payload 1.2.0 → 1.2.2

package/docs/fields/upload.mdx

@@ -23,24 +23,24 @@ keywords: upload, images media, fields, config, configuration, documentation, Co
 
 ### Config
 
-| Option           | Description |
-| ---------------- | ----------- |
-| **`name`** *         | To be used as the property name when stored and retrieved from the database.  |
-| **`*relationTo`** *  | Provide a single collection `slug` to allow this field to accept a relation to. <strong>Note: the related collection must be configured to support Uploads.</strong> |
-| **`filterOptions`**  | A query to filter which options appear in the UI and validate against. [More](#filtering-relationship-options). |
-| **`maxDepth`**       | Sets a number limit on iterations of related documents to populate when queried. [Depth](/docs/getting-started/concepts#depth) |
-| **`label`**          | Used as a field label in the Admin panel and to name the generated GraphQL type. |
-| **`unique`**         | Enforce that each entry in the Collection has a unique value for this field. |
-| **`validate`**       | Provide a custom validation function that will be executed on both the Admin panel and the backend. [More](/docs/fields/overview#validation) |
+| Option           | Description                                                                                                                                                                                         |
+| ---------------- |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| **`name`** *         | To be used as the property name when stored and retrieved from the database.                                                                                                                        |
+| **`*relationTo`** *  | Provide a single collection `slug` to allow this field to accept a relation to. <strong>Note: the related collection must be configured to support Uploads.</strong>                                |
+| **`filterOptions`**  | A query to filter which options appear in the UI and validate against. [More](#filtering-upload-options).                                                                                           |
+| **`maxDepth`**       | Sets a number limit on iterations of related documents to populate when queried. [Depth](/docs/getting-started/concepts#depth)                                                                      |
+| **`label`**          | Text used as a field label in the Admin panel or an object with keys for each language.                                                                                                             |
+| **`unique`**         | Enforce that each entry in the Collection has a unique value for this field.                                                                                                                        |
+| **`validate`**       | Provide a custom validation function that will be executed on both the Admin panel and the backend. [More](/docs/fields/overview#validation)                                                        |
 | **`index`**          | Build a [MongoDB index](https://docs.mongodb.com/manual/indexes/) for this field to produce faster queries. Set this field to `true` if your users will perform queries on this field's data often. |
-| **`saveToJWT`**      | If this field is top-level and nested in a config supporting [Authentication](/docs/authentication/config), include its data in the user JWT. |
-| **`hooks`**          | Provide field-based hooks to control logic for this field. [More](/docs/fields/overview#field-level-hooks) |
-| **`access`**         | Provide field-based access control to denote what users can see and do with this field's data. [More](/docs/fields/overview#field-level-access-control) |
-| **`hidden`**         | Restrict this field's visibility from all APIs entirely. Will still be saved to the database, but will not appear in any API or the Admin panel. |
-| **`defaultValue`**   | Provide data to be used for this field's default value. [More](/docs/fields/overview#default-values) |
-| **`localized`**      | Enable localization for this field. Requires [localization to be enabled](/docs/configuration/localization) in the Base config. |
-| **`required`**       | Require this field to have a value. |
-| **`admin`**          | Admin-specific configuration. See the [default field admin config](/docs/fields/overview#admin-config) for more details. |
+| **`saveToJWT`**      | If this field is top-level and nested in a config supporting [Authentication](/docs/authentication/config), include its data in the user JWT.                                                       |
+| **`hooks`**          | Provide field-based hooks to control logic for this field. [More](/docs/fields/overview#field-level-hooks)                                                                                          |
+| **`access`**         | Provide field-based access control to denote what users can see and do with this field's data. [More](/docs/fields/overview#field-level-access-control)                                             |
+| **`hidden`**         | Restrict this field's visibility from all APIs entirely. Will still be saved to the database, but will not appear in any API or the Admin panel.                                                    |
+| **`defaultValue`**   | Provide data to be used for this field's default value. [More](/docs/fields/overview#default-values)                                                                                                |
+| **`localized`**      | Enable localization for this field. Requires [localization to be enabled](/docs/configuration/localization) in the Base config.                                                                     |
+| **`required`**       | Require this field to have a value.                                                                                                                                                                 |
+| **`admin`**          | Admin-specific configuration. See the [default field admin config](/docs/fields/overview#admin-config) for more details.                                                                            |
 
 *\* An asterisk denotes that a property is required.*
 
@@ -63,3 +63,37 @@ const ExampleCollection: CollectionConfig = {
 }
 
 ```
+
+### Filtering upload options
+
+Options can be dynamically limited by supplying a [query constraint](/docs/queries/overview), which will be used both for validating input and filtering available uploads in the UI.
+
+The `filterOptions` property can either be a `Where` query directly, or a function that returns one. When using a function, it will be called with an argument object with the following properties:
+
+| Property      | Description  |
+| ------------- | -------------|
+| `relationTo`       | The `relationTo` to filter against (as defined on the field) |
+| `data`             | An object of the full collection or global document currently being edited |
+| `siblingData`      | An object of the document data limited to fields within the same parent to the field |
+| `id`               | The value of the collection `id`, will be `undefined` on create request |
+| `user`             | The currently authenticated user object |
+
+**Example:**
+
+```ts
+const uploadField = {
+  name: 'image',
+  type: 'upload',
+  relationTo: 'media',
+  filterOptions: {
+    mimeType: { contains: 'image' },
+  },
+};
+```
+
+You can learn more about writing queries [here](/docs/queries/overview).
+
+<Banner type="warning">
+  <strong>Note:</strong><br/>
+  When an upload field has both <strong>filterOptions</strong> and a custom <strong>validate</strong> function, the api will not validate <strong>filterOptions</strong> unless you call the default upload field validation function imported from <strong>payload/fields/validations</strong> in your validate function.
+</Banner>

package/docs/production/preventing-abuse.mdx

@@ -18,12 +18,12 @@ Set the max number of failed login attempts before a user account is locked out
 
 To prevent DDoS, brute-force, and similar attacks, you can set IP-based rate limits so that once a certain threshold of requests has been hit by a single IP, further requests from the same IP will be ignored. The Payload config `rateLimit` property accepts an object with the following properties:
 
-| Option                       | Description  |
-| ---------------------------- | -------------|
-| **`window`**                 | Time in milliseconds to track requests per IP |
-| **`max`**                    | Number of requests served from a single IP before limiting |
-| **`skip`**                   | Express middleware function that can return true (or promise resulting in true) that will bypass limit |
-| **`trustProxy`**             | True or false, to enable to allow requests to pass through a proxy such as a load balancer or an `nginx` reverse proxy |
+| Option                       | Description |
+| ---------------------------- | ----------- |
+| **`window`**                 | Time in milliseconds to track requests per IP. Defaults to `90000` (15 minutes). |
+| **`max`**                    | Number of requests served from a single IP before limiting. Defaults to `500`. |
+| **`skip`**                   | Express middleware function that can return true (or promise resulting in true) that will bypass limit. |
+| **`trustProxy`**             | True or false, to enable to allow requests to pass through a proxy such as a load balancer or an `nginx` reverse proxy. |
 
 <Banner type="warning">
   <strong>Warning:</strong><br/>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payload",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Node, React and MongoDB Headless CMS and Application Framework",
   "license": "MIT",
   "engines": {
@@ -52,6 +52,7 @@
     "release:minor": "release-it minor",
     "release:major": "release-it major",
     "release:beta": "release-it prepatch --config .release-it.beta.json",
+    "fix": "eslint \"src/**/*.ts\" --fix",
     "lint": "eslint \"src/**/*.ts\""
   },
   "bugs": {
@@ -94,6 +95,7 @@
     "@faceless-ui/scroll-info": "^1.2.3",
     "@faceless-ui/window-info": "^2.0.2",
     "@types/is-plain-object": "^2.0.4",
+    "@types/sharp": "^0.26.1",
     "babel-jest": "^26.3.0",
     "babel-loader": "^8.1.0",
     "body-parser": "^1.19.0",
@@ -255,7 +257,6 @@
     "@types/react-router-dom": "^5.1.6",
     "@types/react-select": "^3.0.26",
     "@types/sass": "^1.16.0",
-    "@types/sharp": "^0.26.1",
     "@types/shelljs": "^0.8.11",
     "@types/testing-library__jest-dom": "^5.9.5",
     "@types/uuid": "^8.3.0",