@mvriu5/payload-ai 0.5.0 → 0.5.8

package/dist/endpoints/aiChatEndpointHandler.js

@@ -5,6 +5,7 @@ import { getModel, getProviderConfig } from "../ai/providerRuntime.js";
 import { isAIProvider } from "../ai/providerOptions.js";
 import { containsSensitiveData } from "../ai/sensitiveData.js";
 import { buildPromptWithMentionContext, collectBlocks, describeField, getAllowedCollectionSlugs, getMentionContext } from "../payload/schemaContext.js";
+import { getCollectionPermissions, isCollectionActionAllowed } from "../payload/collectionPermissions.js";
 export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
         if (!req.user) return Response.json({
             error: "Unauthorized"
@@ -26,8 +27,10 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
             status: 400
         });
         const provider = requestedProvider;
+        const userApiKey = options.allowUserApiKeys === false ? null : user.aiApiKey;
         const providerConfig = getProviderConfig({
-            apiKey: user.aiApiKey,
+            apiKey: userApiKey,
+            defaultModels: options.models?.defaults,
             model: body?.model,
             provider
         });
@@ -48,7 +51,7 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
         };
         if (!providerConfig.apiKey) {
             return Response.json({
-                error: `Add a ${provider} API key to your account settings first.`
+                error: options.allowUserApiKeys === false ? `Configure a ${provider} API key in the server environment first.` : `Add a ${provider} API key to your account settings or configure it in the server environment first.`
             }, {
                 status: 400
             });
@@ -93,6 +96,17 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                 req
             });
             const collectionSlugSchema = z.enum(collectionSlugs);
+            const getDisallowedCollectionActionError = (collection, action)=>{
+                if (isCollectionActionAllowed({
+                    action,
+                    permissions: options.collections,
+                    req,
+                    slug: collection
+                })) return null;
+                return {
+                    error: `${action} is not enabled for collection: ${collection}`
+                };
+            };
             const tools = {
                 getDoc: {
                     description: "Read one document by collection slug and document id.",
@@ -117,6 +131,10 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                         return allowedCollections.map((collection)=>({
                                 fields: collection.fields.map(describeField),
                                 label: collection.labels?.plural || collection.slug,
+                                permissions: getCollectionPermissions({
+                                    permissions: options.collections,
+                                    slug: collection.slug
+                                }),
                                 slug: collection.slug
                             }));
                     }
@@ -158,6 +176,8 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                         label: z.string().min(1)
                     }),
                     execute: async ({ collection, data, label })=>{
+                        const permissionError = getDisallowedCollectionActionError(collection, "create");
+                        if (permissionError) return permissionError;
                         const proposal = {
                             action: "create",
                             collection,
@@ -175,6 +195,8 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                         label: z.string().min(1)
                     }),
                     execute: async ({ collection, id, label })=>{
+                        const permissionError = getDisallowedCollectionActionError(collection, "delete");
+                        if (permissionError) return permissionError;
                         const proposal = {
                             action: "delete",
                             collection,
@@ -193,6 +215,8 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                         label: z.string().min(1)
                     }),
                     execute: async ({ collection, data, id, label })=>{
+                        const permissionError = getDisallowedCollectionActionError(collection, "update");
+                        if (permissionError) return permissionError;
                         const proposal = {
                             action: "update",
                             collection,

package/dist/endpoints/aiMentionSuggestionsEndpointHandler.d.ts

@@ -1,6 +1,7 @@
 import type { PayloadHandler } from "payload";
+import { type ResolvedAICollectionPermissionMap } from "../payload/collectionPermissions.js";
 type AIMentionSuggestionsEndpointOptions = {
-    collections?: string[];
+    collections?: ResolvedAICollectionPermissionMap;
 };
 export declare const createAIMentionSuggestionsEndpointHandler: (options?: AIMentionSuggestionsEndpointOptions) => PayloadHandler;
 export {};

package/dist/endpoints/aiMentionSuggestionsEndpointHandler.js

@@ -1,9 +1,4 @@
-import { isInternalCollection } from "../payload/shared.js";
-const isAllowedCollectionSlug = (slug, collections)=>{
-    if (isInternalCollection(slug)) return false;
-    if (!collections) return true;
-    return collections.includes(slug);
-};
+import { isCollectionActionAllowed } from "../payload/collectionPermissions.js";
 const getDocLabel = (doc, useAsTitle)=>{
     const titleField = useAsTitle && typeof doc[useAsTitle] === "string" ? doc[useAsTitle] : null;
     return (titleField || doc.title || doc.name || doc.email || doc.id || "Untitled").toString();
@@ -22,7 +17,12 @@ export const createAIMentionSuggestionsEndpointHandler = (options = {})=>async (
         });
         const suggestions = [];
         const collections = req.payload.config.collections.filter((collection)=>{
-            if (!isAllowedCollectionSlug(collection.slug, options.collections)) return false;
+            if (!isCollectionActionAllowed({
+                action: "read",
+                permissions: options.collections,
+                req,
+                slug: collection.slug
+            })) return false;
             if (collectionSlug) return collection.slug === collectionSlug;
             return true;
         });

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 import type { CollectionSlug, Config } from "payload";
 import { type AIModelConfig } from "./ai/providerOptions.js";
+import { type AICollectionPermissionConfig } from "./payload/collectionPermissions.js";
 export type PayloadAiPluginOptions = {
-    collections?: Partial<Record<CollectionSlug, true>>;
+    allowUserApiKeys?: boolean;
+    collections?: Partial<Record<CollectionSlug, AICollectionPermissionConfig>>;
     disabled?: boolean;
     models?: AIModelConfig;
 };

package/dist/index.js

@@ -2,11 +2,9 @@ import { aiProviders, getResolvedAIModelConfig } from "./ai/providerOptions.js";
 import { createAIApplyActionEndpointHandler } from "./endpoints/aiApplyActionEndpointHandler.js";
 import { createAIChatEndpointHandler } from "./endpoints/aiChatEndpointHandler.js";
 import { createAIMentionSuggestionsEndpointHandler } from "./endpoints/aiMentionSuggestionsEndpointHandler.js";
-const getEnabledCollections = (collections)=>{
-    if (!collections) return undefined;
-    return Object.entries(collections).filter(([, enabled])=>enabled).map(([slug])=>slug);
-};
-const addAccountFields = (config)=>{
+import { resolveCollectionPermissions } from "./payload/collectionPermissions.js";
+import { isInternalCollection } from "./payload/shared.js";
+const addAccountFields = ({ allowUserApiKeys, config })=>{
     const adminUserSlug = config.admin?.user;
     if (!adminUserSlug || !config.collections) return;
     const userCollection = config.collections.find((c)=>c.slug === adminUserSlug);
@@ -16,29 +14,40 @@ const addAccountFields = (config)=>{
         type: "select",
         defaultValue: "openai",
         options: aiProviders
-    }, {
-        name: "aiApiKey",
-        type: "text",
-        admin: {
-            components: {
-                Field: "payload-ai-plugin/client#AIApiKeyField"
-            }
-        }
     });
+    if (allowUserApiKeys) {
+        userCollection.fields.push({
+            name: "aiApiKey",
+            type: "text",
+            admin: {
+                components: {
+                    Field: "payload-ai-plugin/client#AIApiKeyField"
+                },
+                description: "Optional. If empty, the plugin uses the provider API key from environment variables."
+            }
+        });
+    }
 };
 export const payloadAiPlugin = (pluginOptions)=>(config)=>{
         const incomingOnInit = config.onInit;
-        const enabledCollections = getEnabledCollections(pluginOptions.collections);
+        const collectionPermissions = resolveCollectionPermissions(pluginOptions.collections);
+        const allowUserApiKeys = pluginOptions.allowUserApiKeys !== false;
         const modelConfig = getResolvedAIModelConfig(pluginOptions.models);
         if (!config.collections) config.collections = [];
-        addAccountFields(config);
+        addAccountFields({
+            allowUserApiKeys,
+            config
+        });
         if (pluginOptions.disabled) return config;
+        const mentionCollectionSlugs = config.collections.filter((collection)=>!isInternalCollection(collection.slug)).filter((collection)=>collectionPermissions ? Boolean(collectionPermissions[collection.slug]?.read) : true).map((collection)=>collection.slug);
         if (!config.endpoints) config.endpoints = [];
         if (!config.admin) config.admin = {};
         config.admin.custom = {
             ...config.admin.custom || {},
             payloadAiPlugin: {
                 ...config.admin.custom?.payloadAiPlugin || {},
+                collectionSlugs: mentionCollectionSlugs,
+                allowUserApiKeys,
                 models: modelConfig
             }
         };
@@ -47,21 +56,23 @@ export const payloadAiPlugin = (pluginOptions)=>(config)=>{
         config.admin.components.beforeDashboard.push(`payload-ai-plugin/client#AIInput`);
         config.endpoints.push({
             handler: createAIChatEndpointHandler({
-                collections: enabledCollections
+                allowUserApiKeys,
+                collections: collectionPermissions,
+                models: modelConfig
             }),
             method: "post",
             path: "/ai-chat"
         });
         config.endpoints.push({
             handler: createAIApplyActionEndpointHandler({
-                collections: enabledCollections
+                collections: collectionPermissions
             }),
             method: "post",
             path: "/ai-apply-action"
         });
         config.endpoints.push({
             handler: createAIMentionSuggestionsEndpointHandler({
-                collections: enabledCollections
+                collections: collectionPermissions
             }),
             method: "post",
             path: "/ai-mention-suggestions"

package/dist/payload/collectionPermissions.d.ts

@@ -0,0 +1,22 @@
+import type { PayloadHandler } from "payload";
+export type AICollectionAction = "create" | "delete" | "read" | "update";
+export type AICollectionPermissions = Partial<Record<AICollectionAction, boolean>>;
+export type AICollectionPermissionConfig = true | AICollectionPermissions;
+export type AICollectionPermissionMap = Partial<Record<string, AICollectionPermissionConfig>>;
+export type ResolvedAICollectionPermissionMap = Partial<Record<string, Record<AICollectionAction, boolean>>>;
+export declare const resolveCollectionPermissions: (collections?: AICollectionPermissionMap) => ResolvedAICollectionPermissionMap | undefined;
+export declare const getCollectionSlugsForAction: ({ action, permissions, req, }: {
+    action: AICollectionAction;
+    permissions?: ResolvedAICollectionPermissionMap;
+    req: Parameters<PayloadHandler>[0];
+}) => string[];
+export declare const isCollectionActionAllowed: ({ action, permissions, req, slug, }: {
+    action: AICollectionAction;
+    permissions?: ResolvedAICollectionPermissionMap;
+    req: Parameters<PayloadHandler>[0];
+    slug: string;
+}) => boolean;
+export declare const getCollectionPermissions: ({ permissions, slug, }: {
+    permissions?: ResolvedAICollectionPermissionMap;
+    slug: string;
+}) => Record<AICollectionAction, boolean>;

package/dist/payload/collectionPermissions.js

@@ -0,0 +1,68 @@
+import { isInternalCollection } from "./shared.js";
+const allActions = [
+    "create",
+    "delete",
+    "read",
+    "update"
+];
+const getKnownCollectionSlugs = (req)=>{
+    return req.payload.config.collections.map((collection)=>collection.slug).filter((slug)=>!isInternalCollection(slug));
+};
+export const resolveCollectionPermissions = (collections)=>{
+    if (!collections) return undefined;
+    return Object.fromEntries(Object.entries(collections).map(([slug, config])=>{
+        if (config === true) {
+            return [
+                slug,
+                {
+                    create: true,
+                    delete: true,
+                    read: true,
+                    update: true
+                }
+            ];
+        }
+        if (!config) {
+            return [
+                slug,
+                {
+                    create: false,
+                    delete: false,
+                    read: false,
+                    update: false
+                }
+            ];
+        }
+        return [
+            slug,
+            {
+                create: Boolean(config.create),
+                delete: Boolean(config.delete),
+                read: Boolean(config.read),
+                update: Boolean(config.update)
+            }
+        ];
+    }));
+};
+export const getCollectionSlugsForAction = ({ action, permissions, req })=>{
+    const knownSlugs = getKnownCollectionSlugs(req);
+    if (!permissions) return knownSlugs;
+    return knownSlugs.filter((slug)=>Boolean(permissions[slug]?.[action]));
+};
+export const isCollectionActionAllowed = ({ action, permissions, req, slug })=>{
+    if (!getKnownCollectionSlugs(req).includes(slug)) return false;
+    if (!permissions) return true;
+    return Boolean(permissions[slug]?.[action]);
+};
+export const getCollectionPermissions = ({ permissions, slug })=>{
+    if (!permissions) {
+        return Object.fromEntries(allActions.map((action)=>[
+                action,
+                true
+            ]));
+    }
+    return permissions[slug] || Object.fromEntries(allActions.map((action)=>[
+            action,
+            false
+        ]));
+};

package/dist/payload/schemaContext.d.ts

@@ -1,4 +1,5 @@
 import type { PayloadHandler } from "payload";
+import { type ResolvedAICollectionPermissionMap } from "./collectionPermissions.js";
 export type AIChatMention = {
     collection?: string;
     id?: string;
@@ -43,7 +44,7 @@ export declare const collectBlocks: ({ fields, parent, }: {
     parent: string;
     slug: string;
 })[];
-export declare const getAllowedCollectionSlugs: (req: Parameters<PayloadHandler>[0], collections?: string[]) => string[];
+export declare const getAllowedCollectionSlugs: (req: Parameters<PayloadHandler>[0], collections?: ResolvedAICollectionPermissionMap) => string[];
 export declare const getMentionContext: ({ blockContexts, collectionSlugs, globalSlugs, mentions, req, }: MentionContext) => Promise<Record<string, unknown>[]>;
 export declare const buildPromptWithMentionContext: ({ mentionContext, prompt, }: {
     mentionContext: Record<string, unknown>[];

package/dist/payload/schemaContext.js

@@ -1,3 +1,4 @@
+import { getCollectionSlugsForAction } from "./collectionPermissions.js";
 import { getSerializableLabel, isInternalCollection } from "./shared.js";
 const getSerializableRelationTo = (relationTo)=>{
     if (typeof relationTo === "string") {
@@ -71,9 +72,11 @@ export const collectBlocks = ({ fields, parent })=>{
     return blocks;
 };
 export const getAllowedCollectionSlugs = (req, collections)=>{
-    const configuredSlugs = req.payload.config.collections.map((collection)=>collection.slug).filter((slug)=>!isInternalCollection(slug));
-    if (!collections) return configuredSlugs;
-    return configuredSlugs.filter((slug)=>collections.includes(slug));
+    return getCollectionSlugsForAction({
+        action: "read",
+        permissions: collections,
+        req
+    });
 };
 export const getMentionContext = async ({ blockContexts, collectionSlugs, globalSlugs, mentions, req })=>{
     if (!mentions || mentions.length === 0) return [];

package/package.json

@@ -1,126 +1,117 @@
 {
-  "name": "@mvriu5/payload-ai",
-  "version": "0.5.0",
-  "description": "AI assistant plugin for Payload CMS with provider selection, CMS mentions, and signed action proposals.",
-  "keywords": [
-    "payload",
-    "payloadcms",
-    "payload-plugin",
-    "ai",
-    "cms",
-    "openai",
-    "anthropic",
-    "google-generative-ai",
-    "groq",
-    "mistral"
-  ],
-  "author": "Marius",
-  "license": "MIT",
-  "homepage": "https://github.com/mvriu5/payload-ai-plugin#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/mvriu5/payload-ai-plugin.git"
-  },
-  "bugs": {
-    "url": "https://github.com/mvriu5/payload-ai-plugin/issues"
-  },
-  "type": "module",
-  "exports": {
-    ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    },
-    "./client": {
-      "import": "./dist/exports/client.js",
-      "types": "./dist/exports/client.d.ts",
-      "default": "./dist/exports/client.js"
-    }
-  },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "pnpm copyfiles && pnpm build:types && pnpm build:swc",
-    "build:swc": "swc ./src -d ./dist --config-file .swcrc --strip-leading-paths",
-    "build:types": "tsc --outDir dist --rootDir ./src",
-    "clean": "rimraf {dist,*.tsbuildinfo}",
-    "copyfiles": "copyfiles -u 1 \"src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png,json}\" dist/",
-    "dev": "next dev dev --turbo",
-    "dev:generate-importmap": "pnpm dev:payload generate:importmap",
-    "dev:generate-types": "pnpm dev:payload generate:types",
-    "dev:payload": "cross-env PAYLOAD_CONFIG_PATH=./dev/payload.config.ts payload",
-    "generate:importmap": "pnpm dev:generate-importmap",
-    "generate:types": "pnpm dev:generate-types",
-    "lint": "eslint",
-    "lint:fix": "eslint ./src --fix",
-    "prepublishOnly": "pnpm clean && pnpm build"
-  },
-  "devDependencies": {
-    "@payloadcms/db-postgres": "3.84.1",
-    "@payloadcms/next": "3.84.1",
-    "@payloadcms/richtext-lexical": "3.84.1",
-    "@payloadcms/ui": "3.84.1",
-    "@swc/cli": "0.6.0",
-    "@types/node": "22.19.9",
-    "@types/react": "19.2.14",
-    "@types/react-dom": "19.2.3",
-    "copyfiles": "2.4.1",
-    "cross-env": "^7.0.3",
-    "eslint": "^9.23.0",
-    "graphql": "^16.8.1",
-    "knip": "^6.16.1",
-    "next": "16.2.6",
-    "payload": "3.84.1",
-    "react": "19.2.6",
-    "react-dom": "19.2.6",
-    "rimraf": "3.0.2",
-    "sharp": "0.34.2",
-    "typescript": "5.7.3",
-    "vite-tsconfig-paths": "6.0.5",
-    "vitest": "4.0.18"
-  },
-  "peerDependencies": {
-    "payload": "^3.84.1"
-  },
-  "engines": {
-    "node": "^18.20.2 || >=20.9.0",
-    "pnpm": "^9 || ^10"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "sharp",
-      "esbuild",
-      "unrs-resolver"
-    ]
-  },
-  "registry": "https://registry.npmjs.org/",
-  "knip": {
-    "entry": [
-      "dev/payload.config.ts",
-      "dev/next.config.mjs",
-      "dev/app/**/*.{ts,tsx}"
+    "name": "@mvriu5/payload-ai",
+    "version": "0.5.8",
+    "description": "AI assistant plugin for Payload CMS with provider selection, CMS mentions, and signed action proposals.",
+    "keywords": [
+        "payload",
+        "payloadcms",
+        "payload-plugin",
+        "ai",
+        "cms",
+        "openai",
+        "anthropic",
+        "google-generative-ai",
+        "mistral"
     ],
-    "ignore": [
-      "dev/payload-types.ts"
+    "author": "Marius",
+    "license": "MIT",
+    "homepage": "https://github.com/mvriu5/payload-ai-plugin#readme",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/mvriu5/payload-ai-plugin.git"
+    },
+    "bugs": {
+        "url": "https://github.com/mvriu5/payload-ai-plugin/issues"
+    },
+    "type": "module",
+    "exports": {
+        ".": {
+            "import": "./dist/index.js",
+            "types": "./dist/index.d.ts",
+            "default": "./dist/index.js"
+        },
+        "./client": {
+            "import": "./dist/exports/client.js",
+            "types": "./dist/exports/client.d.ts",
+            "default": "./dist/exports/client.js"
+        }
+    },
+    "main": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "files": [
+        "dist"
     ],
-    "project": [
-      "src/**/*.{ts,tsx}",
-      "dev/**/*.{ts,tsx,mjs}"
-    ]
-  },
-  "dependencies": {
-    "@ai-sdk/anthropic": "^3.0.81",
-    "@ai-sdk/google": "^3.0.80",
-    "@ai-sdk/groq": "^3.0.39",
-    "@ai-sdk/mistral": "^3.0.37",
-    "@ai-sdk/openai": "^3.0.67",
-    "ai": "^6.0.193",
-    "zod": "^4.4.3"
-  }
+    "scripts": {
+        "build": "pnpm copyfiles && pnpm build:types && pnpm build:swc",
+        "build:swc": "swc ./src -d ./dist --config-file .swcrc --strip-leading-paths",
+        "build:types": "tsc --outDir dist --rootDir ./src",
+        "clean": "rimraf {dist,*.tsbuildinfo}",
+        "copyfiles": "copyfiles -u 1 \"src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png,json}\" dist/",
+        "dev": "next dev dev --turbo",
+        "dev:generate-importmap": "pnpm dev:payload generate:importmap",
+        "dev:generate-types": "pnpm dev:payload generate:types",
+        "dev:payload": "cross-env PAYLOAD_CONFIG_PATH=./dev/payload.config.ts payload",
+        "generate:importmap": "pnpm dev:generate-importmap",
+        "generate:types": "pnpm dev:generate-types",
+        "lint": "eslint",
+        "lint:fix": "eslint ./src --fix",
+        "prepublishOnly": "pnpm clean && pnpm build"
+    },
+    "devDependencies": {
+        "@payloadcms/db-postgres": "3.84.1",
+        "@payloadcms/next": "3.84.1",
+        "@payloadcms/richtext-lexical": "3.84.1",
+        "@payloadcms/ui": "3.84.1",
+        "@swc/cli": "0.8.1",
+        "@types/node": "25.9.3",
+        "@types/react": "19.2.17",
+        "@types/react-dom": "19.2.3",
+        "copyfiles": "2.4.1",
+        "cross-env": "^7.0.3",
+        "eslint": "^10.5.0",
+        "graphql": "^16.8.1",
+        "knip": "^6.16.1",
+        "next": "16.2.9",
+        "payload": "3.84.1",
+        "prettier": "^3.8.4",
+        "react": "19.2.7",
+        "react-dom": "19.2.6",
+        "rimraf": "6.1.3",
+        "sharp": "0.35.1",
+        "typescript": "5.9.3",
+        "vite-tsconfig-paths": "6.1.1",
+        "vitest": "4.1.9"
+    },
+    "peerDependencies": {
+        "payload": "^3.84.1"
+    },
+    "engines": {
+        "node": "^18.20.2 || >=20.9.0",
+        "pnpm": "^9 || ^10 || ^11"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "knip": {
+        "entry": [
+            "dev/payload.config.ts",
+            "dev/next.config.mjs",
+            "dev/app/**/*.{ts,tsx}"
+        ],
+        "ignore": [
+            "dev/payload-types.ts"
+        ],
+        "project": [
+            "src/**/*.{ts,tsx}",
+            "dev/**/*.{ts,tsx,mjs}"
+        ]
+    },
+    "dependencies": {
+        "@ai-sdk/anthropic": "^3.0.81",
+        "@ai-sdk/google": "^3.0.80",
+        "@ai-sdk/mistral": "^3.0.37",
+        "@ai-sdk/openai": "^3.0.67",
+        "ai": "^6.0.193",
+        "zod": "^4.4.3"
+    }
 }