fix(next, ui): respect access of user for document locking (#9139)

Author: PatrikKozak

packages/next/src/views/Account/index.tsx

@@ -98,8 +98,7 @@ export const Account: React.FC<AdminViewProps> = async ({
       id: user.id,
       collectionConfig,
       isEditing: true,
-      payload: req.payload,
-      user,
+      req,
     })
 
     // Get all versions required for UI

packages/next/src/views/Document/getIsLocked.ts

@@ -1,5 +1,5 @@
 import type {
-  Payload,
+  PayloadRequest,
   SanitizedCollectionConfig,
   SanitizedGlobalConfig,
   TypedUser,
@@ -11,8 +11,7 @@ type Args = {
   globalConfig?: SanitizedGlobalConfig
   id?: number | string
   isEditing: boolean
-  payload: Payload
-  user: TypedUser
+  req: PayloadRequest
 }
 
 type Result = Promise<{
@@ -26,8 +25,7 @@ export const getIsLocked = async ({
   collectionConfig,
   globalConfig,
   isEditing,
-  payload,
-  user,
+  req,
 }: Args): Result => {
   const entityConfig = collectionConfig || globalConfig
 
@@ -61,17 +59,19 @@ export const getIsLocked = async ({
     ]
   }
 
-  const { docs } = await payload.find({
+  const { docs } = await req.payload.find({
     collection: 'payload-locked-documents',
     depth: 1,
+    overrideAccess: false,
+    req,
     where,
   })
 
   if (docs.length > 0) {
     const newEditor = docs[0].user?.value
     const lastUpdateTime = new Date(docs[0].updatedAt).getTime()
 
-    if (newEditor?.id !== user.id) {
+    if (newEditor?.id !== req.user.id) {
       return {
         currentEditor: newEditor,
         isLocked: true,

packages/next/src/views/Document/index.tsx

@@ -126,8 +126,7 @@ export const renderDocument = async ({
       collectionConfig,
       globalConfig,
       isEditing,
-      payload: req.payload,
-      user,
+      req,
     }),
   ])
 

packages/ui/src/utilities/handleFormStateLocking.ts

@@ -61,7 +61,9 @@ export const handleFormStateLocking = async ({
         collection: 'payload-locked-documents',
         depth: 1,
         limit: 1,
+        overrideAccess: false,
         pagination: false,
+        req,
         where: lockedDocumentQuery,
       })