Skip to content

Commit 90c92f4

Browse files
paulpopusCopilot
paulpopus
and
Copilot
authored
feat(plugin-ecommerce)!: add ability to enable guest carts with reworked access config (#14565)
This PR introduce a breaking change into the plugin as it was necessary in order to provide more secure guest carts. With this change you can now configure `allowGuestCarts` (enabled by default) to enable or disable this kind of access control. - Carts will have a generated secret if they're created by guest users. - Guest users will use this token to retrieve or update the cart, without making all non-claimed carts publicly available - This secret is stored in local storage, it's not super critical information either The access config has changed **Before** ```ts ecommercePlugin({ access: { adminOnly, adminOnlyFieldAccess, adminOrCustomerOwner, adminOrPublishedStatus, customerOnlyFieldAccess, } }) ``` **After** ```ts ecommercePlugin({ access: { adminOnlyFieldAccess, adminOrPublishedStatus, customerOnlyFieldAccess, isAdmin, isDocumentOwner, } }) ``` This PR also adds a new `isLoading` status to all hooks that will be true when any action is being taken allowing you to disable buttons or UI conditionally. --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent 14f042f commit 90c92f4

34 files changed

+2813
-501
lines changed

‎docs/ecommerce/advanced.mdx‎

Lines changed: 39 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,12 @@ Use this to create the `addresses` collection. This collection is used to store
3636

3737
The access object can contain the following properties:
3838

39-
| Property | Type | Description |
40-
| ------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
41-
| `adminOrCustomerOwner` | `Access` | Access control to check if the user has `admin` permissions or is the owner of the document via the `customer` field. Used to limit read, update or delete to only the customers that own this address. |
42-
| `authenticatedOnly` | `Access` | Access control to check if the user is authenticated. Use on the `create` access to allow any customer to create a new address. |
43-
| `customerOnlyFieldAccess` | `FieldAccess` | Field level access control to check if the user has `customer` permissions. |
39+
| Property | Type | Description |
40+
| ------------------------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
41+
| `isAdmin` | `Access` | Access control to check if the user has `admin` permissions. |
42+
| `isAuthenticated` | `Access` | Access control to check if the user is authenticated. Use on the `create` access to allow any customer to create a new address. |
43+
| `isDocumentOwner` | `Access` | Access control to check if the user owns the document via the `customer` field. Used to limit read, update or delete to only the customers that own this address. |
44+
| `customerOnlyFieldAccess` | `FieldAccess` | Field level access control to check if the user has `customer` permissions. |
4445

4546
See the [access control section](./plugin#access) for more details on each of these functions.
4647

@@ -51,8 +52,9 @@ import { createAddressesCollection } from 'payload-plugin-ecommerce'
5152

5253
const Addresses = createAddressesCollection({
5354
access: {
54-
adminOrCustomerOwner,
55-
authenticatedOnly,
55+
isAdmin,
56+
isAuthenticated,
57+
isDocumentOwner,
5658
customerOnlyFieldAccess,
5759
},
5860
addressFields: [
@@ -80,10 +82,12 @@ Use this to create the `carts` collection to store customer carts. It takes the
8082

8183
The access object can contain the following properties:
8284

83-
| Property | Type | Description |
84-
| ---------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
85-
| `adminOrCustomerOwner` | `Access` | Access control to check if the user has `admin` permissions or is the owner of the document via the `customer` field. Used to limit read, update or delete to only the customers that own this cart. |
86-
| `publicAccess` | `Access` | Allow anyone to create a new cart, useful for guests. |
85+
| Property | Type | Description |
86+
| ----------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
87+
| `isAdmin` | `Access` | Access control to check if the user has `admin` permissions. |
88+
| `isAuthenticated` | `Access` | Access control to check if the user is authenticated. |
89+
| `isDocumentOwner` | `Access` | Access control to check if the user owns the document via the `customer` field. Used to limit read, update or delete to only the customers that own this cart. |
90+
| `publicAccess` | `Access` | (Optional) Allow anyone to create a new cart, useful for guests. |
8791

8892
See the [access control section](./plugin#access) for more details on each of these functions.
8993

@@ -94,8 +98,9 @@ import { createCartsCollection } from 'payload-plugin-ecommerce'
9498

9599
const Carts = createCartsCollection({
96100
access: {
97-
adminOrCustomerOwner,
98-
publicAccess,
101+
isAdmin,
102+
isAuthenticated,
103+
isDocumentOwner,
99104
},
100105
enableVariants: true,
101106
currenciesConfig: {
@@ -131,11 +136,11 @@ Use this to create the `orders` collection to store customer orders. It takes th
131136

132137
The access object can contain the following properties:
133138

134-
| Property | Type | Description |
135-
| ---------------------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
136-
| `adminOrCustomerOwner` | `Access` | Access control to check if the user has `admin` permissions or is the owner of the document via the `customer` field. Used to limit read to only the customers that own this order. |
137-
| `adminOnly` | `Access` | Access control to check if the user has `admin` permissions. Used to limit create, update and delete access to only admins. |
138-
| `adminOnlyFieldAccess` | `FieldAccess` | Field level access control to check if the user has `admin` permissions. Limits the transaction ID field to admins only. |
139+
| Property | Type | Description |
140+
| ---------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
141+
| `isAdmin` | `Access` | Access control to check if the user has `admin` permissions. Used to limit create, update and delete access to only admins. |
142+
| `isDocumentOwner` | `Access` | Access control to check if the user owns the document via the `customer` field. Used to limit read to only the customers that own this order. |
143+
| `adminOnlyFieldAccess` | `FieldAccess` | Field level access control to check if the user has `admin` permissions. Limits the transaction ID field to admins only. |
139144

140145
See the [access control section](./plugin#access) for more details on each of these functions.
141146

@@ -146,8 +151,8 @@ import { createOrdersCollection } from 'payload-plugin-ecommerce'
146151

147152
const Orders = createOrdersCollection({
148153
access: {
149-
adminOrCustomerOwner,
150-
adminOnly,
154+
isAdmin,
155+
isDocumentOwner,
151156
adminOnlyFieldAccess,
152157
},
153158
enableVariants: true,
@@ -193,9 +198,9 @@ Use this to create the `transactions` collection to store payment transactions.
193198

194199
The access object can contain the following properties:
195200

196-
| Property | Type | Description |
197-
| ----------- | -------- | ----------------------------------------------------------------------------------------------------- |
198-
| `adminOnly` | `Access` | Access control to check if the user has `admin` permissions. Used to limit all access to only admins. |
201+
| Property | Type | Description |
202+
| --------- | -------- | ----------------------------------------------------------------------------------------------------- |
203+
| `isAdmin` | `Access` | Access control to check if the user has `admin` permissions. Used to limit all access to only admins. |
199204

200205
See the [access control section](./plugin#access) for more details on each of these functions.
201206

@@ -206,7 +211,7 @@ import { createTransactionsCollection } from 'payload-plugin-ecommerce'
206211

207212
const Transactions = createTransactionsCollection({
208213
access: {
209-
adminOnly,
214+
isAdmin,
210215
},
211216
enableVariants: true,
212217
currenciesConfig: {
@@ -252,7 +257,7 @@ The access object can contain the following properties:
252257

253258
| Property | Type | Description |
254259
| ------------------------ | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
255-
| `adminOnly` | `Access` | Access control to check if the user has `admin` permissions. Used to limit create, update or delete to only admins. |
260+
| `isAdmin` | `Access` | Access control to check if the user has `admin` permissions. Used to limit create, update or delete to only admins. |
256261
| `adminOrPublishedStatus` | `Access` | Access control to check if the user has `admin` permissions or if the product has a `published` status. Used to limit read access to published products for non-admins. |
257262

258263
See the [access control section](./plugin#access) for more details on each of these functions.
@@ -264,7 +269,7 @@ import { createProductsCollection } from 'payload-plugin-ecommerce'
264269

265270
const Products = createProductsCollection({
266271
access: {
267-
adminOnly,
272+
isAdmin,
268273
adminOrPublishedStatus,
269274
},
270275
enableVariants: true,
@@ -305,7 +310,7 @@ The access object can contain the following properties:
305310

306311
| Property | Type | Description |
307312
| ------------------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
308-
| `adminOnly` | `Access` | Access control to check if the user has `admin` permissions. Used to limit all access to only admins. |
313+
| `isAdmin` | `Access` | Access control to check if the user has `admin` permissions. Used to limit all access to only admins. |
309314
| `adminOrPublishedStatus` | `Access` | Access control to check if the user has `admin` permissions or if the related product has a `published` status. Used to limit read access to variants of published products for non-admins. |
310315

311316
See the [access control section](./plugin#access) for more details on each of these functions.
@@ -317,7 +322,7 @@ import { createVariantsCollection } from 'payload-plugin-ecommerce'
317322

318323
const Variants = createVariantsCollection({
319324
access: {
320-
adminOnly,
325+
isAdmin,
321326
adminOrPublishedStatus,
322327
},
323328
currenciesConfig: {
@@ -353,8 +358,8 @@ The access object can contain the following properties:
353358

354359
| Property | Type | Description |
355360
| -------------- | -------- | ----------------------------------------------------------------------------------------------------- |
356-
| `adminOnly` | `Access` | Access control to check if the user has `admin` permissions. Used to limit all access to only admins. |
357-
| `publicAccess` | `Access` | Allow anyone to read variant types. |
361+
| `isAdmin` | `Access` | Access control to check if the user has `admin` permissions. Used to limit all access to only admins. |
362+
| `publicAccess` | `Access` | (Optional) Allow anyone to read variant types. |
358363

359364
See the [access control section](./plugin#access) for more details on each of these functions.
360365

@@ -365,7 +370,7 @@ import { createVariantTypesCollection } from 'payload-plugin-ecommerce'
365370

366371
const VariantTypes = createVariantTypesCollection({
367372
access: {
368-
adminOnly,
373+
isAdmin,
369374
publicAccess,
370375
},
371376
})
@@ -384,8 +389,8 @@ The access object can contain the following properties:
384389

385390
| Property | Type | Description |
386391
| -------------- | -------- | ----------------------------------------------------------------------------------------------------- |
387-
| `adminOnly` | `Access` | Access control to check if the user has `admin` permissions. Used to limit all access to only admins. |
388-
| `publicAccess` | `Access` | Allow anyone to read variant options. |
392+
| `isAdmin` | `Access` | Access control to check if the user has `admin` permissions. Used to limit all access to only admins. |
393+
| `publicAccess` | `Access` | (Optional) Allow anyone to read variant options. |
389394

390395
See the [access control section](./plugin#access) for more details on each of these functions.
391396

@@ -396,7 +401,7 @@ import { createVariantOptionsCollection } from 'payload-plugin-ecommerce'
396401

397402
const VariantOptions = createVariantOptionsCollection({
398403
access: {
399-
adminOnly,
404+
isAdmin,
400405
publicAccess,
401406
},
402407
})

0 commit comments

Comments
 (0)