@payloadcms/plugin-mcp 4.0.0-internal.203916b → 4.0.0-internal.21664f3

package/src/utils/schemaConversion/filterFieldsByAccess.ts

@@ -0,0 +1,123 @@
+import type {
+  FlattenedBlock,
+  FlattenedField,
+  Operation,
+  SanitizedDocumentPermissions,
+  SanitizedFieldsPermissions,
+} from 'payload'
+
+type FieldOperation = Exclude<Operation, 'delete'>
+type AllowedFieldOperations = Record<FieldOperation, boolean>
+
+/**
+ * Filters fields using the access results in `permissions`. `shouldExcludeField` receives the
+ * operations allowed by the entity, field, and its parents and decides whether to remove the
+ * field.
+ *
+ * Arrays, groups, named tabs, and blocks are filtered recursively. Rows and unnamed tabs are
+ * flattened by Payload, so their children are filtered at the containing level.
+ *
+ * @example Include fields writable through any collection operation the user can perform.
+ * ```ts
+ * filterFieldsByAccess({
+ *   fields,
+ *   permissions: collectionPermissions,
+ *   shouldExcludeField: ({ create, update }) => !create && !update,
+ * })
+ * ```
+ */
+export const filterFieldsByAccess = ({
+  blocks,
+  fields,
+  permissions,
+  shouldExcludeField,
+}: {
+  blocks?: FlattenedBlock[]
+  fields: FlattenedField[]
+  permissions: SanitizedDocumentPermissions
+  shouldExcludeField: (allowedOperations: AllowedFieldOperations) => boolean
+}): FlattenedField[] => {
+  const filterFields = (
+    nestedFields: FlattenedField[],
+    nestedPermissions: SanitizedFieldsPermissions | undefined,
+    parentAllowedOperations: AllowedFieldOperations,
+  ): FlattenedField[] => {
+    const accessibleFields: FlattenedField[] = []
+
+    for (const field of nestedFields) {
+      const fieldPermissions = nestedPermissions === true ? true : nestedPermissions?.[field.name]
+      const isOperationAllowed = (operation: FieldOperation): boolean =>
+        parentAllowedOperations[operation] &&
+        (fieldPermissions === true || fieldPermissions?.[operation] === true)
+      const allowedOperations: AllowedFieldOperations = {
+        create: isOperationAllowed('create'),
+        read: isOperationAllowed('read'),
+        update: isOperationAllowed('update'),
+      }
+
+      if (shouldExcludeField(allowedOperations)) {
+        continue
+      }
+
+      if (field.type === 'blocks') {
+        const accessibleBlocks: (FlattenedBlock | string)[] = []
+
+        for (const blockOrReference of field.blocks) {
+          const block =
+            typeof blockOrReference === 'string'
+              ? blocks?.find(({ slug }) => slug === blockOrReference)
+              : blockOrReference
+
+          if (!block) {
+            continue
+          }
+
+          const blockPermissions =
+            fieldPermissions === true
+              ? true
+              : fieldPermissions?.blocks === true
+                ? true
+                : fieldPermissions?.blocks?.[block.slug]
+
+          accessibleBlocks.push({
+            ...block,
+            flattenedFields: filterFields(
+              block.flattenedFields,
+              blockPermissions === true ? true : blockPermissions?.fields,
+              allowedOperations,
+            ),
+          })
+        }
+
+        if (accessibleBlocks.length === 0) {
+          continue
+        }
+
+        accessibleFields.push({ ...field, blocks: accessibleBlocks })
+        continue
+      }
+
+      if (field.type === 'array' || field.type === 'group' || field.type === 'tab') {
+        accessibleFields.push({
+          ...field,
+          flattenedFields: filterFields(
+            field.flattenedFields,
+            fieldPermissions === true ? true : fieldPermissions?.fields,
+            allowedOperations,
+          ),
+        })
+        continue
+      }
+
+      accessibleFields.push(field)
+    }
+
+    return accessibleFields
+  }
+
+  return filterFields(fields, permissions.fields, {
+    create: 'create' in permissions && permissions.create === true,
+    read: permissions.read === true,
+    update: permissions.update === true,
+  })
+}

package/src/utils/schemaConversion/getEntityInputSchema.ts

@@ -1,21 +1,27 @@
 import {
   type CollectionSlug,
   entityToStandaloneJSONSchema,
+  type FlattenedField,
   type GlobalSlug,
   type PayloadRequest,
   type SanitizedCollectionConfig,
+  type SanitizedCollectionPermission,
   type SanitizedGlobalConfig,
+  type SanitizedGlobalPermission,
 } from 'payload'
 
 import type { JsonSchemaType } from '../../types.js'
 
+import { filterFieldsByAccess } from './filterFieldsByAccess.js'
 import { sanitizeEntitySchema } from './sanitizeEntitySchema.js'
 
 export const getCollectionInputSchema = ({
   collectionSlug,
+  permissions,
   req,
 }: {
   collectionSlug: CollectionSlug
+  permissions?: SanitizedCollectionPermission
   req: PayloadRequest
 }): JsonSchemaType | null => {
   const collection = req.payload.collections[collectionSlug]?.config
@@ -24,14 +30,27 @@ export const getCollectionInputSchema = ({
     return null
   }
 
-  return buildEntityInputSchema({ entity: collection, req })
+  if (!permissions) {
+    return buildEntityInputSchema({ entity: collection, req })
+  }
+
+  const fieldsAllowedByAccess = filterFieldsByAccess({
+    blocks: req.payload.config.blocks,
+    fields: collection.flattenedFields,
+    permissions,
+    shouldExcludeField: ({ create, update }) => !create && !update,
+  })
+
+  return buildEntityInputSchema({ entity: collection, fields: fieldsAllowedByAccess, req })
 }
 
 export const getGlobalInputSchema = ({
   globalSlug,
+  permissions,
   req,
 }: {
   globalSlug: GlobalSlug
+  permissions?: SanitizedGlobalPermission
   req: PayloadRequest
 }): JsonSchemaType | null => {
   const global = req.payload.config.globals.find((globalConfig) => globalConfig.slug === globalSlug)
@@ -40,23 +59,38 @@ export const getGlobalInputSchema = ({
     return null
   }
 
-  return buildEntityInputSchema({ entity: global, req })
+  if (!permissions) {
+    return buildEntityInputSchema({ entity: global, req })
+  }
+
+  const fieldsAllowedByAccess = filterFieldsByAccess({
+    blocks: req.payload.config.blocks,
+    fields: global.flattenedFields,
+    permissions,
+    shouldExcludeField: ({ create, update }) => !create && !update,
+  })
+
+  return buildEntityInputSchema({ entity: global, fields: fieldsAllowedByAccess, req })
 }
 
 const buildEntityInputSchema = ({
   entity,
+  fields = entity.flattenedFields,
   req,
 }: {
   entity: SanitizedCollectionConfig | SanitizedGlobalConfig
+  fields?: FlattenedField[]
   req: PayloadRequest
-}): JsonSchemaType =>
-  // The `input` variant is already the write shape; sanitizeEntitySchema only adds MCP-specific passes.
-  sanitizeEntitySchema(
-    entityToStandaloneJSONSchema({
-      config: req.payload.config,
-      defaultIDType: req.payload.db.defaultIDType,
-      entity,
-      i18n: req.i18n,
-      variant: 'input',
-    }) as unknown as JsonSchemaType,
-  )
+}): JsonSchemaType => {
+  // The core schema generator reads flattenedFields from the entity and has no fields argument.
+  const entityForSchema = { ...entity, flattenedFields: fields }
+  const schema = entityToStandaloneJSONSchema({
+    config: req.payload.config,
+    defaultIDType: req.payload.db.defaultIDType,
+    entity: entityForSchema,
+    i18n: req.i18n,
+    variant: 'input',
+  }) as unknown as JsonSchemaType
+
+  return sanitizeEntitySchema(schema)
+}

package/src/utils/schemaConversion/sanitizeEntitySchema.spec.ts

@@ -76,8 +76,8 @@ describe('sanitizeEntitySchema', () => {
         },
       },
       properties: {
-        // Managed fields (createdAt/updatedAt/_status) are excluded upstream by the `input` variant;
-        // `id` stays because it's a valid optional input (a client may supply a custom ID).
+        // Managed timestamps are excluded upstream by the `input` variant. `id` stays because it's
+        // a valid optional input (a client may supply a custom ID).
         id: { type: 'string' },
         content: {
           type: 'object',

package/dist/utils/localAPIDefaults.d.ts

@@ -1,20 +0,0 @@
-import type { AuthorizedMCP } from '../types.js';
-/**
- * Returns the `user` and `overrideAccess` arguments every Payload local API call
- * should receive when initiated from an MCP request. Spread the result into the
- * call's arg object so the two pieces of caller state can't drift apart.
- *
- * @example
- * ```ts
- * await req.payload.create({
- *   collection: 'posts',
- *   data,
- *   ...localAPIDefaults(authorizedMCP),
- * })
- * ```
- */
-export declare const localAPIDefaults: (authorizedMCP: AuthorizedMCP) => {
-    overrideAccess: boolean;
-    user: AuthorizedMCP["user"];
-};
-//# sourceMappingURL=localAPIDefaults.d.ts.map

package/dist/utils/localAPIDefaults.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"localAPIDefaults.d.ts","sourceRoot":"","sources":["../../src/utils/localAPIDefaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,GAC3B,eAAe,aAAa,KAC3B;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAGvD,CAAA"}

package/dist/utils/localAPIDefaults.js

@@ -1,19 +0,0 @@
-/**
- * Returns the `user` and `overrideAccess` arguments every Payload local API call
- * should receive when initiated from an MCP request. Spread the result into the
- * call's arg object so the two pieces of caller state can't drift apart.
- *
- * @example
- * ```ts
- * await req.payload.create({
- *   collection: 'posts',
- *   data,
- *   ...localAPIDefaults(authorizedMCP),
- * })
- * ```
- */ export const localAPIDefaults = (authorizedMCP)=>({
-        overrideAccess: authorizedMCP.overrideAccess,
-        user: authorizedMCP.user
-    });
-
-//# sourceMappingURL=localAPIDefaults.js.map

package/dist/utils/localAPIDefaults.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/utils/localAPIDefaults.ts"],"sourcesContent":["import type { AuthorizedMCP } from '../types.js'\n\n/**\n * Returns the `user` and `overrideAccess` arguments every Payload local API call\n * should receive when initiated from an MCP request. Spread the result into the\n * call's arg object so the two pieces of caller state can't drift apart.\n *\n * @example\n * ```ts\n * await req.payload.create({\n *   collection: 'posts',\n *   data,\n *   ...localAPIDefaults(authorizedMCP),\n * })\n * ```\n */\nexport const localAPIDefaults = (\n  authorizedMCP: AuthorizedMCP,\n): { overrideAccess: boolean; user: AuthorizedMCP['user'] } => ({\n  overrideAccess: authorizedMCP.overrideAccess,\n  user: authorizedMCP.user,\n})\n"],"names":["localAPIDefaults","authorizedMCP","overrideAccess","user"],"mappings":"AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,mBAAmB,CAC9BC,gBAC8D,CAAA;QAC9DC,gBAAgBD,cAAcC,cAAc;QAC5CC,MAAMF,cAAcE,IAAI;IAC1B,CAAA,EAAE"}

package/src/utils/localAPIDefaults.ts

@@ -1,22 +0,0 @@
-import type { AuthorizedMCP } from '../types.js'
-
-/**
- * Returns the `user` and `overrideAccess` arguments every Payload local API call
- * should receive when initiated from an MCP request. Spread the result into the
- * call's arg object so the two pieces of caller state can't drift apart.
- *
- * @example
- * ```ts
- * await req.payload.create({
- *   collection: 'posts',
- *   data,
- *   ...localAPIDefaults(authorizedMCP),
- * })
- * ```
- */
-export const localAPIDefaults = (
-  authorizedMCP: AuthorizedMCP,
-): { overrideAccess: boolean; user: AuthorizedMCP['user'] } => ({
-  overrideAccess: authorizedMCP.overrideAccess,
-  user: authorizedMCP.user,
-})