payload-plugin-newsletter 0.1.1 → 0.3.1

package/CHANGELOG.md

@@ -5,6 +5,58 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.1] - 2025-06-15
+
+### Security
+- **CRITICAL**: Fixed access control vulnerability where any authenticated user could read, update, or delete any subscriber
+- **CRITICAL**: Fixed access control vulnerability where any authenticated user could modify newsletter settings
+- Added proper admin role checking with support for multiple admin patterns
+- Added configurable admin check function for custom authentication setups
+
+### Added
+- New `access.isAdmin` configuration option for custom admin authentication
+- Flexible admin detection supporting common patterns (roles, isAdmin, role, admin)
+- Access control utility functions for consistent security
+
+### Changed
+- All collection access controls now properly validate admin status
+- Improved security documentation with custom admin configuration examples
+
+## [0.3.0] - 2025-06-15
+
+### Added
+- Comprehensive security improvements to respect Payload access control
+- Synthetic user pattern for subscriber self-service operations
+- Admin verification for newsletter settings modifications
+- Security documentation in README
+
+### Changed
+- All API endpoints now properly implement `overrideAccess` and `user` parameters
+- Preferences endpoint now ensures subscribers can only access their own data
+- Unsubscribe endpoint validates ownership through tokens
+- Magic link verification uses synthetic users for updates
+- Newsletter settings modifications now require admin authentication
+
+### Security
+- Implemented proper access control for all Payload Local API operations
+- Added user context validation for authenticated endpoints
+- Restricted settings access to admin users only
+- Enhanced protection against unauthorized data access
+
+## [0.2.0] - 2025-06-15
+
+### Changed
+- **BREAKING**: Changed newsletter settings from a global to a collection
+  - Allows multiple configurations (e.g., dev/staging/prod)
+  - Only one configuration can be active at a time
+  - Migrate existing settings by creating a new configuration in the collection
+- Updated README to clarify the settings collection usage
+
+### Added
+- Support for multiple email configurations
+- Automatic deactivation of other configs when activating one
+- Configuration name field for better organization
+
 ## [0.1.1] - 2025-06-15
 
 ### Fixed
@@ -38,6 +90,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Domain restriction options
 - Input validation and sanitization
 
+[0.3.1]: https://github.com/aniketpanjwani/payload-plugin-email-newsletter/releases/tag/v0.3.1
+[0.3.0]: https://github.com/aniketpanjwani/payload-plugin-email-newsletter/releases/tag/v0.3.0
+[0.2.0]: https://github.com/aniketpanjwani/payload-plugin-email-newsletter/releases/tag/v0.2.0
+[0.1.1]: https://github.com/aniketpanjwani/payload-plugin-email-newsletter/releases/tag/v0.1.1
 [0.1.0]: https://github.com/aniketpanjwani/payload-plugin-email-newsletter/releases/tag/v0.1.0
 
 ---

package/README.md

@@ -64,7 +64,7 @@ export default buildConfig({
 
 The plugin automatically adds:
 - A `subscribers` collection to manage your subscribers
-- A `newsletter-settings` global for email configuration
+- A `newsletter-settings` collection for email configurations (supports multiple environments)
 - API endpoints for subscription and authentication
 - Newsletter scheduling fields to your articles (optional)
 
@@ -111,12 +111,32 @@ Subscribers can be managed through the Payload admin panel at `/admin/collection
 
 ### Email Settings
 
-After setup, configure email settings at `/admin/globals/newsletter-settings` in your admin panel. You can:
+After setup, configure email settings at `/admin/collections/newsletter-settings` in your admin panel. You can:
+- Create multiple configurations (e.g., for different environments or purposes)
+- Set one configuration as active at a time
 - Switch between email providers
 - Update API keys and settings
 - Customize email templates
 - Set subscription preferences
 
+**Note**: Only one configuration can be active at a time. The plugin will use the active configuration for sending emails.
+
+## Initial Setup
+
+After installing the plugin, you'll need to:
+
+1. **Create an email configuration**:
+   - Go to `/admin/collections/newsletter-settings`
+   - Click "Create New"
+   - Give it a name (e.g., "Production" or "Development")
+   - Configure your email provider settings
+   - Set it as "Active"
+   - Save
+
+2. **Start collecting subscribers**:
+   - Subscribers will appear in `/admin/collections/subscribers`
+   - Use the provided React components or API endpoints
+
 ## Configuration Options
 
 ### Minimal Configuration
@@ -394,6 +414,45 @@ newsletterPlugin({
 - Check the email provider's dashboard for errors
 - Ensure from address is verified with your provider
 
+## Security
+
+### Access Control
+
+Starting from v0.3.0, the plugin implements proper access control for all operations:
+
+- **Subscriber data**: Users can only access and modify their own data via magic link authentication
+- **Newsletter settings**: Only admin users can modify email provider settings and configurations
+- **API endpoints**: All endpoints respect Payload's access control rules
+
+#### Custom Admin Check
+
+The plugin supports multiple admin authentication patterns out of the box:
+- `user.roles.includes('admin')` - Role-based
+- `user.isAdmin === true` - Boolean field
+- `user.role === 'admin'` - Single role field
+- `user.admin === true` - Admin boolean
+
+If your setup uses a different pattern, configure a custom admin check:
+
+```typescript
+newsletterPlugin({
+  access: {
+    isAdmin: (user) => {
+      // Your custom logic
+      return user.customAdminField === true
+    }
+  },
+  // ... other config
+})
+```
+
+### Best Practices
+
+- Always use environment variables for sensitive data (API keys, JWT secrets)
+- Enable double opt-in for GDPR compliance
+- Configure allowed domains to prevent spam subscriptions
+- Set reasonable rate limits for subscriptions per IP
+
 ## Migration Guide
 
 Coming from another newsletter system? The plugin stores subscribers in a standard Payload collection, making it easy to import existing data: