Skip to content

v1.6.0

Choose a tag to compare

@github-actions github-actions released this 09 Jun 18:52

Makes the plugin's custom Reservations admin views multi-tenant aware. Additive minor release — with no multiTenant option set and no tenant field on the collections, behavior is unchanged.

Fixed

  • Cross-tenant data leak in the custom admin views. The plugin replaces the built-in Reservations list view with a custom calendar and fetches its own data (REST in the client views, Local API in the dashboard widget), so @payloadcms/plugin-multi-tenant's list-view baseFilter never applied — a super-admin with a single tenant selected saw every tenant's reservations, resources, and schedules. The calendar, pending count/list, availability grid, and dashboard widget now scope to the selected tenant (read from the payload-tenant cookie).

Added

  • multiTenant plugin option — opt-in tenant scoping for the custom admin views: { tenantField?: string (default 'tenant'); cookieName?: string (default 'payload-tenant') }. Auto-detected at runtime: scoping is applied only when the scoped collection (resources, schedules, reservations) actually has the tenant field and the tenant cookie is set, so plain single-tenant installs are byte-for-byte unchanged. No peer dependency on @payloadcms/plugin-multi-tenant (it is detected, not required).