@simmalugnt-se/payload-content-health 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.1
+
+- The work list at `/admin/content-health` requires Admin access. Payload leaves custom Admin views
+  public, so a visitor who was not signed in saw the list, filled with what anonymous access could
+  read. Now they are sent to the login and back, and a signed-in user without Admin access to
+  Payload's unauthorized page.
+
 ## 0.2.0
 
 - Work list at `/admin/content-health`, linked from the nav: every finding, filterable by check,

package/README.md

@@ -115,8 +115,9 @@ or block the unsaved form no longer has opens the nearest enclosing field instea
 
 With `@simmalugnt-se/payload-editor-assistant` (0.5.0 or later), rows in the collections the
 assistant works in also get "Fix with the assistant": the same link with a ready prompt that the
-assistant puts in its message box. The editor sends it. The packages do not import each other; they
-share these names:
+assistant puts in its message box. The editor sends it. To write a missing alt text, the assistant
+needs to see the image: allow `media.view` on the media collection (0.6.0 or later). The packages
+do not import each other; they share these names:
 
 | Name                                         | Direction               | Meaning                                  |
 | -------------------------------------------- | ----------------------- | ---------------------------------------- |

package/dist/links.d.ts

@@ -21,6 +21,21 @@ export declare const SELECT_EVENT = "content-health:select";
  * `config.admin.custom.editorAssistant.collections`. The work list offers the assistant only there.
  */
 export declare const ASSISTANT_CUSTOM_KEY = "editorAssistant";
+/**
+ * Where to send a visitor who may not use Admin, or null to show the work list. Payload leaves
+ * custom views public, so the view checks this itself, as Payload does for its own: to the login
+ * with a way back when signed out, to Payload's unauthorized page when signed in without access.
+ */
+export declare function accessRedirect(args: {
+    routes: {
+        admin: string;
+        login: `/${string}`;
+        unauthorized: `/${string}`;
+    };
+    canAccessAdmin: boolean;
+    signedIn: boolean;
+    searchParams?: Record<string, string | string[] | undefined>;
+}): string | null;
 export declare function assistantCollections(adminCustom: unknown): string[];
 /** The document in the finding's locale with its field brought into view, and a prompt when given. */
 export declare function editURL(adminRoute: string, finding: Finding, ask?: string): string;

package/dist/links.js

@@ -27,6 +27,31 @@ export const SELECT_EVENT = "content-health:select";
  * `config.admin.custom.editorAssistant.collections`. The work list offers the assistant only there.
  */
 export const ASSISTANT_CUSTOM_KEY = "editorAssistant";
+/**
+ * Where to send a visitor who may not use Admin, or null to show the work list. Payload leaves
+ * custom views public, so the view checks this itself, as Payload does for its own: to the login
+ * with a way back when signed out, to Payload's unauthorized page when signed in without access.
+ */
+export function accessRedirect(args) {
+    const { routes } = args;
+    if (args.canAccessAdmin) {
+        return null;
+    }
+    if (args.signedIn) {
+        return formatAdminURL({ adminRoute: routes.admin, path: routes.unauthorized });
+    }
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(args.searchParams ?? {})) {
+        if (key === "redirect")
+            continue;
+        for (const item of Array.isArray(value) ? value : value === undefined ? [] : [value]) {
+            query.append(key, item);
+        }
+    }
+    const back = `${VIEW_PATH}${query.size ? `?${query}` : ""}`;
+    const login = formatAdminURL({ adminRoute: routes.admin, path: routes.login });
+    return `${login}?${new URLSearchParams({ redirect: back })}`;
+}
 export function assistantCollections(adminCustom) {
     const entry = adminCustom?.[ASSISTANT_CUSTOM_KEY];
     const collections = entry?.collections;

package/dist/view/ContentHealthView.d.ts

@@ -4,5 +4,6 @@ import "../styles/view.css";
  * The work list: every finding with filters on check, collection and locale. Each row opens the
  * document in the finding's locale with the field selected; where the editor assistant works, a
  * second link opens it with a ready prompt too. Scans once per visit; the filters work in the browser.
+ * Only for visitors who may use Admin: Payload leaves custom views public.
  */
 export declare function ContentHealthView({ initPageResult, params, searchParams, }: AdminViewServerProps): Promise<import("react").JSX.Element>;

package/dist/view/ContentHealthView.js

@@ -1,8 +1,9 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { DefaultTemplate } from "@payloadcms/next/templates";
 import { Gutter, SetStepNav } from "@payloadcms/ui";
+import { redirect } from "next/navigation";
 import { ASK, CHECK_LABELS, findingDetail, LIST_COPY, uiLanguage } from "../copy.js";
-import { assistantCollections, editURL, readFilters } from "../links.js";
+import { accessRedirect, assistantCollections, editURL, readFilters } from "../links.js";
 import { scanContentHealth } from "../scan.js";
 import { CHECK_IDS } from "../types.js";
 import { WorkList } from "./WorkList.js";
@@ -11,9 +12,19 @@ import "../styles/view.css";
  * The work list: every finding with filters on check, collection and locale. Each row opens the
  * document in the finding's locale with the field selected; where the editor assistant works, a
  * second link opens it with a ready prompt too. Scans once per visit; the filters work in the browser.
+ * Only for visitors who may use Admin: Payload leaves custom views public.
  */
 export async function ContentHealthView({ initPageResult, params, searchParams, }) {
     const { req, locale, permissions, visibleEntities } = initPageResult;
+    const denied = accessRedirect({
+        routes: { admin: req.payload.config.routes.admin, ...req.payload.config.admin.routes },
+        canAccessAdmin: Boolean(permissions?.canAccessAdmin),
+        signedIn: Boolean(req.user),
+        searchParams,
+    });
+    if (denied) {
+        redirect(denied);
+    }
     const language = uiLanguage(req.i18n?.language);
     const copy = LIST_COPY[language];
     const { config } = req.payload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simmalugnt-se/payload-content-health",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Content health checks and dashboard widgets for Payload Admin: alt texts, SEO fields and more",
   "keywords": [
     "payload",