@payloadcms/plugin-mcp 4.0.0-internal.811e0a4 → 4.0.0-internal.8ba6b5b

package/dist/utils/schemaConversion/filterFieldsByAccess.js

@@ -0,0 +1,71 @@
+/**
+ * Filters fields using the access results in `permissions`. `shouldExcludeField` receives the
+ * operations allowed by the entity, field, and its parents and decides whether to remove the
+ * field.
+ *
+ * Arrays, groups, named tabs, and blocks are filtered recursively. Rows and unnamed tabs are
+ * flattened by Payload, so their children are filtered at the containing level.
+ *
+ * @example Include fields writable through any collection operation the user can perform.
+ * ```ts
+ * filterFieldsByAccess({
+ *   fields,
+ *   permissions: collectionPermissions,
+ *   shouldExcludeField: ({ create, update }) => !create && !update,
+ * })
+ * ```
+ */ export const filterFieldsByAccess = ({ blocks, fields, permissions, shouldExcludeField })=>{
+    const filterFields = (nestedFields, nestedPermissions, parentAllowedOperations)=>{
+        const accessibleFields = [];
+        for (const field of nestedFields){
+            const fieldPermissions = nestedPermissions === true ? true : nestedPermissions?.[field.name];
+            const isOperationAllowed = (operation)=>parentAllowedOperations[operation] && (fieldPermissions === true || fieldPermissions?.[operation] === true);
+            const allowedOperations = {
+                create: isOperationAllowed('create'),
+                read: isOperationAllowed('read'),
+                update: isOperationAllowed('update')
+            };
+            if (shouldExcludeField(allowedOperations)) {
+                continue;
+            }
+            if (field.type === 'blocks') {
+                const accessibleBlocks = [];
+                for (const blockOrReference of field.blocks){
+                    const block = typeof blockOrReference === 'string' ? blocks?.find(({ slug })=>slug === blockOrReference) : blockOrReference;
+                    if (!block) {
+                        continue;
+                    }
+                    const blockPermissions = fieldPermissions === true ? true : fieldPermissions?.blocks === true ? true : fieldPermissions?.blocks?.[block.slug];
+                    accessibleBlocks.push({
+                        ...block,
+                        flattenedFields: filterFields(block.flattenedFields, blockPermissions === true ? true : blockPermissions?.fields, allowedOperations)
+                    });
+                }
+                if (accessibleBlocks.length === 0) {
+                    continue;
+                }
+                accessibleFields.push({
+                    ...field,
+                    blocks: accessibleBlocks
+                });
+                continue;
+            }
+            if (field.type === 'array' || field.type === 'group' || field.type === 'tab') {
+                accessibleFields.push({
+                    ...field,
+                    flattenedFields: filterFields(field.flattenedFields, fieldPermissions === true ? true : fieldPermissions?.fields, allowedOperations)
+                });
+                continue;
+            }
+            accessibleFields.push(field);
+        }
+        return accessibleFields;
+    };
+    return filterFields(fields, permissions.fields, {
+        create: 'create' in permissions && permissions.create === true,
+        read: permissions.read === true,
+        update: permissions.update === true
+    });
+};
+
+//# sourceMappingURL=filterFieldsByAccess.js.map

package/dist/utils/schemaConversion/filterFieldsByAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/schemaConversion/filterFieldsByAccess.ts"],"sourcesContent":["import type {\n  FlattenedBlock,\n  FlattenedField,\n  Operation,\n  SanitizedDocumentPermissions,\n  SanitizedFieldsPermissions,\n} from 'payload'\n\ntype FieldOperation = Exclude<Operation, 'delete'>\ntype AllowedFieldOperations = Record<FieldOperation, boolean>\n\n/**\n * Filters fields using the access results in `permissions`. `shouldExcludeField` receives the\n * operations allowed by the entity, field, and its parents and decides whether to remove the\n * field.\n *\n * Arrays, groups, named tabs, and blocks are filtered recursively. Rows and unnamed tabs are\n * flattened by Payload, so their children are filtered at the containing level.\n *\n * @example Include fields writable through any collection operation the user can perform.\n * ```ts\n * filterFieldsByAccess({\n *   fields,\n *   permissions: collectionPermissions,\n *   shouldExcludeField: ({ create, update }) => !create && !update,\n * })\n * ```\n */\nexport const filterFieldsByAccess = ({\n  blocks,\n  fields,\n  permissions,\n  shouldExcludeField,\n}: {\n  blocks?: FlattenedBlock[]\n  fields: FlattenedField[]\n  permissions: SanitizedDocumentPermissions\n  shouldExcludeField: (allowedOperations: AllowedFieldOperations) => boolean\n}): FlattenedField[] => {\n  const filterFields = (\n    nestedFields: FlattenedField[],\n    nestedPermissions: SanitizedFieldsPermissions | undefined,\n    parentAllowedOperations: AllowedFieldOperations,\n  ): FlattenedField[] => {\n    const accessibleFields: FlattenedField[] = []\n\n    for (const field of nestedFields) {\n      const fieldPermissions = nestedPermissions === true ? true : nestedPermissions?.[field.name]\n      const isOperationAllowed = (operation: FieldOperation): boolean =>\n        parentAllowedOperations[operation] &&\n        (fieldPermissions === true || fieldPermissions?.[operation] === true)\n      const allowedOperations: AllowedFieldOperations = {\n        create: isOperationAllowed('create'),\n        read: isOperationAllowed('read'),\n        update: isOperationAllowed('update'),\n      }\n\n      if (shouldExcludeField(allowedOperations)) {\n        continue\n      }\n\n      if (field.type === 'blocks') {\n        const accessibleBlocks: (FlattenedBlock | string)[] = []\n\n        for (const blockOrReference of field.blocks) {\n          const block =\n            typeof blockOrReference === 'string'\n              ? blocks?.find(({ slug }) => slug === blockOrReference)\n              : blockOrReference\n\n          if (!block) {\n            continue\n          }\n\n          const blockPermissions =\n            fieldPermissions === true\n              ? true\n              : fieldPermissions?.blocks === true\n                ? true\n                : fieldPermissions?.blocks?.[block.slug]\n\n          accessibleBlocks.push({\n            ...block,\n            flattenedFields: filterFields(\n              block.flattenedFields,\n              blockPermissions === true ? true : blockPermissions?.fields,\n              allowedOperations,\n            ),\n          })\n        }\n\n        if (accessibleBlocks.length === 0) {\n          continue\n        }\n\n        accessibleFields.push({ ...field, blocks: accessibleBlocks })\n        continue\n      }\n\n      if (field.type === 'array' || field.type === 'group' || field.type === 'tab') {\n        accessibleFields.push({\n          ...field,\n          flattenedFields: filterFields(\n            field.flattenedFields,\n            fieldPermissions === true ? true : fieldPermissions?.fields,\n            allowedOperations,\n          ),\n        })\n        continue\n      }\n\n      accessibleFields.push(field)\n    }\n\n    return accessibleFields\n  }\n\n  return filterFields(fields, permissions.fields, {\n    create: 'create' in permissions && permissions.create === true,\n    read: permissions.read === true,\n    update: permissions.update === true,\n  })\n}\n"],"names":["filterFieldsByAccess","blocks","fields","permissions","shouldExcludeField","filterFields","nestedFields","nestedPermissions","parentAllowedOperations","accessibleFields","field","fieldPermissions","name","isOperationAllowed","operation","allowedOperations","create","read","update","type","accessibleBlocks","blockOrReference","block","find","slug","blockPermissions","push","flattenedFields","length"],"mappings":"AAWA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMA,uBAAuB,CAAC,EACnCC,MAAM,EACNC,MAAM,EACNC,WAAW,EACXC,kBAAkB,EAMnB;IACC,MAAMC,eAAe,CACnBC,cACAC,mBACAC;QAEA,MAAMC,mBAAqC,EAAE;QAE7C,KAAK,MAAMC,SAASJ,aAAc;YAChC,MAAMK,mBAAmBJ,sBAAsB,OAAO,OAAOA,mBAAmB,CAACG,MAAME,IAAI,CAAC;YAC5F,MAAMC,qBAAqB,CAACC,YAC1BN,uBAAuB,CAACM,UAAU,IACjCH,CAAAA,qBAAqB,QAAQA,kBAAkB,CAACG,UAAU,KAAK,IAAG;YACrE,MAAMC,oBAA4C;gBAChDC,QAAQH,mBAAmB;gBAC3BI,MAAMJ,mBAAmB;gBACzBK,QAAQL,mBAAmB;YAC7B;YAEA,IAAIT,mBAAmBW,oBAAoB;gBACzC;YACF;YAEA,IAAIL,MAAMS,IAAI,KAAK,UAAU;gBAC3B,MAAMC,mBAAgD,EAAE;gBAExD,KAAK,MAAMC,oBAAoBX,MAAMT,MAAM,CAAE;oBAC3C,MAAMqB,QACJ,OAAOD,qBAAqB,WACxBpB,QAAQsB,KAAK,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASH,oBACpCA;oBAEN,IAAI,CAACC,OAAO;wBACV;oBACF;oBAEA,MAAMG,mBACJd,qBAAqB,OACjB,OACAA,kBAAkBV,WAAW,OAC3B,OACAU,kBAAkBV,QAAQ,CAACqB,MAAME,IAAI,CAAC;oBAE9CJ,iBAAiBM,IAAI,CAAC;wBACpB,GAAGJ,KAAK;wBACRK,iBAAiBtB,aACfiB,MAAMK,eAAe,EACrBF,qBAAqB,OAAO,OAAOA,kBAAkBvB,QACrDa;oBAEJ;gBACF;gBAEA,IAAIK,iBAAiBQ,MAAM,KAAK,GAAG;oBACjC;gBACF;gBAEAnB,iBAAiBiB,IAAI,CAAC;oBAAE,GAAGhB,KAAK;oBAAET,QAAQmB;gBAAiB;gBAC3D;YACF;YAEA,IAAIV,MAAMS,IAAI,KAAK,WAAWT,MAAMS,IAAI,KAAK,WAAWT,MAAMS,IAAI,KAAK,OAAO;gBAC5EV,iBAAiBiB,IAAI,CAAC;oBACpB,GAAGhB,KAAK;oBACRiB,iBAAiBtB,aACfK,MAAMiB,eAAe,EACrBhB,qBAAqB,OAAO,OAAOA,kBAAkBT,QACrDa;gBAEJ;gBACA;YACF;YAEAN,iBAAiBiB,IAAI,CAAChB;QACxB;QAEA,OAAOD;IACT;IAEA,OAAOJ,aAAaH,QAAQC,YAAYD,MAAM,EAAE;QAC9Cc,QAAQ,YAAYb,eAAeA,YAAYa,MAAM,KAAK;QAC1DC,MAAMd,YAAYc,IAAI,KAAK;QAC3BC,QAAQf,YAAYe,MAAM,KAAK;IACjC;AACF,EAAC"}

package/dist/utils/schemaConversion/getEntityInputSchema.d.ts

@@ -1,11 +1,13 @@
-import { type CollectionSlug, type GlobalSlug, type PayloadRequest } from 'payload';
+import { type CollectionSlug, type GlobalSlug, type PayloadRequest, type SanitizedCollectionPermission, type SanitizedGlobalPermission } from 'payload';
 import type { JsonSchemaType } from '../../types.js';
-export declare const getCollectionInputSchema: ({ collectionSlug, req, }: {
+export declare const getCollectionInputSchema: ({ collectionSlug, permissions, req, }: {
     collectionSlug: CollectionSlug;
+    permissions?: SanitizedCollectionPermission;
     req: PayloadRequest;
 }) => JsonSchemaType | null;
-export declare const getGlobalInputSchema: ({ globalSlug, req, }: {
+export declare const getGlobalInputSchema: ({ globalSlug, permissions, req, }: {
     globalSlug: GlobalSlug;
+    permissions?: SanitizedGlobalPermission;
     req: PayloadRequest;
 }) => JsonSchemaType | null;
 //# sourceMappingURL=getEntityInputSchema.d.ts.map

package/dist/utils/schemaConversion/getEntityInputSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getEntityInputSchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAEnB,KAAK,UAAU,EACf,KAAK,cAAc,EAGpB,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAIpD,eAAO,MAAM,wBAAwB,GAAI,0BAGtC;IACD,cAAc,EAAE,cAAc,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAQpB,CAAA;AAED,eAAO,MAAM,oBAAoB,GAAI,sBAGlC;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAQpB,CAAA"}
+{"version":3,"file":"getEntityInputSchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAGnB,KAAK,UAAU,EACf,KAAK,cAAc,EAEnB,KAAK,6BAA6B,EAElC,KAAK,yBAAyB,EAC/B,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAKpD,eAAO,MAAM,wBAAwB,GAAI,uCAItC;IACD,cAAc,EAAE,cAAc,CAAA;IAC9B,WAAW,CAAC,EAAE,6BAA6B,CAAA;IAC3C,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA;AAED,eAAO,MAAM,oBAAoB,GAAI,mCAIlC;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,CAAC,EAAE,yBAAyB,CAAA;IACvC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA"}

package/dist/utils/schemaConversion/getEntityInputSchema.js

@@ -1,32 +1,66 @@
 import { entityToStandaloneJSONSchema } from 'payload';
+import { filterFieldsByAccess } from './filterFieldsByAccess.js';
 import { sanitizeEntitySchema } from './sanitizeEntitySchema.js';
-export const getCollectionInputSchema = ({ collectionSlug, req })=>{
+export const getCollectionInputSchema = ({ collectionSlug, permissions, req })=>{
     const collection = req.payload.collections[collectionSlug]?.config;
     if (!collection) {
         return null;
     }
+    if (!permissions) {
+        return buildEntityInputSchema({
+            entity: collection,
+            req
+        });
+    }
+    const fieldsAllowedByAccess = filterFieldsByAccess({
+        blocks: req.payload.config.blocks,
+        fields: collection.flattenedFields,
+        permissions,
+        shouldExcludeField: ({ create, update })=>!create && !update
+    });
     return buildEntityInputSchema({
         entity: collection,
+        fields: fieldsAllowedByAccess,
         req
     });
 };
-export const getGlobalInputSchema = ({ globalSlug, req })=>{
+export const getGlobalInputSchema = ({ globalSlug, permissions, req })=>{
     const global = req.payload.config.globals.find((globalConfig)=>globalConfig.slug === globalSlug);
     if (!global) {
         return null;
     }
+    if (!permissions) {
+        return buildEntityInputSchema({
+            entity: global,
+            req
+        });
+    }
+    const fieldsAllowedByAccess = filterFieldsByAccess({
+        blocks: req.payload.config.blocks,
+        fields: global.flattenedFields,
+        permissions,
+        shouldExcludeField: ({ create, update })=>!create && !update
+    });
     return buildEntityInputSchema({
         entity: global,
+        fields: fieldsAllowedByAccess,
         req
     });
 };
-const buildEntityInputSchema = ({ entity, req })=>// The `input` variant is already the write shape; sanitizeEntitySchema only adds MCP-specific passes.
-    sanitizeEntitySchema(entityToStandaloneJSONSchema({
+const buildEntityInputSchema = ({ entity, fields = entity.flattenedFields, req })=>{
+    // The core schema generator reads flattenedFields from the entity and has no fields argument.
+    const entityForSchema = {
+        ...entity,
+        flattenedFields: fields
+    };
+    const schema = entityToStandaloneJSONSchema({
         config: req.payload.config,
         defaultIDType: req.payload.db.defaultIDType,
-        entity,
+        entity: entityForSchema,
         i18n: req.i18n,
         variant: 'input'
-    }));
+    });
+    return sanitizeEntitySchema(schema);
+};
 
 //# sourceMappingURL=getEntityInputSchema.js.map

package/dist/utils/schemaConversion/getEntityInputSchema.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"sourcesContent":["import {\n  type CollectionSlug,\n  entityToStandaloneJSONSchema,\n  type GlobalSlug,\n  type PayloadRequest,\n  type SanitizedCollectionConfig,\n  type SanitizedGlobalConfig,\n} from 'payload'\n\nimport type { JsonSchemaType } from '../../types.js'\n\nimport { sanitizeEntitySchema } from './sanitizeEntitySchema.js'\n\nexport const getCollectionInputSchema = ({\n  collectionSlug,\n  req,\n}: {\n  collectionSlug: CollectionSlug\n  req: PayloadRequest\n}): JsonSchemaType | null => {\n  const collection = req.payload.collections[collectionSlug]?.config\n\n  if (!collection) {\n    return null\n  }\n\n  return buildEntityInputSchema({ entity: collection, req })\n}\n\nexport const getGlobalInputSchema = ({\n  globalSlug,\n  req,\n}: {\n  globalSlug: GlobalSlug\n  req: PayloadRequest\n}): JsonSchemaType | null => {\n  const global = req.payload.config.globals.find((globalConfig) => globalConfig.slug === globalSlug)\n\n  if (!global) {\n    return null\n  }\n\n  return buildEntityInputSchema({ entity: global, req })\n}\n\nconst buildEntityInputSchema = ({\n  entity,\n  req,\n}: {\n  entity: SanitizedCollectionConfig | SanitizedGlobalConfig\n  req: PayloadRequest\n}): JsonSchemaType =>\n  // The `input` variant is already the write shape; sanitizeEntitySchema only adds MCP-specific passes.\n  sanitizeEntitySchema(\n    entityToStandaloneJSONSchema({\n      config: req.payload.config,\n      defaultIDType: req.payload.db.defaultIDType,\n      entity,\n      i18n: req.i18n,\n      variant: 'input',\n    }) as unknown as JsonSchemaType,\n  )\n"],"names":["entityToStandaloneJSONSchema","sanitizeEntitySchema","getCollectionInputSchema","collectionSlug","req","collection","payload","collections","config","buildEntityInputSchema","entity","getGlobalInputSchema","globalSlug","global","globals","find","globalConfig","slug","defaultIDType","db","i18n","variant"],"mappings":"AAAA,SAEEA,4BAA4B,QAKvB,UAAS;AAIhB,SAASC,oBAAoB,QAAQ,4BAA2B;AAEhE,OAAO,MAAMC,2BAA2B,CAAC,EACvCC,cAAc,EACdC,GAAG,EAIJ;IACC,MAAMC,aAAaD,IAAIE,OAAO,CAACC,WAAW,CAACJ,eAAe,EAAEK;IAE5D,IAAI,CAACH,YAAY;QACf,OAAO;IACT;IAEA,OAAOI,uBAAuB;QAAEC,QAAQL;QAAYD;IAAI;AAC1D,EAAC;AAED,OAAO,MAAMO,uBAAuB,CAAC,EACnCC,UAAU,EACVR,GAAG,EAIJ;IACC,MAAMS,SAAST,IAAIE,OAAO,CAACE,MAAM,CAACM,OAAO,CAACC,IAAI,CAAC,CAACC,eAAiBA,aAAaC,IAAI,KAAKL;IAEvF,IAAI,CAACC,QAAQ;QACX,OAAO;IACT;IAEA,OAAOJ,uBAAuB;QAAEC,QAAQG;QAAQT;IAAI;AACtD,EAAC;AAED,MAAMK,yBAAyB,CAAC,EAC9BC,MAAM,EACNN,GAAG,EAIJ,GACC,sGAAsG;IACtGH,qBACED,6BAA6B;QAC3BQ,QAAQJ,IAAIE,OAAO,CAACE,MAAM;QAC1BU,eAAed,IAAIE,OAAO,CAACa,EAAE,CAACD,aAAa;QAC3CR;QACAU,MAAMhB,IAAIgB,IAAI;QACdC,SAAS;IACX"}
+{"version":3,"sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"sourcesContent":["import {\n  type CollectionSlug,\n  entityToStandaloneJSONSchema,\n  type FlattenedField,\n  type GlobalSlug,\n  type PayloadRequest,\n  type SanitizedCollectionConfig,\n  type SanitizedCollectionPermission,\n  type SanitizedGlobalConfig,\n  type SanitizedGlobalPermission,\n} from 'payload'\n\nimport type { JsonSchemaType } from '../../types.js'\n\nimport { filterFieldsByAccess } from './filterFieldsByAccess.js'\nimport { sanitizeEntitySchema } from './sanitizeEntitySchema.js'\n\nexport const getCollectionInputSchema = ({\n  collectionSlug,\n  permissions,\n  req,\n}: {\n  collectionSlug: CollectionSlug\n  permissions?: SanitizedCollectionPermission\n  req: PayloadRequest\n}): JsonSchemaType | null => {\n  const collection = req.payload.collections[collectionSlug]?.config\n\n  if (!collection) {\n    return null\n  }\n\n  if (!permissions) {\n    return buildEntityInputSchema({ entity: collection, req })\n  }\n\n  const fieldsAllowedByAccess = filterFieldsByAccess({\n    blocks: req.payload.config.blocks,\n    fields: collection.flattenedFields,\n    permissions,\n    shouldExcludeField: ({ create, update }) => !create && !update,\n  })\n\n  return buildEntityInputSchema({ entity: collection, fields: fieldsAllowedByAccess, req })\n}\n\nexport const getGlobalInputSchema = ({\n  globalSlug,\n  permissions,\n  req,\n}: {\n  globalSlug: GlobalSlug\n  permissions?: SanitizedGlobalPermission\n  req: PayloadRequest\n}): JsonSchemaType | null => {\n  const global = req.payload.config.globals.find((globalConfig) => globalConfig.slug === globalSlug)\n\n  if (!global) {\n    return null\n  }\n\n  if (!permissions) {\n    return buildEntityInputSchema({ entity: global, req })\n  }\n\n  const fieldsAllowedByAccess = filterFieldsByAccess({\n    blocks: req.payload.config.blocks,\n    fields: global.flattenedFields,\n    permissions,\n    shouldExcludeField: ({ create, update }) => !create && !update,\n  })\n\n  return buildEntityInputSchema({ entity: global, fields: fieldsAllowedByAccess, req })\n}\n\nconst buildEntityInputSchema = ({\n  entity,\n  fields = entity.flattenedFields,\n  req,\n}: {\n  entity: SanitizedCollectionConfig | SanitizedGlobalConfig\n  fields?: FlattenedField[]\n  req: PayloadRequest\n}): JsonSchemaType => {\n  // The core schema generator reads flattenedFields from the entity and has no fields argument.\n  const entityForSchema = { ...entity, flattenedFields: fields }\n  const schema = entityToStandaloneJSONSchema({\n    config: req.payload.config,\n    defaultIDType: req.payload.db.defaultIDType,\n    entity: entityForSchema,\n    i18n: req.i18n,\n    variant: 'input',\n  }) as unknown as JsonSchemaType\n\n  return sanitizeEntitySchema(schema)\n}\n"],"names":["entityToStandaloneJSONSchema","filterFieldsByAccess","sanitizeEntitySchema","getCollectionInputSchema","collectionSlug","permissions","req","collection","payload","collections","config","buildEntityInputSchema","entity","fieldsAllowedByAccess","blocks","fields","flattenedFields","shouldExcludeField","create","update","getGlobalInputSchema","globalSlug","global","globals","find","globalConfig","slug","entityForSchema","schema","defaultIDType","db","i18n","variant"],"mappings":"AAAA,SAEEA,4BAA4B,QAQvB,UAAS;AAIhB,SAASC,oBAAoB,QAAQ,4BAA2B;AAChE,SAASC,oBAAoB,QAAQ,4BAA2B;AAEhE,OAAO,MAAMC,2BAA2B,CAAC,EACvCC,cAAc,EACdC,WAAW,EACXC,GAAG,EAKJ;IACC,MAAMC,aAAaD,IAAIE,OAAO,CAACC,WAAW,CAACL,eAAe,EAAEM;IAE5D,IAAI,CAACH,YAAY;QACf,OAAO;IACT;IAEA,IAAI,CAACF,aAAa;QAChB,OAAOM,uBAAuB;YAAEC,QAAQL;YAAYD;QAAI;IAC1D;IAEA,MAAMO,wBAAwBZ,qBAAqB;QACjDa,QAAQR,IAAIE,OAAO,CAACE,MAAM,CAACI,MAAM;QACjCC,QAAQR,WAAWS,eAAe;QAClCX;QACAY,oBAAoB,CAAC,EAAEC,MAAM,EAAEC,MAAM,EAAE,GAAK,CAACD,UAAU,CAACC;IAC1D;IAEA,OAAOR,uBAAuB;QAAEC,QAAQL;QAAYQ,QAAQF;QAAuBP;IAAI;AACzF,EAAC;AAED,OAAO,MAAMc,uBAAuB,CAAC,EACnCC,UAAU,EACVhB,WAAW,EACXC,GAAG,EAKJ;IACC,MAAMgB,SAAShB,IAAIE,OAAO,CAACE,MAAM,CAACa,OAAO,CAACC,IAAI,CAAC,CAACC,eAAiBA,aAAaC,IAAI,KAAKL;IAEvF,IAAI,CAACC,QAAQ;QACX,OAAO;IACT;IAEA,IAAI,CAACjB,aAAa;QAChB,OAAOM,uBAAuB;YAAEC,QAAQU;YAAQhB;QAAI;IACtD;IAEA,MAAMO,wBAAwBZ,qBAAqB;QACjDa,QAAQR,IAAIE,OAAO,CAACE,MAAM,CAACI,MAAM;QACjCC,QAAQO,OAAON,eAAe;QAC9BX;QACAY,oBAAoB,CAAC,EAAEC,MAAM,EAAEC,MAAM,EAAE,GAAK,CAACD,UAAU,CAACC;IAC1D;IAEA,OAAOR,uBAAuB;QAAEC,QAAQU;QAAQP,QAAQF;QAAuBP;IAAI;AACrF,EAAC;AAED,MAAMK,yBAAyB,CAAC,EAC9BC,MAAM,EACNG,SAASH,OAAOI,eAAe,EAC/BV,GAAG,EAKJ;IACC,8FAA8F;IAC9F,MAAMqB,kBAAkB;QAAE,GAAGf,MAAM;QAAEI,iBAAiBD;IAAO;IAC7D,MAAMa,SAAS5B,6BAA6B;QAC1CU,QAAQJ,IAAIE,OAAO,CAACE,MAAM;QAC1BmB,eAAevB,IAAIE,OAAO,CAACsB,EAAE,CAACD,aAAa;QAC3CjB,QAAQe;QACRI,MAAMzB,IAAIyB,IAAI;QACdC,SAAS;IACX;IAEA,OAAO9B,qBAAqB0B;AAC9B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/plugin-mcp",
-  "version": "4.0.0-internal.811e0a4",
+  "version": "4.0.0-internal.8ba6b5b",
   "description": "MCP (Model Context Protocol) capabilities with Payload",
   "keywords": [
     "plugin",
@@ -61,10 +61,10 @@
   },
   "devDependencies": {
     "@payloadcms/eslint-config": "3.28.0",
-    "payload": "4.0.0-internal.811e0a4"
+    "payload": "4.0.0-internal.8ba6b5b"
   },
   "peerDependencies": {
-    "payload": "4.0.0-internal.811e0a4"
+    "payload": "4.0.0-internal.8ba6b5b"
   },
   "//deps_notes": {
     "zod": "zod is a hard dependency of @modelcontextprotocol/server, thus we can safely use it without it impacting bundle size. Make extra sure the zod version here matches exactly what's defined in the dependencies of @modelcontextprotocol/server to avoid duplicate versions being installed.",

package/src/endpoint/access.ts

@@ -12,13 +12,8 @@ export type GetAuthorizedMCPArgs = {
 }
 
 /**
- * Resolves the MCP caller and returns the MCP surface authorized for that request.
- *
- * Authorization has two layers:
- * 1. Payload collection/global permissions determine whether built-in operation tools are shown.
- * 2. MCP `access` callbacks can further hide any configured tool, prompt, or resource.
- *
- * Like Payload core operations, `overrideAccess` skips both layers.
+ * Authenticates an MCP request and removes items the user cannot access.
+ * `overrideAccess` skips Payload and MCP item access checks.
  */
 export const getAuthorizedMCP: (args: GetAuthorizedMCPArgs) => Promise<AuthorizedMCP> = async ({
   overrideAccess,
@@ -53,7 +48,6 @@ export const getAuthorizedMCP: (args: GetAuthorizedMCPArgs) => Promise<Authorize
       req,
     }),
     overrideAccess,
-    user: req.user,
   }
 }
 
@@ -66,8 +60,7 @@ export const filterMCPItems = async ({
   overrideAccess: boolean
   req: PayloadRequest
 }): Promise<MCPItem[]> => {
-  // Match Payload core: overrideAccess bypasses access evaluation instead of
-  // forcing each access function to return true.
+  // Match Payload core: overrideAccess bypasses access evaluation
   if (overrideAccess) {
     return items
   }

package/src/mcp/builtin/collections/countTool.ts

@@ -3,7 +3,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 
 const DEFAULT_DESCRIPTION =
@@ -42,8 +41,8 @@ export const countDocumentsTool = defineCollectionTool({
   try {
     const result = await payload.count({
       collection: collectionSlug,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(locale ? { locale } : {}),
       ...(trash !== undefined ? { trash } : {}),
       ...(where ? { where } : {}),

package/src/mcp/builtin/collections/countVersionsTool.ts

@@ -3,7 +3,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 
 const DEFAULT_DESCRIPTION =
@@ -22,10 +21,7 @@ export const countVersionsTool = defineCollectionTool({
   },
   description: DEFAULT_DESCRIPTION,
   input: z.object({
-    locale: z
-      .string()
-      .describe('Optional: locale code to count versions in')
-      .optional(),
+    locale: z.string().describe('Optional: locale code to count versions in').optional(),
     where: whereSchema
       .describe(
         'Optional: where clause for filtering versions. Version document fields are usually under "version". Example: {"version.title":{"contains":"test"}}',
@@ -42,8 +38,8 @@ export const countVersionsTool = defineCollectionTool({
   try {
     const result = await payload.countVersions({
       collection: collectionSlug,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(locale ? { locale } : {}),
       ...(where ? { where } : {}),
     })

package/src/mcp/builtin/collections/createTool.ts

@@ -9,7 +9,6 @@ import {
   getCollectionVirtualFieldNames,
   stripVirtualFields,
 } from '../../../utils/getVirtualFieldNames.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { validateCollectionData } from '../validateEntityData.js'
 import { formatCollectionError } from './formatCollectionError.js'
@@ -86,8 +85,8 @@ export const createDocumentTool = defineCollectionTool({
       data: parsedData,
       depth,
       draft,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(locale ? { locale } : {}),
       ...(fallbackLocale ? { fallbackLocale } : {}),
       ...(select ? { select: select as SelectType } : {}),

package/src/mcp/builtin/collections/deleteTool.ts

@@ -3,7 +3,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 
 const DEFAULT_DESCRIPTION =
@@ -69,8 +68,8 @@ export const deleteDocumentsTool = defineCollectionTool({
     const deleteOptions: Record<string, unknown> = {
       collection: collectionSlug,
       depth,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(locale && { locale }),
       ...(fallbackLocale && { fallbackLocale }),
     }

package/src/mcp/builtin/collections/duplicateTool.ts

@@ -9,7 +9,6 @@ import {
   getCollectionVirtualFieldNames,
   stripVirtualFields,
 } from '../../../utils/getVirtualFieldNames.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { formatCollectionError } from './formatCollectionError.js'
 
@@ -105,8 +104,8 @@ export const duplicateDocumentTool = defineCollectionTool({
       collection: collectionSlug,
       depth,
       draft,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(parsedData ? { data: parsedData } : {}),
       ...(locale ? { locale } : {}),
       ...(fallbackLocale ? { fallbackLocale } : {}),

package/src/mcp/builtin/collections/findDistinctTool.ts

@@ -5,7 +5,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 
 const DEFAULT_DESCRIPTION =
@@ -73,7 +72,8 @@ export const findDistinctTool = defineCollectionTool({
 }).handler(async ({ authorizedMCP, collectionSlug, input, req }) => {
   const payload = req.payload
   const logger = getLogger({ payload })
-  const { depth, field, limit, locale, page, populate, showHiddenFields, sort, trash, where } = input
+  const { depth, field, limit, locale, page, populate, showHiddenFields, sort, trash, where } =
+    input
 
   logger.info(`Finding distinct values in collection: ${collectionSlug}, field: ${field}`)
 
@@ -82,8 +82,8 @@ export const findDistinctTool = defineCollectionTool({
       collection: collectionSlug,
       depth,
       field,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(limit ? { limit } : {}),
       ...(locale ? { locale } : {}),
       ...(page ? { page } : {}),

package/src/mcp/builtin/collections/findTool.ts

@@ -5,7 +5,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 
 const DEFAULT_DESCRIPTION =
@@ -134,8 +133,8 @@ export const findDocumentsTool = defineCollectionTool({
           id,
           collection: collectionSlug,
           depth,
+          overrideAccess: authorizedMCP.overrideAccess,
           req,
-          ...localAPIDefaults(authorizedMCP),
           ...(select && { select: select as SelectType }),
           ...(populate && { populate: populate as PopulateType }),
           ...(joins !== undefined && { joins: joins as JoinQuery }),
@@ -171,9 +170,9 @@ export const findDocumentsTool = defineCollectionTool({
       collection: collectionSlug,
       depth,
       limit,
+      overrideAccess: authorizedMCP.overrideAccess,
       page,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(select && { select: select as SelectType }),
       ...(populate && { populate: populate as PopulateType }),
       ...(joins !== undefined && { joins: joins as JoinQuery }),

package/src/mcp/builtin/collections/findVersionByIDTool.ts

@@ -5,7 +5,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 
 const DEFAULT_DESCRIPTION =
   'Find a specific document version in any version-enabled collection by passing the collection slug and version ID.'
@@ -75,8 +74,8 @@ export const findVersionByIDTool = defineCollectionTool({
       id,
       collection: collectionSlug,
       depth,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(fallbackLocale ? { fallbackLocale } : {}),
       ...(locale ? { locale } : {}),
       ...(populate ? { populate: populate as PopulateType } : {}),

package/src/mcp/builtin/collections/findVersionsTool.ts

@@ -5,7 +5,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 
 const DEFAULT_DESCRIPTION =
@@ -116,9 +115,9 @@ export const findVersionsTool = defineCollectionTool({
       collection: collectionSlug,
       depth,
       limit,
+      overrideAccess: authorizedMCP.overrideAccess,
       page,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(fallbackLocale ? { fallbackLocale } : {}),
       ...(locale ? { locale } : {}),
       ...(pagination !== undefined ? { pagination } : {}),

package/src/mcp/builtin/collections/getCollectionSchemaTool.ts

@@ -1,3 +1,5 @@
+import { getAccessResults } from 'payload'
+
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getCollectionInputSchema } from '../../../utils/schemaConversion/getEntityInputSchema.js'
@@ -6,12 +8,7 @@ export const getCollectionSchemaTool = defineCollectionTool({
   access: (args) => {
     const permissions = args.permissions?.collections?.[args.collectionSlug]
 
-    return (
-      defaultAccess(args) &&
-      Boolean(
-        permissions?.create || permissions?.delete || permissions?.read || permissions?.update,
-      )
-    )
+    return defaultAccess(args) && Boolean(permissions?.create || permissions?.update)
   },
   annotations: {
     destructiveHint: false,
@@ -21,8 +18,28 @@ export const getCollectionSchemaTool = defineCollectionTool({
     title: 'Get Collection Schema',
   },
   description: 'Get the input schema for creating or updating documents in a collection.',
-}).handler(({ collectionSlug, req }) => {
-  const inputSchema = getCollectionInputSchema({ collectionSlug, req })
+}).handler(async ({ authorizedMCP, collectionSlug, req }) => {
+  const permissions = authorizedMCP.overrideAccess
+    ? null
+    : (await getAccessResults({ req })).collections?.[collectionSlug]
+
+  if (!authorizedMCP.overrideAccess && !permissions?.create && !permissions?.update) {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `Error: MCP access to "getCollectionSchema" is not enabled for collection "${collectionSlug}"`,
+        },
+      ],
+      isError: true,
+    }
+  }
+
+  const inputSchema = getCollectionInputSchema({
+    collectionSlug,
+    req,
+    ...(permissions ? { permissions } : {}),
+  })
 
   if (!inputSchema) {
     return {

package/src/mcp/builtin/collections/restoreVersionTool.ts

@@ -5,7 +5,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 
 const DEFAULT_DESCRIPTION =
   'Restore a document from a previous version in any version-enabled collection.'
@@ -74,8 +73,8 @@ export const restoreVersionTool = defineCollectionTool({
       collection: collectionSlug,
       depth,
       draft,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(fallbackLocale ? { fallbackLocale } : {}),
       ...(locale ? { locale } : {}),
       ...(populate ? { populate: populate as PopulateType } : {}),

package/src/mcp/builtin/collections/updateTool.ts

@@ -9,7 +9,6 @@ import {
   getCollectionVirtualFieldNames,
   stripVirtualFields,
 } from '../../../utils/getVirtualFieldNames.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { getCollectionInputSchema } from '../../../utils/schemaConversion/getEntityInputSchema.js'
 import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
@@ -129,9 +128,9 @@ export const updateDocumentTool = defineCollectionTool({
         data: parsedData,
         depth,
         draft,
+        overrideAccess: authorizedMCP.overrideAccess,
         overrideLock,
         req,
-        ...localAPIDefaults(authorizedMCP),
         ...(filePath ? { filePath } : {}),
         ...(overwriteExistingFiles ? { overwriteExistingFiles } : {}),
         ...(locale ? { locale } : {}),
@@ -155,10 +154,10 @@ export const updateDocumentTool = defineCollectionTool({
       data: parsedData,
       depth,
       draft,
+      overrideAccess: authorizedMCP.overrideAccess,
       overrideLock,
       req,
       where: whereClause,
-      ...localAPIDefaults(authorizedMCP),
       ...(filePath ? { filePath } : {}),
       ...(overwriteExistingFiles ? { overwriteExistingFiles } : {}),
       ...(locale ? { locale } : {}),

package/src/mcp/builtin/getConfigInfoTool.ts

@@ -12,10 +12,8 @@ export const getConfigInfoTool = defineTool({
   },
   description: 'List the Payload collection and global slugs visible to this MCP client.',
 }).handler(async ({ authorizedMCP, req }) => {
-  const user = authorizedMCP.user
-  const permissions = authorizedMCP.overrideAccess
-    ? null
-    : await getAccessResults({ req: { ...req, user } })
+  const user = req.user
+  const permissions = authorizedMCP.overrideAccess ? null : await getAccessResults({ req })
   const authorizedCollectionSlugs = new Set<string>()
   const authorizedGlobalSlugs = new Set<string>()
 

package/src/mcp/builtin/globals/countVersionsTool.ts

@@ -3,7 +3,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 
 const DEFAULT_DESCRIPTION =
@@ -21,10 +20,7 @@ export const countGlobalVersionsTool = defineGlobalTool({
   },
   description: DEFAULT_DESCRIPTION,
   input: z.object({
-    locale: z
-      .string()
-      .describe('Optional: locale code to count versions in')
-      .optional(),
+    locale: z.string().describe('Optional: locale code to count versions in').optional(),
     where: whereSchema
       .describe(
         'Optional: where clause for filtering versions. Version document fields are usually under "version". Example: {"version.siteName":{"contains":"test"}}',
@@ -41,8 +37,8 @@ export const countGlobalVersionsTool = defineGlobalTool({
   try {
     const result = await payload.countGlobalVersions({
       global: globalSlug,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(locale ? { locale } : {}),
       ...(where ? { where } : {}),
     })

package/src/mcp/builtin/globals/findTool.ts

@@ -5,7 +5,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 
 const DEFAULT_DESCRIPTION = 'Find any Payload global by passing the global slug.'
 
@@ -66,7 +65,8 @@ export const findGlobalTool = defineGlobalTool({
     const findOptions: Parameters<typeof payload.findGlobal>[0] = {
       slug: globalSlug,
       depth,
-      ...localAPIDefaults(authorizedMCP),
+      overrideAccess: authorizedMCP.overrideAccess,
+      req,
     }
 
     if (locale) {

package/src/mcp/builtin/globals/findVersionByIDTool.ts

@@ -5,7 +5,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 
 const DEFAULT_DESCRIPTION =
   'Find a specific global version in any version-enabled global by passing the global slug and version ID.'
@@ -70,8 +69,8 @@ export const findGlobalVersionByIDTool = defineGlobalTool({
       id,
       slug: globalSlug,
       depth,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(fallbackLocale ? { fallbackLocale } : {}),
       ...(locale ? { locale } : {}),
       ...(populate ? { populate: populate as PopulateType } : {}),