@payloadcms/plugin-mcp 4.0.0-internal.811e0a4 → 4.0.0-internal.8867dba

package/src/utils/schemaConversion/getEntityInputSchema.ts

@@ -1,21 +1,27 @@
 import {
   type CollectionSlug,
   entityToStandaloneJSONSchema,
+  type FlattenedField,
   type GlobalSlug,
   type PayloadRequest,
   type SanitizedCollectionConfig,
+  type SanitizedCollectionPermission,
   type SanitizedGlobalConfig,
+  type SanitizedGlobalPermission,
 } from 'payload'
 
 import type { JsonSchemaType } from '../../types.js'
 
+import { filterFieldsByAccess } from './filterFieldsByAccess.js'
 import { sanitizeEntitySchema } from './sanitizeEntitySchema.js'
 
 export const getCollectionInputSchema = ({
   collectionSlug,
+  permissions,
   req,
 }: {
   collectionSlug: CollectionSlug
+  permissions?: SanitizedCollectionPermission
   req: PayloadRequest
 }): JsonSchemaType | null => {
   const collection = req.payload.collections[collectionSlug]?.config
@@ -24,14 +30,27 @@ export const getCollectionInputSchema = ({
     return null
   }
 
-  return buildEntityInputSchema({ entity: collection, req })
+  if (!permissions) {
+    return buildEntityInputSchema({ entity: collection, req })
+  }
+
+  const fieldsAllowedByAccess = filterFieldsByAccess({
+    blocks: req.payload.config.blocks,
+    fields: collection.flattenedFields,
+    permissions,
+    shouldExcludeField: ({ create, update }) => !create && !update,
+  })
+
+  return buildEntityInputSchema({ entity: collection, fields: fieldsAllowedByAccess, req })
 }
 
 export const getGlobalInputSchema = ({
   globalSlug,
+  permissions,
   req,
 }: {
   globalSlug: GlobalSlug
+  permissions?: SanitizedGlobalPermission
   req: PayloadRequest
 }): JsonSchemaType | null => {
   const global = req.payload.config.globals.find((globalConfig) => globalConfig.slug === globalSlug)
@@ -40,23 +59,38 @@ export const getGlobalInputSchema = ({
     return null
   }
 
-  return buildEntityInputSchema({ entity: global, req })
+  if (!permissions) {
+    return buildEntityInputSchema({ entity: global, req })
+  }
+
+  const fieldsAllowedByAccess = filterFieldsByAccess({
+    blocks: req.payload.config.blocks,
+    fields: global.flattenedFields,
+    permissions,
+    shouldExcludeField: ({ create, update }) => !create && !update,
+  })
+
+  return buildEntityInputSchema({ entity: global, fields: fieldsAllowedByAccess, req })
 }
 
 const buildEntityInputSchema = ({
   entity,
+  fields = entity.flattenedFields,
   req,
 }: {
   entity: SanitizedCollectionConfig | SanitizedGlobalConfig
+  fields?: FlattenedField[]
   req: PayloadRequest
-}): JsonSchemaType =>
-  // The `input` variant is already the write shape; sanitizeEntitySchema only adds MCP-specific passes.
-  sanitizeEntitySchema(
-    entityToStandaloneJSONSchema({
-      config: req.payload.config,
-      defaultIDType: req.payload.db.defaultIDType,
-      entity,
-      i18n: req.i18n,
-      variant: 'input',
-    }) as unknown as JsonSchemaType,
-  )
+}): JsonSchemaType => {
+  // The core schema generator reads flattenedFields from the entity and has no fields argument.
+  const entityForSchema = { ...entity, flattenedFields: fields }
+  const schema = entityToStandaloneJSONSchema({
+    config: req.payload.config,
+    defaultIDType: req.payload.db.defaultIDType,
+    entity: entityForSchema,
+    i18n: req.i18n,
+    variant: 'input',
+  }) as unknown as JsonSchemaType
+
+  return sanitizeEntitySchema(schema)
+}

package/src/utils/schemaConversion/sanitizeEntitySchema.spec.ts

@@ -76,8 +76,8 @@ describe('sanitizeEntitySchema', () => {
         },
       },
       properties: {
-        // Managed fields (createdAt/updatedAt/_status) are excluded upstream by the `input` variant;
-        // `id` stays because it's a valid optional input (a client may supply a custom ID).
+        // Managed timestamps are excluded upstream by the `input` variant. `id` stays because it's
+        // a valid optional input (a client may supply a custom ID).
         id: { type: 'string' },
         content: {
           type: 'object',

package/dist/utils/localAPIDefaults.d.ts

@@ -1,20 +0,0 @@
-import type { AuthorizedMCP } from '../types.js';
-/**
- * Returns the `user` and `overrideAccess` arguments every Payload local API call
- * should receive when initiated from an MCP request. Spread the result into the
- * call's arg object so the two pieces of caller state can't drift apart.
- *
- * @example
- * ```ts
- * await req.payload.create({
- *   collection: 'posts',
- *   data,
- *   ...localAPIDefaults(authorizedMCP),
- * })
- * ```
- */
-export declare const localAPIDefaults: (authorizedMCP: AuthorizedMCP) => {
-    overrideAccess: boolean;
-    user: AuthorizedMCP["user"];
-};
-//# sourceMappingURL=localAPIDefaults.d.ts.map

package/dist/utils/localAPIDefaults.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"localAPIDefaults.d.ts","sourceRoot":"","sources":["../../src/utils/localAPIDefaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,GAC3B,eAAe,aAAa,KAC3B;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAGvD,CAAA"}

package/dist/utils/localAPIDefaults.js

@@ -1,19 +0,0 @@
-/**
- * Returns the `user` and `overrideAccess` arguments every Payload local API call
- * should receive when initiated from an MCP request. Spread the result into the
- * call's arg object so the two pieces of caller state can't drift apart.
- *
- * @example
- * ```ts
- * await req.payload.create({
- *   collection: 'posts',
- *   data,
- *   ...localAPIDefaults(authorizedMCP),
- * })
- * ```
- */ export const localAPIDefaults = (authorizedMCP)=>({
-        overrideAccess: authorizedMCP.overrideAccess,
-        user: authorizedMCP.user
-    });
-
-//# sourceMappingURL=localAPIDefaults.js.map

package/dist/utils/localAPIDefaults.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/utils/localAPIDefaults.ts"],"sourcesContent":["import type { AuthorizedMCP } from '../types.js'\n\n/**\n * Returns the `user` and `overrideAccess` arguments every Payload local API call\n * should receive when initiated from an MCP request. Spread the result into the\n * call's arg object so the two pieces of caller state can't drift apart.\n *\n * @example\n * ```ts\n * await req.payload.create({\n *   collection: 'posts',\n *   data,\n *   ...localAPIDefaults(authorizedMCP),\n * })\n * ```\n */\nexport const localAPIDefaults = (\n  authorizedMCP: AuthorizedMCP,\n): { overrideAccess: boolean; user: AuthorizedMCP['user'] } => ({\n  overrideAccess: authorizedMCP.overrideAccess,\n  user: authorizedMCP.user,\n})\n"],"names":["localAPIDefaults","authorizedMCP","overrideAccess","user"],"mappings":"AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,mBAAmB,CAC9BC,gBAC8D,CAAA;QAC9DC,gBAAgBD,cAAcC,cAAc;QAC5CC,MAAMF,cAAcE,IAAI;IAC1B,CAAA,EAAE"}

package/src/utils/localAPIDefaults.ts

@@ -1,22 +0,0 @@
-import type { AuthorizedMCP } from '../types.js'
-
-/**
- * Returns the `user` and `overrideAccess` arguments every Payload local API call
- * should receive when initiated from an MCP request. Spread the result into the
- * call's arg object so the two pieces of caller state can't drift apart.
- *
- * @example
- * ```ts
- * await req.payload.create({
- *   collection: 'posts',
- *   data,
- *   ...localAPIDefaults(authorizedMCP),
- * })
- * ```
- */
-export const localAPIDefaults = (
-  authorizedMCP: AuthorizedMCP,
-): { overrideAccess: boolean; user: AuthorizedMCP['user'] } => ({
-  overrideAccess: authorizedMCP.overrideAccess,
-  user: authorizedMCP.user,
-})