLOAD_SECRET,BETTER_AUTH_SECRET&stores=%5B%7B%22type%22%3A%22integration%22%2C%22protocol%22%3A%22storage%22%2C%22productSlug%22%3A%22neon%22%2C%22integrationSlug%22%3A%22neon%22%7D%2C%7B%22type%22%3A%22blob%22%7D%5D"><img src="https://vercel.com/button" alt="Deploy with Vercel" height="32"></a>
 </p>
 
+> 🔒 **Upgrading to 0.9.1? Security release — the generated pages collection no longer defaults to allow-all writes.**
+>
+> - If you called `createPuckPlugin()` without an `access` option, your `pages` collection let **anonymous** callers create, update and delete through Payload's REST/GraphQL API. `create`, `update` and `delete` now default to any authenticated user; `read` stays public. Anything you pass explicitly still wins.
+> - **Action:** none if you already pass `access`. Otherwise decide who may write pages and say so, e.g. `access: { update: ({ req }) => req.user?.role === 'admin' }`. See the [CHANGELOG](./CHANGELOG.md#091---2026-09-09).
+
+---
+
 > 🔒 **Upgrading to 0.9? Security release — action required if you use the standalone route factories.**
 >
 > - **`createPuckApiRoutes`, `createPuckApiRoutesWithId`, `createPuckApiRoutesVersions` and `createPromptApiRoutes` now enforce Payload collection access control** ([GHSA-957g-hmmp-rchg](https://github.com/delmaredigital/payload-puck/security/advisories/GHSA-957g-hmmp-rchg)). They previously called Payload's Local API with the default `overrideAccess: true`, so collection and field `access` rules were **never evaluated** — any caller your `authenticate` hook accepted could read drafts and version history, restore versions over live content, publish, create and delete.

package/dist/plugin/collections/Pages.js

@@ -2,8 +2,13 @@ import { DEFAULT_LAYOUTS } from '../../layouts/defaults.js';
 import { puckDataField, createEditorVersionField, createPageLayoutField, isHomepageField, seoFieldGroup, conversionFieldGroup } from '../fields/index.js';
 import { createIsHomepageUniqueHook } from '../hooks/isHomepageUnique.js';
 /**
- * Default access function - allows all
- */ const defaultAccess = ()=>true;
+ * Default access: anyone may read, only authenticated Payload users may write.
+ *
+ * Before 0.9.1 every operation defaulted to allow-all, so a plugin consumer who
+ * passed no `access` shipped a pages collection that anonymous REST callers
+ * could create, update and delete.
+ */ const defaultReadAccess = ()=>true;
+const defaultWriteAccess = ({ req })=>Boolean(req.user);
 /**
  * Generates a Pages collection configuration for Puck
  */ export function generatePagesCollection(slug, options) {
@@ -91,10 +96,10 @@ import { createIsHomepageUniqueHook } from '../hooks/isHomepageUnique.js';
             ...collectionOverrides.admin ?? {}
         },
         access: {
-            read: access.read ?? defaultAccess,
-            create: access.create ?? defaultAccess,
-            update: access.update ?? defaultAccess,
-            delete: access.delete ?? defaultAccess,
+            read: access.read ?? defaultReadAccess,
+            create: access.create ?? defaultWriteAccess,
+            update: access.update ?? defaultWriteAccess,
+            delete: access.delete ?? defaultWriteAccess,
             ...collectionOverrides.access ?? {}
         },
         hooks: {

package/dist/types/index.d.ts

@@ -51,8 +51,12 @@ export interface PuckPluginOptions {
      */
     collectionOverrides?: Partial<CollectionConfig>;
     /**
-     * Access control for Puck operations
-     * Uses Payload's Access type for full compatibility
+     * Access control for the generated pages collection.
+     * Uses Payload's Access type for full compatibility.
+     *
+     * Defaults: `read` allows everyone; `create`, `update` and `delete` require
+     * an authenticated Payload user (`({ req }) => Boolean(req.user)`). Pass your
+     * own functions to tighten this, e.g. `update: ({ req }) => req.user?.role === 'admin'`.
      */
     access?: {
         read?: Access;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.9.0";
+export declare const VERSION = "0.9.1";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/generate-version.js - do not edit manually
-export const VERSION = '0.9.0';
+export const VERSION = '0.9.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-puck",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Puck visual page builder plugin for Payload CMS",
   "type": "module",
   "license": "MIT",
@@ -144,24 +144,24 @@
     "@puckeditor/cloud-client": "^0.8.2",
     "@puckeditor/plugin-ai": "^0.8.2",
     "@puckeditor/plugin-heading-analyzer": "^0.23.0",
-    "@radix-ui/react-popover": "^1.1.15",
-    "@tiptap/core": "^3.29.2",
-    "@tiptap/extension-color": "^3.29.2",
-    "@tiptap/extension-highlight": "^3.29.2",
-    "@tiptap/extension-link": "^3.29.2",
-    "@tiptap/extension-subscript": "^3.29.2",
-    "@tiptap/extension-superscript": "^3.29.2",
-    "@tiptap/extension-text-align": "^3.29.2",
-    "@tiptap/extension-text-style": "^3.29.2",
-    "@tiptap/extension-underline": "^3.29.2",
-    "@tiptap/react": "^3.29.2",
-    "@tiptap/starter-kit": "^3.29.2",
+    "@radix-ui/react-popover": "^1.1.23",
+    "@tiptap/core": "^3.31.0",
+    "@tiptap/extension-color": "^3.31.0",
+    "@tiptap/extension-highlight": "^3.31.0",
+    "@tiptap/extension-link": "^3.31.0",
+    "@tiptap/extension-subscript": "^3.31.0",
+    "@tiptap/extension-superscript": "^3.31.0",
+    "@tiptap/extension-text-align": "^3.31.0",
+    "@tiptap/extension-text-style": "^3.31.0",
+    "@tiptap/extension-underline": "^3.31.0",
+    "@tiptap/react": "^3.31.0",
+    "@tiptap/starter-kit": "^3.31.0",
     "html-react-parser": "^6.1.5",
-    "lucide-react": "^1.30.0"
+    "lucide-react": "^1.39.0"
   },
   "devDependencies": {
-    "@payloadcms/next": "^3.87.1",
-    "@payloadcms/ui": "^3.87.1",
+    "@payloadcms/next": "^3.88.0",
+    "@payloadcms/ui": "^3.88.0",
     "@puckeditor/core": "^0.23.0",
     "@swc/cli": "^0.8.1",
     "@swc/core": "^1.15.47",
@@ -171,7 +171,7 @@
     "@vitest/coverage-v8": "^4.1.10",
     "copyfiles": "^2.4.1",
     "next": "^16.3.0",
-    "payload": "^3.87.1",
+    "payload": "^3.88.0",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "typescript": "^5.9.3",
@@ -197,5 +197,22 @@
   "bugs": {
     "url": "https://github.com/delmaredigital/payload-puck/issues"
   },
-  "homepage": "https://delmaredigital.com/developers"
+  "homepage": "https://delmaredigital.com/developers",
+  "pnpm": {
+    "overrides": {
+      "brace-expansion@1": "^1.1.16",
+      "brace-expansion@2": "^2.1.2",
+      "dompurify": "^3.4.13",
+      "fast-uri": "^3.1.5",
+      "happy-dom": "^20.8.9",
+      "immutable": "^4.3.9",
+      "js-yaml@4": "^4.3.1",
+      "linkify-it": "^5.0.2",
+      "markdown-it": "^14.2.0",
+      "nanoid@3": "^3.3.18",
+      "piscina": "^4.9.3",
+      "postcss": "^8.5.23",
+      "ws": "^8.21.0"
+    }
+  }
 }