From 486fdca2a0085448f3e91429fea9c1628c284b93 Mon Sep 17 00:00:00 2001
From: Z8MB1E <jason@onyxsimple.com>
Date: Thu, 10 Sep 2026 16:13:51 -0400
Subject: [PATCH] fix(missions): enforce access control on missions pages

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
---
 .../(frontend)/intelligence/missions/[id]/page.tsx | 14 +++++++++-----
 .../intelligence/missions/calendar/page.tsx        |  2 ++
 src/app/(frontend)/intelligence/missions/page.tsx  |  7 +++++++
 3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/src/app/(frontend)/intelligence/missions/[id]/page.tsx b/src/app/(frontend)/intelligence/missions/[id]/page.tsx
index a7ffb97..c751fe2 100644
--- a/src/app/(frontend)/intelligence/missions/[id]/page.tsx
+++ b/src/app/(frontend)/intelligence/missions/[id]/page.tsx
@@ -70,11 +70,18 @@ export default async function MissionDetailPage({ params }: MissionDetailPagePro
   const { id } = await params;
   const payload = await getPayload({ config });
 
+  const { user: currentUser } = await payload.auth({
+    headers: await nextHeaders(),
+    canSetHeaders: false,
+  });
+
   const mission = await payload
     .findByID({
       collection: "missions",
       id: Number(id),
       depth: 2,
+      user: currentUser,
+      overrideAccess: false,
     })
     .catch(() => null);
 
@@ -127,6 +134,8 @@ export default async function MissionDetailPage({ params }: MissionDetailPagePro
             sort: "-classification.startDateTime",
             limit: 5,
             depth: 0,
+            user: currentUser,
+            overrideAccess: false,
             select: {
               name: true,
               codeName: true,
@@ -139,11 +148,6 @@ export default async function MissionDetailPage({ params }: MissionDetailPagePro
 
   const siblingMissions = siblingMissionsRes.docs;
 
-  const { user: currentUser } = await payload.auth({
-    headers: await nextHeaders(),
-    canSetHeaders: false,
-  });
-
   const canManage = currentUser
     ? await hasPermission(payload, currentUser, "missions:update")
     : false;
diff --git a/src/app/(frontend)/intelligence/missions/calendar/page.tsx b/src/app/(frontend)/intelligence/missions/calendar/page.tsx
index f23cb30..15008ad 100644
--- a/src/app/(frontend)/intelligence/missions/calendar/page.tsx
+++ b/src/app/(frontend)/intelligence/missions/calendar/page.tsx
@@ -62,6 +62,8 @@ export default async function FridayCalendarPage() {
     sort: "classification.startDateTime",
     depth: 1,
     limit: 200,
+    user,
+    overrideAccess: false,
     select: {
       name: true,
       codeName: true,
diff --git a/src/app/(frontend)/intelligence/missions/page.tsx b/src/app/(frontend)/intelligence/missions/page.tsx
index e019356..8438349 100644
--- a/src/app/(frontend)/intelligence/missions/page.tsx
+++ b/src/app/(frontend)/intelligence/missions/page.tsx
@@ -1,5 +1,6 @@
 import config from "@payload-config";
 import { getPayload } from "payload";
+import { headers as nextHeaders } from "next/headers";
 import type { Campaign, Mission } from "@/payload-types";
 import { CrosshairIcon } from "lucide-react";
 import { MissionsList } from "@/components/frontend/intelligence/MissionsList";
@@ -10,6 +11,10 @@ export const metadata = {
 
 export default async function MissionsPage() {
   const payload = await getPayload({ config });
+  const { user } = await payload.auth({
+    headers: await nextHeaders(),
+    canSetHeaders: false,
+  });
 
   const missionsRes = await payload
     .find({
@@ -17,6 +22,8 @@ export default async function MissionsPage() {
       sort: "-classification.startDateTime",
       limit: 500,
       depth: 2,
+      user,
+      overrideAccess: false,
     })
     .catch(() => ({ docs: [] }));